2026-10-11 02:59:29
(2 weeks ago)
Aggressive web scan
Web App Attack
🇫🇷
Quarks Solutions
2026-10-11 02:04:00
(2 weeks ago)
crowdsecurity/appsec-vpatch
Web App Attack
🇬🇧
andypiper
2026-10-11 01:01:12
(2 weeks ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇹🇷
ferique
2026-10-11 00:52:53
(2 weeks ago)
Real-time Intercept: DNN_AUTH attack. Reference: 2026-10-11 03:52:50.2158 Login failure: 34.77.206. ...
show more
Real-time Intercept: DNN_AUTH attack. Reference: 2026-10-11 03:52:50.2158 Login failure: 34.77.206.225 DNN_AUTH
show less
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-11 00:15:04
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.77.206.225 (225.206.77.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.77.206.225 (225.206.77.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 20:14:56.847122 2026] [security2:error] [pid 927:tid 927] [client 34.77.206.225:48132] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||raynernet.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "raynernet.com"] [uri "/z9x8c7v6b5-debug-trigger-raynernet.com"] [unique_id "asrVAM5PTiO_GPXna84eVAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 23:57:11
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.77.206.225 (225.206.77.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.77.206.225 (225.206.77.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 19:57:05.158814 2026] [security2:error] [pid 16046:tid 16046] [client 34.77.206.225:35142] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||micahgartman.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "micahgartman.com"] [uri "/z9x8c7v6b5-debug-trigger-micahgartman.com"] [unique_id "asrQ0TXEORXJVOvJMos_VgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
cwytech
2026-10-10 23:55:46
(2 weeks ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: crowdsecurity/http-probing.
Bad Web Bot
Web App Attack
🇺🇸
TAY
2026-10-10 23:46:20
(2 weeks ago)
34.77.206.225 - - [11/Oct/2026:07:46:12 +0800] "GET /@fs/../.env?raw?? HTTP/1.1" 404 43899 "-" "Mozi ...
show more
34.77.206.225 - - [11/Oct/2026:07:46:12 +0800] "GET /@fs/../.env?raw?? HTTP/1.1" 404 43899 "-" "Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)"
34.77.206.225 - - [11/Oct/2026:07:46:15 +0800] "GET /@fs/../.env?import&raw?? HTTP/1.1" 404 43899 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)"
34.77.206.225 - - [11/Oct/2026:07:46:19 +0800] "GET /_nuxt/../.env HTTP/1.1" 404 43899 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
34.77.206.225 - - [11/Oct/2026:07:46:19 +0800] "GET /_image?href=/../../../.env HTTP/1.1" 404 38122 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"
34.77.206.225 - - [11/Oct/2026:07:46:20 +0800] "GET /public/plugins/alertlist/../../../../../../../../proc/self/environ HTTP/1.1" 400 7834 "-" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sh
...
show less
Brute-Force
2026-10-10 23:43:31
(2 weeks ago)
Banned by Fail2Ban on server
Web App Attack
🇬🇧
consul.to
2026-10-10 23:38:53
(2 weeks ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 23:34:53
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.77.206.225 (225.206.77.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.77.206.225 (225.206.77.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 19:34:45.751996 2026] [security2:error] [pid 2419:tid 2419] [client 34.77.206.225:44662] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||greighhouse.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "greighhouse.com"] [uri "/z9x8c7v6b5-debug-trigger-greighhouse.com"] [unique_id "asrLlaeXlHFzy23r_KpUbQAAAC0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 23:19:42
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.77.206.225 (225.206.77.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.77.206.225 (225.206.77.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 19:19:35.970265 2026] [security2:error] [pid 5527:tid 5550] [client 34.77.206.225:37080] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||docdalton.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "docdalton.com"] [uri "/z9x8c7v6b5-debug-trigger-docdalton.com"] [unique_id "asrIBwVXFzixCVqXl19VOgAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-10 23:15:56
(2 weeks ago)
Web App Attack
Brute-Force
Exploited Host
Web App Attack
🇺🇸
mad-abuseip
2026-10-10 22:57:08
(2 weeks ago)
SCORE:99 REASON:suspicious-score:100 | "GET /api/w/admins/jobs_u/get_log_file/../../../../proc/self/ ...
show more
SCORE:99 REASON:suspicious-score:100 | "GET /api/w/admins/jobs_u/get_log_file/../../../../proc/self/environ HTTP/1.1" SCORE:99 REASON:suspicious-score:100 - "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; +***@anthropic.com)"
show less
Web App Attack
🇬🇧
noise.agency
2026-10-10 22:51:14
(2 weeks ago)
34.77.206.225 (BE/Belgium/225.206.77.34.bc.googleusercontent.com), more than 30 Apache 404 hits
Hacking
