🇪🇸
alferez
2026-06-08 18:09:10
(2 days ago)
Searching .(env|sql|zip|tar|rar) files
Hacking
Exploited Host
Web App Attack
🇳🇱
sernate
2026-06-08 16:48:57
(2 days ago)
(404blocker) 404 trigger 34.79.94.141 (BE/Belgium/141.94.79.34.bc.googleusercontent.com): 80 in the ...
show more
(404blocker) 404 trigger 34.79.94.141 (BE/Belgium/141.94.79.34.bc.googleusercontent.com): 80 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-06-08 15:22:37
(2 days ago)
(mod_security) mod_security (id:210831) triggered by 34.79.94.141 (141.94.79.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210831) triggered by 34.79.94.141 (141.94.79.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 11:22:30.986821 2026] [security2:error] [pid 30218:tid 30218] [client 34.79.94.141:40740] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||yocontrolo.sipco.cl|F|4"] [data "EmailWolf"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "yocontrolo.sipco.cl"] [uri "/api/actuator/env"] [unique_id "aibeNuY07Oz9wS3tQJwoQQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 14:43:45
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 34.79.94.141 (141.94.79.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.79.94.141 (141.94.79.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 10:43:39.400773 2026] [security2:error] [pid 1229:tid 1229] [client 34.79.94.141:47814] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.iam.zombiekillabob.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.iam.zombiekillabob.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aibVG3YMlLjsiPA2pHIlhwAAAFM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-08 14:40:39
(3 days ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 14:16:55
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 34.79.94.141 (141.94.79.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.79.94.141 (141.94.79.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 10:16:48.137530 2026] [security2:error] [pid 21984:tid 21984] [client 34.79.94.141:60976] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||theledmancom.rotarymagnetics.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "theledmancom.rotarymagnetics.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "aibO0JVOZ0Kptj1mHD7hvQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
voormedia
2026-06-08 08:07:18
(3 days ago)
Accessed trap at '/actuator/env'
Web App Attack
🇳🇱
Savvii
2026-06-08 08:07:10
(3 days ago)
20 attempts against mh-misbehave-ban on ec102933
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Hippoline
2026-06-08 06:34:07
(3 days ago)
[Mon Jun 08 08:34:06.209563 2026] [authz_core:error] [pid 9796] [client 34.79.94.141:34030] AH01630: ...
show more
[Mon Jun 08 08:34:06.209563 2026] [authz_core:error] [pid 9796] [client 34.79.94.141:34030] AH01630: client denied by server configuration: /var/www/deppefest.lu/web/phpinfo.php
[Mon Jun 08 08:34:06.274841 2026] [authz_core:error] [pid 9783] [client 34.79.94.141:34070] AH01630: client denied by server configuration: /var/www/deppefest.lu/web/test.php
[Mon Jun 08 08:34:06.283876 2026] [authz_core:error] [pid 9833] [client 34.79.94.141:34056] AH01630: client denied by server configuration: /var/www/deppefest.lu/web/php.php
[Mon Jun 08 08:34:06.287426 2026] [authz_core:error] [pid 12475] [client 34.79.94.141:34086] AH01630: client denied by server configuration: /var/www/deppefest.lu/web/debug.php
[Mon Jun 08 08:34:06.289635 2026] [authz_core:error] [pid 10966] [client 34.79.94.141:34034] AH01630: client denied by server configuration: /var/www/deppefest.lu/web/info.php
[Mon Jun 08 08:34:06.333186 2026] [authz_core:error] [pid 9781] [client 34.79.94.141:34074] AH01630: client denied by se
...
show less
Brute-Force
Web App Attack
🇫🇷
Octopuce
2026-06-08 05:52:33
(3 days ago)
Aggressive web search of vulnerable pages: /phpinfo.php /php.php /info.php /test.php /debug.php /con ...
show more
Aggressive web search of vulnerable pages: /phpinfo.php /php.php /info.php /test.php /debug.php /config.php /parameters.php /database.php /db.p ...
show less
Web App Attack
🇹🇷
baku.hosting
2026-06-08 05:36:54
(3 days ago)
CSF Auto Report: (mod_security) mod_security (id:949110) triggered by 34.79.94.141 (BE/Belgium/141.9 ...
show more
CSF Auto Report: (mod_security) mod_security (id:949110) triggered by 34.79.94.141 (BE/Belgium/141.94.79.34.bc.googleusercontent.com): 5 in the last 3600 secs
show less
Brute-Force
Web App Attack
🇫🇮
oh.mg
2026-06-08 03:03:31
(3 days ago)
34.79.94.141 - - [08/Jun/2026:05:03:30 +0200] "GET /actuator/auditevents HTTP/1.1" 403 3081 "-" "SAM ...
show more
34.79.94.141 - - [08/Jun/2026:05:03:30 +0200] "GET /actuator/auditevents HTTP/1.1" 403 3081 "-" "SAMSUNG-SGH-E250/1.0 Profile/MIDP-2.0 Configuration/CLDC-1.1 UP.Browser/6.2.3.3.c.1.101 (GUI) MMP/2.0 (compatible; Googlebot-Mobile/2.1; http://www.google.com/bot.html)"
34.79.94.141 - - [08/Jun/2026:05:03:30 +0200] "GET /.aws/credentials HTTP/1.1" 403 3082 "-" "Mozilla/5.0 (Linux; Android 9; CLT-L09) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.143 Mobile Safari/537.36"
34.79.94.141 - - [08/Jun/2026:05:03:30 +0200] "GET /.aws/config HTTP/1.1" 403 3082 "-" "Mozilla/5.0 (Linux; Android 8.1.0; Redmi Y2) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"
34.79.94.141 - - [08/Jun/2026:05:03:30 +0200] "GET /.config/gcloud/credentials.db HTTP/1.1" 403 3082 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.94 Safari/537.36"
34.79.94.141 - - [08/Jun/2026:05:03:30 +0200] "GET /.azure/credentials HTTP/1.1"
...
show less
Bad Web Bot
Web App Attack
🇬🇧
venus.launch.bz
2026-06-08 02:46:32
(3 days ago)
(mod_security) mod_security triggered on hostname [redacted] 34.79.94.141 (BE/Belgium/141.94.79.34.b ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.79.94.141 (BE/Belgium/141.94.79.34.bc.googleusercontent.com)
show less
SQL Injection
🇮🇹
VHosting
2026-06-08 01:40:04
(3 days ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-06-08 01:15:20
(3 days ago)
Excessive 404/403 errors
Brute-Force