🇭🇺
DumaNet
2026-05-30 05:59:00
(1 week ago)
TCP connect flood, port scan (Port: 80/TCP).
Date: Sat May 30. 06:04:26 2026 +0200
IP: 34.81.26.14 ...
show more
TCP connect flood, port scan (Port: 80/TCP).
Date: Sat May 30. 06:04:26 2026 +0200
IP: 34.81.26.148 (TW/Taiwan/148.26.81.34.bc.googleusercontent.com)
Connections (sample):
tcp6: 34.81.26.148:33196 -> [removed]:80 (TIME_WAIT)
tcp6: 34.81.26.148:60014 -> [removed]:80 (TIME_WAIT)
tcp6: 34.81.26.148:58040 -> [removed]:80 (TIME_WAIT)
tcp6: 34.81.26.148:57214 -> [removed]:80 (TIME_WAIT)
tcp6: 34.81.26.148:33374 -> [removed]:80 (TIME_WAIT)
tcp6: 34.81.26.148:59324 -> [removed]:80 (TIME_WAIT)
tcp6: 34.81.26.148:56796 -> [removed]:80 (TIME_WAIT)
tcp6: 34.81.26.148:59538 -> [removed]:80 (TIME_WAIT)
tcp6: 34.81.26.148:34110 -> [removed]:80 (TIME_WAIT)
tcp6: 34.81.26.148:57576 -> [removed]:80 (TIME_WAIT)
tcp6: 34.81.26.148:57598 -> [removed]:80 (TIME_WAIT)
tcp6: 34.81.26.148:60064 -> [removed]:80 (TIME_WAIT)
tcp6: 34.81.26.148:33842 -> [removed]:80 (TIME_WAIT)
tcp6: 34.81.26.148:58396 -> [removed]:80 (TIME_WAIT)
tcp6: 34.81.26.148:33078 -> [removed]:80
.... (765 times/attempts total at same time).
show less
Port Scan
Brute-Force
🇳🇱
Savvii
2026-05-30 04:52:52
(1 week ago)
20 attempts against mh-misbehave-ban on flow
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-30 03:05:28
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.81.26.148 (148.26.81.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.81.26.148 (148.26.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 23:05:23.310432 2026] [security2:error] [pid 11866:tid 11866] [client 34.81.26.148:40122] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||192.64.150.226|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "192.64.150.226"] [uri "/.config/gcloud/credentials.db"] [unique_id "ahpT87qqJeAVDnWr2v4bRgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
gadix
2026-05-30 00:15:55
(1 week ago)
[30/May/2026:02:15:54.037956 +0200] ahosOiCgEIvF1kr6TB_cVAAAAAk 34.81.26.148 52240 127.0.0.1 7080
[3 ...
show more
[30/May/2026:02:15:54.037956 +0200] ahosOiCgEIvF1kr6TB_cVAAAAAk 34.81.26.148 52240 127.0.0.1 7080
[30/May/2026:02:15:54.577614 +0200] ahosOu8p6-C0CNtyFSsCIgAAAAc 34.81.26.148 52884 127.0.0.1 7080
[30/May/2026:02:15:54.586744 +0200] ahosOkF07kRe5dG4F4DnPwAAAAI 34.81.26.148 52890 127.0.0.1 7080
...
show less
Web App Attack
🇳🇱
i-turnradio.nl
2026-05-29 22:28:52
(1 week ago)
2026-05-30 @ 00:28:51 (CET) ~ Blocked for trying to access: /actuator/httptrace
Web App Attack
🇺🇸
TPI-Abuse
2026-05-29 04:04:54
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.81.26.148 (148.26.81.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.81.26.148 (148.26.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 00:04:48.554306 2026] [security2:error] [pid 2551:tid 2571] [client 34.81.26.148:55142] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||192.64.150.127|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "192.64.150.127"] [uri "/.config/gcloud/credentials.db"] [unique_id "ahkQYBUMp7G8XC67yChP1AAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
EricTheRedFL
2026-05-29 03:01:17
(1 week ago)
web.ab-data.us:80 34.81.26.148 - - [28/May/2026:23:01:11 -0400] "\x16\x03\x01" 301 653 "-" "-"
web.a ...
show more
web.ab-data.us:80 34.81.26.148 - - [28/May/2026:23:01:11 -0400] "\x16\x03\x01" 301 653 "-" "-"
web.ab-data.us:80 34.81.26.148 - - [28/May/2026:23:01:11 -0400] "\x16\x03\x01" 301 653 "-" "-"
web.ab-data.us:80 34.81.26.148 - - [28/May/2026:23:01:11 -0400] "\x16\x03\x01" 301 653 "-" "-"
web.ab-data.us:80 34.81.26.148 - - [28/May/2026:23:01:11 -0400] "\x16\x03\x01" 301 653 "-" "-"
web.ab-data.us:80 34.81.26.148 - - [28/May/2026:23:01:11 -0400] "\x16\x03\x01" 301 653 "-" "-"
...
show less
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-29 00:40:50
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 34.81.26.148 (148.26.81.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.81.26.148 (148.26.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 28 20:40:45.053136 2026] [security2:error] [pid 23924:tid 23924] [client 34.81.26.148:36036] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||192.64.150.137|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "192.64.150.137"] [uri "/sql/backup.sql"] [unique_id "ahjgjTDgQm7MtrnACKOs5AAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
ioscloud.co.id
2026-05-28 23:40:15
(1 week ago)
[OGWAF] bad_reputation attack blocked | severity: high | GET /api/actuator/logfile | UA: Mozilla/5.0 ...
show more
[OGWAF] bad_reputation attack blocked | severity: high | GET /api/actuator/logfile | UA: Mozilla/5.0 (iPhone; CPU iPhone OS 11_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Vers
show less
Web App Attack
🇫🇷
dynamix
2026-05-28 22:04:36
(1 week ago)
Multiple WAF Violations
Web App Attack