🇮🇳
evicky2002
2026-08-09 06:00:00
UTC ·
(3 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-08-08 22:42:16
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 34.81.83.254 (254.83.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 08 18:42:08.097812 2026] [security2:error] [pid 166777:tid 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.81.83.254 (254.83.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 08 18:42:08.097812 2026] [security2:error] [pid 166777:tid 166777] [client 34.81.83.254:55612] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.austli.com"] [uri "/.git/config"] [unique_id "anewwO7U7dvOagYVxcG8NwAAAFg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-08-08 22:31:24
UTC ·
(3 months ago)
CrowdSec: crowdsecurity/http-probing | req: /z9x8c7v6b5-debug-trigger-boissier-sa.com | 11 distinct paths | UA: Mozilla/5.0 (compatible; Amazonbot/0.1; +https://developer.amazon.com/support/amazonbot)
Port Scan
Web App Attack
2026-08-08 22:23:33
UTC ·
(3 months ago)
Blocked by ModSec and CSF
Port Scan
🇺🇸
TPI-Abuse
2026-08-08 22:22:52
UTC ·
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 34.81.83.254 (254.83.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 08 18:22:46.177895 2026] [security2:error] [pid 24217:tid 24 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.81.83.254 (254.83.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 08 18:22:46.177895 2026] [security2:error] [pid 24217:tid 24217] [client 34.81.83.254:58804] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.bikinitweets.com|F|2"] [data ".bikinitweets.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.bikinitweets.com"] [uri "/z9x8c7v6b5-debug-trigger-www.bikinitweets.com"] [unique_id "anesNhLcAMHG4VG615cNdwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-08-08 22:17:51
UTC ·
(3 months ago)
2.537 requests from abuseipdb.com blacklisted IP (1yr10mos1w)
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-08 21:53:16
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 34.81.83.254 (254.83.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 08 17:53:08.601832 2026] [security2:error] [pid 1389412:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.81.83.254 (254.83.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 08 17:53:08.601832 2026] [security2:error] [pid 1389412:tid 1389412] [client 34.81.83.254:35456] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.bhartman.com"] [uri "/.git/HEAD"] [unique_id "anelRIexzA5IG7GNvSYWWwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-08 21:37:57
UTC ·
(3 months ago)
fail2ban: plesk-modsecurity jail on genckocaeli.com
Web App Attack
🇳🇱
Site.eu
2026-08-08 21:31:14
UTC ·
(3 months ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
bigscoots.com
2026-08-08 21:22:40
UTC ·
(3 months ago)
(PERMBLOCK) 34.81.83.254 (TW/Taiwan/254.83.81.34.bc.googleusercontent.com) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: 1; Trigger: LF_PERMBLOCK_COUNT; Logs:
Brute-Force
SSH
🇺🇸
Matthew Ping
2026-08-08 20:00:02
UTC ·
(3 months ago)
cPanel/WHM brute force blocked by CSF/LFD on wp1.
Web App Attack
Brute-Force
🇺🇸
TPI-Abuse
2026-08-08 19:39:42
UTC ·
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 34.81.83.254 (254.83.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 08 15:39:37.155908 2026] [security2:error] [pid 18983:tid 18 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.81.83.254 (254.83.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 08 15:39:37.155908 2026] [security2:error] [pid 18983:tid 18983] [client 34.81.83.254:44366] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.arctic-sea.com"] [uri "/.env"] [unique_id "aneF-ZSNDAYrM9cm2E0sIAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-08 18:59:53
UTC ·
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 34.81.83.254 (254.83.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 08 14:59:49.037547 2026] [security2:error] [pid 793236:tid 7 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.81.83.254 (254.83.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 08 14:59:49.037547 2026] [security2:error] [pid 793236:tid 793236] [client 34.81.83.254:41444] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.ballast-capital.com|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.ballast-capital.com"] [uri "/rclone.conf"] [unique_id "and8pReKFjkV1UQC_iFgCQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-08 18:25:30
UTC ·
(3 months ago)
(mod_security) mod_security (id:949110) triggered by 34.81.83.254 (254.83.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 08 14:25:25.892748 2026] [security2:error] [pid 3760583:tid ...
show more
(mod_security) mod_security (id:949110) triggered by 34.81.83.254 (254.83.81.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 08 14:25:25.892748 2026] [security2:error] [pid 3760583:tid 3760583] [client 34.81.83.254:39060] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.boraborapearlbookings.com"] [uri "/rclone.conf"] [unique_id "and0ldZOTmgOZVnE7xPZXgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Lee Daniel
2026-08-08 17:36:35
UTC ·
(3 months ago)
34.81.83.254 - - [08/Aug/2026:13:36:34 -0400] "GET /manifest.json HTTP/1.1" 404 45767 "https://caribbeannewmedia.com/manifest.json" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
34.81.83.254 - ...
show more
34.81.83.254 - - [08/Aug/2026:13:36:34 -0400] "GET /manifest.json HTTP/1.1" 404 45767 "https://caribbeannewmedia.com/manifest.json" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
34.81.83.254 - - [08/Aug/2026:13:36:34 -0400] "GET /assets/manifest.json HTTP/1.1" 404 45854 "https://caribbeannewmedia.com/assets/manifest.json" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
34.81.83.254 - - [08/Aug/2026:13:36:34 -0400] "GET /webpack-stats.json HTTP/1.1" 404 45797 "https://caribbeannewmedia.com/webpack-stats.json" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
34.81.83.254 - - [08/Aug/2026:13:36:34 -0400] "GET /static/manifest.json HTTP/1.1" 404 45854 "https://caribbeannewmedia.com/static/manifest.json" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
34.81.83.254 - - [
...
show less
DDoS Attack
Web Spam
Email Spam
Port Scan
Brute-Force
Bad Web Bot
Web App Attack