2026-10-11 16:35:41
(4 days ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇨🇦
polycoda
2026-10-11 11:52:42
(5 days ago)
🔥 VERY AGGRESSIVE SCANNER probed over 500 inexistent files and PHP scripts in less than an hour.
Hacking
Web App Attack
🇷🇸
pexodelic
2026-10-11 10:05:02
(5 days ago)
Automated report from web, SSH and FTP server logs: 248 requests probing for exposed secrets (.env, ...
show more
Automated report from web, SSH and FTP server logs: 248 requests probing for exposed secrets (.env, .git, config files). First reported 2026-10-10 19:05 UTC, last reported 2026-10-11 12:05 UTC; counts cover the current log rotation window.
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 03:07:57
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 34.83.228.94 (94.228.83.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.83.228.94 (94.228.83.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 23:07:51.794378 2026] [security2:error] [pid 8141:tid 8141] [client 34.83.228.94:38596] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||pamplonaserviciotecnico.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pamplonaserviciotecnico.com"] [uri "/z9x8c7v6b5-debug-trigger-pamplonaserviciotecnico.com"] [unique_id "asr9h3XmG-uiUyiOuZf8wAAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
[email protected]
2026-10-11 02:53:48
(5 days ago)
CrowdSec ban: crowdsecurity/http-admin-interface-probing (duration: 71h59m58s)
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 02:42:56
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 34.83.228.94 (94.228.83.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.83.228.94 (94.228.83.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 22:42:49.789206 2026] [security2:error] [pid 8514:tid 8514] [client 34.83.228.94:39006] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mike-garner.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mike-garner.com"] [uri "/z9x8c7v6b5-debug-trigger-mike-garner.com"] [unique_id "asr3qbD24zjzTF6VALXgrwAAAD0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
polycoda
2026-10-11 02:39:56
(5 days ago)
AutoBlock: 📡 Port Scan (Non Decay-Based) - ❌ Excessive 40X Errors (Decay-Based)
Port Scan
Bad Web Bot
2026-10-11 01:42:41
(5 days ago)
Banned by Fail2Ban on server
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 01:39:25
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 34.83.228.94 (94.228.83.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.83.228.94 (94.228.83.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 21:39:22.378689 2026] [security2:error] [pid 32712:tid 32712] [client 34.83.228.94:54970] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||michleen-collins.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "michleen-collins.com"] [uri "/z9x8c7v6b5-debug-trigger-michleen-collins.com"] [unique_id "asroytVNnwNZGJXCNhbKrAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-11 01:20:06
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 34.83.228.94 (94.228.83.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.83.228.94 (94.228.83.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 21:19:55.498665 2026] [security2:error] [pid 29416:tid 29421] [client 34.83.228.94:36410] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||michaelmercier.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "michaelmercier.com"] [uri "/z9x8c7v6b5-debug-trigger-michaelmercier.com"] [unique_id "asrkO7dH31l52wH47UJAwwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-10-11 00:18:39
(5 days ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-10-11 00:17:50
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 34.83.228.94 (94.228.83.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.83.228.94 (94.228.83.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 20:17:45.219625 2026] [security2:error] [pid 18996:tid 18996] [client 34.83.228.94:40586] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mfleetservice.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mfleetservice.com"] [uri "/z9x8c7v6b5-debug-trigger-mfleetservice.com"] [unique_id "asrVqcMF8An24sD9w70fCwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-10 23:55:10
(5 days ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇺🇸
Major Hostility
2026-10-10 23:40:32
(5 days ago)
"GET /app HTTP/1.1" 404
"GET /signin HTTP/1.1" 404
"GET /dwj4dptwl8cbmpm3g05e HTTP/1.1" 404
"GET /we ...
show more
"GET /app HTTP/1.1" 404
"GET /signin HTTP/1.1" 404
"GET /dwj4dptwl8cbmpm3g05e HTTP/1.1" 404
"GET /webpack-stats.json HTTP/1.1" 404
"GET /sign-in HTTP/1.1" 404
"GET /el6hh0ajppnrz6ko722x HTTP/1.1" 404
"GET /portal HTTP/1.1" 404
"GET /signup HTTP/1.1" 404
"GET /forgot-password HTTP/1.1" 404
"GET /register HTTP/1.1" 404
"GET /admin/login HTTP/1.1" 404
"GET /manifest.json HTTP/1.1" 404
"GET /secure HTTP/1.1" 404
"GET /account HTTP/1.1" 404
"GET /backoffice HTTP/1.1" 404
"GET /reset-password HTTP/1.1" 404
"GET /account/login HTTP/1.1" 404
"GET /console HTTP/1.1" 404
"GET /user/login HTTP/1.1" 404
"GET /login HTTP/1.1" 404
"GET /auth/login HTTP/1.1" 404
show less
Web App Attack
🇺🇸
antlac1
2026-10-10 23:26:23
(5 days ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
