🇩🇪
ger-stg-sifi1
2026-10-09 20:55:52
(1 day ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇦🇺
paulshipley.com.au
2026-10-09 20:18:03
(1 day ago)
[Sat Oct 10 07:18:01.440314 2026] [security2:error] [pid 704822] [client 34.85.236.238:39106] [clien ...
show more
[Sat Oct 10 07:18:01.440314 2026] [security2:error] [pid 704822] [client 34.85.236.238:39106] [client 34.85.236.238] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "rjryanpartners.com.au"] [uri "/.ssh/id_rsa"] [unique_id "aslL-afkc0JurQRBxoR4LwAAAAo"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 20:09:27
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.85.236.238 (238.236.85.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.85.236.238 (238.236.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 16:09:23.491034 2026] [security2:error] [pid 6912:tid 6912] [client 34.85.236.238:33276] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rentaroller.com.au"] [uri "/.htpasswd"] [unique_id "aslJ8yodOyLy6Zcv2nJ6lgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
AWW-Admin
2026-10-09 19:44:40
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted] 34.85.236.238 (US/United States/238.236 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 34.85.236.238 (US/United States/238.236.85.34.bc.googleusercontent.com)
show less
SQL Injection
🇦🇺
Bay13
2026-10-09 19:34:33
(1 day ago)
CrowdSec:custom/http-probing
Web App Attack
2026-10-09 18:58:05
(1 day ago)
34.85.236.238 - - [09/Oct/2026:18:58:05 +0000] "GET /@fs/app/.env?raw?? HTTP/2.0" 404 42921 "-" "Moz ...
show more
34.85.236.238 - - [09/Oct/2026:18:58:05 +0000] "GET /@fs/app/.env?raw?? HTTP/2.0" 404 42921 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 18:26:35
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.85.236.238 (238.236.85.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.85.236.238 (238.236.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 14:26:29.180250 2026] [security2:error] [pid 22983:tid 22983] [client 34.85.236.238:54542] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "newlife.org.au"] [uri "/.htpasswd"] [unique_id "askx1XuOaCtR74KvY_f48QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
A.i.D.A.N.N
2026-10-09 18:16:37
(1 day ago)
A.i.D.A.N.N: Anomaly Detected - Signature match Web Service - Web vulnerability scanning detected
Web App Attack
2026-10-09 16:50:04
(1 day ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇦🇺
Klaverstyn
2026-10-09 16:38:23
(1 day ago)
Excessive HTTP request rate
Web App Attack
🇦🇺
screwlooseit.com.au
2026-10-09 16:24:30
(1 day ago)
Blocked by CSF 13 firewall - Rule: config-dotfile
US/United States/238.236.85.34.bc.googleuserconten ...
show more
Blocked by CSF 13 firewall - Rule: config-dotfile
US/United States/238.236.85.34.bc.googleusercontent.com
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 16:20:48
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 34.85.236.238 (238.236.85.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.85.236.238 (238.236.85.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 12:20:40.245117 2026] [security2:error] [pid 16894:tid 16894] [client 34.85.236.238:48372] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||joyflightsunshinecoast.com.au|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "joyflightsunshinecoast.com.au"] [uri "/server.key"] [unique_id "askUWMRNZ7zYSkpNW_S-uQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
2000cn.com.au
2026-10-09 16:19:42
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/grafana-cve-2021-43798
Web App Attack
Hacking
🇺🇸
oralunal
2026-10-09 16:08:21
(1 day ago)
IP banned by Fail2Ban in jail its-suss access.log mvfnds
...
Bad Web Bot
Web App Attack
🇩🇪
Blexyel
2026-10-09 15:46:30
(1 day ago)
34.85.236.238 - - [09/Oct/2026:17:46:28 +0200] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1 ...
show more
34.85.236.238 - - [09/Oct/2026:17:46:28 +0200] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/1.1" 404 577 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
...
show less
Brute-Force
Web App Attack
