🇩🇪
updown.io
2026-09-24 07:19:57
UTC ·
(1 month ago)
{"level":"info","ts":1790234380.205469,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.89.169.253","remote_port":"35642","client_ip":"34.89.169.253","proto":"HTTP/1.1","method":"GET","host":"bupdate.zyxwvutupdate.lk ...
show more
{"level":"info","ts":1790234380.205469,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.89.169.253","remote_port":"35642","client_ip":"34.89.169.253","proto":"HTTP/1.1","method":"GET","host":"bupdate.zyxwvutupdate.lknmlkjilkjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io","uri":"/.codex/config.json","headers":{"Accept":["*/*"],"User-Agent":["crusader-worker/1.0"]}},"bytes_read":0,"user_id":"","duration":0.000045496,"size":0,"status":308,"resp_headers":{"Connection":["close"],"Location":["https://bupdate.zyxwvutupdate.lknmlkjilkjihgc7402a95-6fc9-4756-b4e6-fa6c7eeb29c6.random.159.89.98.98.nip.io/.codex/config.json"],"Content-Type":[],"Server":["Caddy"]}}
{"level":"info","ts":1790234380.2082846,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.89.169.253","remote_port":"35644","client_ip":"34.89.169.253","proto":"HTTP/1.1","method":"GET","host":"bupdate.zyxwvutupdate.lknmlkjilkjihgc7402a95-6fc9-4756-b4e
...
show less
DDoS Attack
Web App Attack
🇳🇱
Savvii
2026-09-24 07:05:53
UTC ·
(1 month ago)
20 attempts against mh-misbehave-ban on ethyl
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-24 03:52:40
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.89.169.253 (253.169.89.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 23:52:32.000871 2026] [security2:error] [pid 5104:tid 5 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.89.169.253 (253.169.89.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 23:52:32.000871 2026] [security2:error] [pid 5104:tid 5104] [client 34.89.169.253:42360] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||blackjobsnetwork.com|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blackjobsnetwork.com"] [uri "/.codex/auth.json.bak"] [unique_id "arSef3yNheFRrazuYH8ZKwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 21:41:25
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.89.169.253 (253.169.89.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 17:41:18.494530 2026] [security2:error] [pid 7804:tid 7 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.89.169.253 (253.169.89.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 17:41:18.494530 2026] [security2:error] [pid 7804:tid 7804] [client 34.89.169.253:59766] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aws.corepest.com|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aws.corepest.com"] [uri "/.codex/auth.json.bak"] [unique_id "arRHfjd6wAP1mi88-SPtiQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-09-23 21:15:02
UTC ·
(1 month ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
2026-09-23 17:23:01
UTC ·
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇩🇪
BlueWire Hosting
2026-09-23 16:37:54
UTC ·
(1 month ago)
Aggressive scanning resulting into 404
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-23 16:23:18
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.89.169.253 (253.169.89.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 12:23:14.993971 2026] [security2:error] [pid 9294:tid 9 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.89.169.253 (253.169.89.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 12:23:14.993971 2026] [security2:error] [pid 9294:tid 9294] [client 34.89.169.253:38902] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||atheismz.com|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "atheismz.com"] [uri "/.codex/auth.json.bak"] [unique_id "arP88na0VBrR3LKTLj5PUQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Artelis
2026-09-23 15:09:44
UTC ·
(1 month ago)
34.89.169.253 - - [23/Sep/2026:15:09:43 +0000] "GET /.codex/config.toml HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:15:09:43 +0000] "GET /.codex/auth.json HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.89.169.253 - - [2 ...
show more
34.89.169.253 - - [23/Sep/2026:15:09:43 +0000] "GET /.codex/config.toml HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:15:09:43 +0000] "GET /.codex/auth.json HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:15:09:43 +0000] "GET /backup/.claude.json HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:15:09:43 +0000] "GET /backup/.claude/credentials.json HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:15:09:43 +0000] "GET /bak/.codex/auth.json HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:15:09:43 +0000] "GET /.codex/auth.json.txt HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:15:09:43 +0000] "GET /backup/.codex/auth.json HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:15:09:43 +0000] "GET /.codex/auth.json.bak HTTP/1.1" 404 146 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:15:09:43 +0000] "G
...
show less
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-23 15:06:45
UTC ·
(1 month ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇩🇪
yitzhaq
2026-09-23 08:34:39
UTC ·
(1 month ago)
34.89.169.253 - - [23/Sep/2026:10:34:35 +0200] "GET /data/.claude.json HTTP/1.1" 404 449 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:10:34:35 +0200] "GET /api/.codex/auth.json HTTP/1.1" 404 449 "-" "crusader-worker/1.0"
34.89.169.253 - - ...
show more
34.89.169.253 - - [23/Sep/2026:10:34:35 +0200] "GET /data/.claude.json HTTP/1.1" 404 449 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:10:34:35 +0200] "GET /api/.codex/auth.json HTTP/1.1" 404 449 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:10:34:35 +0200] "GET /app/.claude/credentials.json HTTP/1.1" 404 449 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:10:34:35 +0200] "GET /wwwroot/.codex/auth.json HTTP/1.1" 404 449 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:10:34:35 +0200] "GET /htdocs/.codex/auth.json HTTP/1.1" 404 449 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:10:34:35 +0200] "GET /web/.codex/auth.json HTTP/1.1" 404 449 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:10:34:35 +0200] "GET /tmp/.codex/auth.json HTTP/1.1" 404 449 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:10:34:35 +0200] "GET /home/.codex/auth.json HTTP/1.1" 404 449 "-" "crusader-worker/1.0"
34.89.169.253 - - [23/Sep/2026:10:34:35 +02
show less
Bad Web Bot
🇫🇷
masterguru
2026-09-23 08:27:36
UTC ·
(1 month ago)
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .compositefont/ .config/ .conf/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .d ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .compositefont/ .config/ .conf/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .scr/ .sct/ .shs/ .sql/ .swp/ .sys/ .tlb/ .tmp/ .url/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-195)
show less
Hacking
🇺🇸
TPI-Abuse
2026-09-23 08:20:21
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.89.169.253 (253.169.89.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 04:20:13.685001 2026] [security2:error] [pid 23643:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 34.89.169.253 (253.169.89.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 04:20:13.685001 2026] [security2:error] [pid 23643:tid 23643] [client 34.89.169.253:43434] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||anchorroots.com|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "anchorroots.com"] [uri "/.codex/auth.json.bak"] [unique_id "arOLvbhRAuDzajwSm9lOOgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Marc
2026-09-23 07:28:58
UTC ·
(1 month ago)
34.89.169.253 - - [23/Sep/2026:09:28:57 +0200] "-" 408 361 "-" "-" 34.89.169.253 - - [23/Sep/2026:09:28:57 +0200] "-" 408 361 "-" "-" 34.89.169.253 - - [23/Sep/2026:09:28:57 +0200] "-" 408 361 "-" "-"
Brute-Force
🇮🇹
VHosting
2026-09-23 06:40:08
UTC ·
(1 month ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
