🇺🇸
TPI-Abuse
2026-10-03 06:50:34
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.95.165.172 (172.165.95.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.95.165.172 (172.165.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 02:50:30.547607 2026] [security2:error] [pid 9999:tid 9999] [client 34.95.165.172:39558] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.1cdn.com"] [uri "/css../.env"] [unique_id "asCltubcEOp_qTZZqV4PNwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-03 06:49:36
(3 weeks ago)
"GET /api/fs/read?allowOutsideWorkspace=true&path=/app/.env HTTP/1.1"
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-03 06:30:53
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.95.165.172 (172.165.95.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.95.165.172 (172.165.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 02:30:48.840130 2026] [security2:error] [pid 24350:tid 24350] [client 34.95.165.172:43440] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.3beeze.bridgital.com|F|2"] [data ".3beeze.bridgital.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.3beeze.bridgital.com"] [uri "/z9x8c7v6b5-debug-trigger-www.3beeze.bridgital.com"] [unique_id "asChGMOvyGoopknjlxVNvQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-03 05:16:37
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.95.165.172 (172.165.95.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.95.165.172 (172.165.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 01:16:33.447996 2026] [security2:error] [pid 6105:tid 6105] [client 34.95.165.172:56532] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.4dbm.com"] [uri "/web.config"] [unique_id "asCPsa2uETTL29hTA6Z7SQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-03 04:49:12
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.95.165.172 (172.165.95.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.95.165.172 (172.165.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 00:49:07.510764 2026] [security2:error] [pid 7399:tid 7425] [client 34.95.165.172:57794] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.3stepreviewforyou.docdalton.com|F|2"] [data ".3stepreviewforyou.docdalton.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.3stepreviewforyou.docdalton.com"] [uri "/z9x8c7v6b5-debug-trigger-www.3stepreviewforyou.docdalton.com"] [unique_id "asCJQ-oR-ven96SzNZ-ChwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mad-abuseip
2026-10-03 03:13:11
(3 weeks ago)
SCORE:99 REASON:suspicious-score:103 | "POST /api/v1/node-load-method/customMCP HTTP/1.1" SCORE:99 ...
show more
SCORE:99 REASON:suspicious-score:103 | "POST /api/v1/node-load-method/customMCP HTTP/1.1" SCORE:99 REASON:suspicious-score:103 - "Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-03 02:45:44
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.95.165.172 (172.165.95.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.95.165.172 (172.165.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 22:45:38.897683 2026] [security2:error] [pid 31951:tid 31951] [client 34.95.165.172:58062] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||4photogifts.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "4photogifts.com"] [uri "/z9x8c7v6b5-debug-trigger-4photogifts.com"] [unique_id "asBsUmsWzpSKFB3wAXdfaAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-03 00:25:32
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.95.165.172 (172.165.95.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.95.165.172 (172.165.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 20:25:28.335521 2026] [security2:error] [pid 1996716:tid 1996716] [client 34.95.165.172:55028] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||callalbany.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "callalbany.com"] [uri "/z9x8c7v6b5-debug-trigger-callalbany.com"] [unique_id "asBLeJFXiWUSkhoKgejdNwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-02 21:11:14
(3 weeks ago)
FPROCO WEBEXPLOIT 34.95.165.172 (172.165.95.34.bc.googleusercontent.com)
Web App Attack
🇹🇷
ferique
2026-10-02 20:13:42
(3 weeks ago)
Real-time Intercept: DNN_AUTH attack. Reference: 2026-10-02 23:13:32.6352 Login failure: 34.95.165. ...
show more
Real-time Intercept: DNN_AUTH attack. Reference: 2026-10-02 23:13:32.6352 Login failure: 34.95.165.172 DNN_AUTH
show less
Web App Attack
Bad Web Bot
🇪🇸
pipeline.es
2026-10-02 19:25:17
(3 weeks ago)
Web scanning / probing for vulnerable paths | URL: /gcp-service.json | Evidence: 3tbooking.com 34.95 ...
show more
Web scanning / probing for vulnerable paths | URL: /gcp-service.json | Evidence: 3tbooking.com 34.95.165.172 - - [02/Oct/2026:21:23:55 +0200] \"GET /gcp-service.json HTTP/2.0\" 404 27599 \"-\" \"Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email])\" GEOIP_COUNTRY_CODE=BR 20701 | ASN: GOOGLE-CLOUD-PLATFORM | Country: BR
show less
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 18:25:58
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.95.165.172 (172.165.95.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.95.165.172 (172.165.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 14:25:53.870655 2026] [security2:error] [pid 12618:tid 12618] [client 34.95.165.172:47196] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.48consultancy.com|F|2"] [data ".48consultancy.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.48consultancy.com"] [uri "/z9x8c7v6b5-debug-trigger-www.48consultancy.com"] [unique_id "ar_3Mdd0uSTmAO_Cv8bDAwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 16:47:18
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.95.165.172 (172.165.95.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 34.95.165.172 (172.165.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 12:47:10.284206 2026] [security2:error] [pid 29219:tid 29219] [client 34.95.165.172:36288] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.3dcounty.com"] [uri "/wp-config.php.old"] [unique_id "ar_gDtUbUGBcgeh1CG57OQAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 16:24:44
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 34.95.165.172 (172.165.95.34.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 34.95.165.172 (172.165.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 12:24:38.415016 2026] [security2:error] [pid 17553:tid 17553] [client 34.95.165.172:33618] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||1derfulwaysrv.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "1derfulwaysrv.com"] [uri "/z9x8c7v6b5-debug-trigger-1derfulwaysrv.com"] [unique_id "ar_axrhFMFBsnnEDWq-MaAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-10-02 14:40:04
(3 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
