🇫🇷
SpaceHost-Server
2026-09-24 22:24:43
UTC ·
(1 month ago)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-24 09:23:43
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.95.61.12 (12.61.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 24 05:23:39.411956 2026] [security2:error] [pid 25517:tid 2551 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.95.61.12 (12.61.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 24 05:23:39.411956 2026] [security2:error] [pid 25517:tid 25517] [client 34.95.61.12:39904] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||canadianprimarysources.org|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "canadianprimarysources.org"] [uri "/.codex/auth.json.bak"] [unique_id "arTsG9ct7aXraSaSdv1LkAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
macrob
2026-09-24 08:34:46
UTC ·
(1 month ago)
2026/09/24 08:34:44 [error] 2420250#2420250: *31133633 access forbidden by rule, client: 34.95.61.12, server: ca5h.win, request: "GET /.claude/settings.local.json HTTP/1.1", host: "ca5h.win"
2026/09/24 08:34:44 [error] 2420250#2420250: *31133635 acce ...
show more
2026/09/24 08:34:44 [error] 2420250#2420250: *31133633 access forbidden by rule, client: 34.95.61.12, server: ca5h.win, request: "GET /.claude/settings.local.json HTTP/1.1", host: "ca5h.win"
2026/09/24 08:34:44 [error] 2420250#2420250: *31133635 access forbidden by rule, client: 34.95.61.12, server: ca5h.win, request: "GET /.claude/settings.json HTTP/1.1", host: "ca5h.win"
2026/09/24 08:34:44 [error] 2420248#2420248: *31133634 access forbidden by rule, client: 34.95.61.12, server: ca5h.win, request: "GET /.claude.json HTTP/1.1", host: "ca5h.win"
...
show less
Web App Attack
🇳🇱
Cloud86 B.V.
2026-09-24 07:24:02
UTC ·
(1 month ago)
categories: DDoS Attack
DDoS Attack
🇬🇧
openstrike.co.uk
2026-09-24 05:14:39
UTC ·
(1 month ago)
16 attacks on password/key grabbing URLs:
GET /app/.claude/credentials.json HTTP/1.1
Hacking
🇺🇸
TPI-Abuse
2026-09-23 18:31:39
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.95.61.12 (12.61.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 14:31:35.541879 2026] [security2:error] [pid 14745:tid 1474 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.95.61.12 (12.61.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 14:31:35.541879 2026] [security2:error] [pid 14745:tid 14745] [client 34.95.61.12:33428] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.lexie.org|F|2"] [data ".json.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.lexie.org"] [uri "/.codex/auth.json.old"] [unique_id "arQbB7exQyUcGOXtQToKhwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-09-23 16:12:53
UTC ·
(1 month ago)
[WedSep2318:12:47.2163092026][security2:error][pid874061:tid874145][client34.95.61.12:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/.dat/. ...
show more
[WedSep2318:12:47.2163092026][security2:error][pid874061:tid874145][client34.95.61.12:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Stringmatchwithin\".asa/.asax/.ascx/.backup/.bak/.bat/.cdx/.cer/.cfg/.cmd/.com/.config/.conf/.cs/.csproj/.csr/.dat/.db/.dbf/.dll/.dos/.htr/.htw/.ida/.idc/.idq/.inc/.ini/.key/.licx/.lnk/.log/.mdb/.old/.pass/.pdb/.pol/.printer/.pwd/.rdb/.resources/.resx/.sql/.swp/.sys/.vb/.vbs/.vbproj/.vsdisco/.webinfo/.xsx/\"atTX:extension.[file\"/etc/apache2/conf.d/modsec_rules/00_asl_zz_strict.conf\"][line\"91\"][id\"390716\"][rev\"2\"][msg\"Atomicorp.comWAFRules:URLfileextensionisrestrictedbypolicy\"][data\".old\"][severity\"ERROR\"][hostname\"associazione-iris.ch\"][uri\"/.codex/auth.json.old\"][unique_id\"arP6fxh4KyuZoiv09VsYnwAAAMU\"]
show less
Hacking
Web App Attack
2026-09-23 07:46:36
UTC ·
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇫🇷
dynamix
2026-09-23 07:41:57
UTC ·
(1 month ago)
Automated web vulnerability and path enumeration scan with excessive 404 requests
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 07:38:21
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.95.61.12 (12.61.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 03:38:16.812246 2026] [security2:error] [pid 29602:tid 2960 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.95.61.12 (12.61.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 03:38:16.812246 2026] [security2:error] [pid 29602:tid 29602] [client 34.95.61.12:56194] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||amatosdrywall.com|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "amatosdrywall.com"] [uri "/.codex/auth.json.bak"] [unique_id "arOB6N47oRyt1HhWi1iNxgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 06:39:36
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.95.61.12 (12.61.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 02:39:29.970825 2026] [security2:error] [pid 20543:tid 2054 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.95.61.12 (12.61.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 02:39:29.970825 2026] [security2:error] [pid 20543:tid 20543] [client 34.95.61.12:40660] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||alccontractorsllc.com|F|2"] [data ".json.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "alccontractorsllc.com"] [uri "/.codex/auth.json.old"] [unique_id "arN0ISXRJ6YZuxawLfqXIwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 01:04:36
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 34.95.61.12 (12.61.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 21:04:31.865016 2026] [security2:error] [pid 23436:tid 2343 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.95.61.12 (12.61.95.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 21:04:31.865016 2026] [security2:error] [pid 23436:tid 23436] [client 34.95.61.12:60636] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||abirdnamedfart.com|F|2"] [data ".json.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "abirdnamedfart.com"] [uri "/.codex/auth.json.bak"] [unique_id "arMln-aX6NyTuSlnRf17ygAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-09-22 09:05:04
UTC ·
(1 month ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
2026-09-22 07:19:29
UTC ·
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
