🇺🇸
cwytech
2026-10-24 11:34:48
(37 minutes ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/tpot-web-high.
Bad Web Bot
Web App Attack
🇬🇷
setupgr
2026-10-24 06:49:56
(5 hours ago)
(mod_security) mod_security (id:11000011) triggered by 35.223.219.166 (US/United States/Iowa/Council ...
show more
(mod_security) mod_security (id:11000011) triggered by 35.223.219.166 (US/United States/Iowa/Council Bluffs/-/[AS396982 Google LLC]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Sat Oct 24 09:49:55.508353 2026] [security2:error] [pid 869234:tid 869400] [client 35.223.219.166:46532] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "googleusercontent.com" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "140"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: 166.219.223.35.bc.googleusercontent.com"] [severity "CRITICAL"] [hostname "babis.photo"] [uri "/wp-content/uploads/2021/06/kosmidis112.jpg"] [unique_id "atxVE1yCdQfnu8H3uO3AnQAAA9U"]
show less
Port Scan
2026-10-24 00:32:37
(11 hours ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇩🇪
LRob
2026-10-23 17:29:41
(18 hours ago)
Not following 301 redirects — wasted requests | method: GET | path: /fr/entretien-jardin-luberon/ | ...
show more
Not following 301 redirects — wasted requests | method: GET | path: /fr/entretien-jardin-luberon/ | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 | 2026-10-23 17:29 UTC
show less
Bad Web Bot
🇩🇪
LRob
2026-10-23 07:23:32
(1 day ago)
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Macintosh; ...
show more
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-23 07:13:04
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 35.223.219.166 (166.219.223.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.223.219.166 (166.219.223.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 03:12:57.793175 2026] [security2:error] [pid 25540:tid 25540] [client 35.223.219.166:56130] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.hayrun.com|F|2"] [data ".hayrun.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.hayrun.com"] [uri "/blog/img_0676/www.hayrun.com"] [unique_id "atsI-aWgHwyBoKdzn1b1JwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 03:24:19
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 35.223.219.166 (166.219.223.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.223.219.166 (166.219.223.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 23:24:13.062577 2026] [security2:error] [pid 12852:tid 12852] [client 35.223.219.166:60554] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.danialias.com|F|2"] [data ".shakingasia.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.danialias.com"] [uri "/news/wp-admin/www.shakingasia.com"] [unique_id "atrTXT859scYRdld4k2t7QAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-22 23:05:57
(1 day ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-22 15:18:12
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 35.223.219.166 (166.219.223.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.223.219.166 (166.219.223.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 11:18:08.198672 2026] [security2:error] [pid 14611:tid 14611] [client 35.223.219.166:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.swarnar.com|F|2"] [data ".jpost.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.swarnar.com"] [uri "/www.jpost.com"] [unique_id "atopMMhV0uBovb1-hG9dNwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-10-22 00:06:25
(2 days ago)
block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8
Bad Web Bot
2026-10-21 23:00:46
(2 days ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
