2026-11-10 00:26:45
UTC ·
(22 hours ago)
LH-Watcher: FAKE_ID [Fake Claude-User]
Bad Web Bot
🇸🇪
vaia.cloud
2026-11-08 13:50:03
UTC ·
(2 days ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 10:16:59
UTC ·
(2 days ago)
(mod_security) mod_security (id:210831) triggered by 35.231.42.30 (30.42.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 05:16:55.555415 2026] [security2:error] [pid 19825:tid 19 ...
show more
(mod_security) mod_security (id:210831) triggered by 35.231.42.30 (30.42.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 05:16:55.555415 2026] [security2:error] [pid 19825:tid 19825] [client 35.231.42.30:8192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:user-agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||aeservices.com|F|4"] [data "ContactBot/"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "aeservices.com"] [uri "/"] [unique_id "avBMF3YZ9gPq-u2RDwY3nwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-06 11:11:01
UTC ·
(4 days ago)
Malicious activity detected
Hacking
Web App Attack
2026-11-02 21:14:12
UTC ·
(1 week ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-02 15:01:19
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 35.231.42.30 (30.42.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 10:01:11.412028 2026] [security2:error] [pid 5210:tid 521 ...
show more
(mod_security) mod_security (id:210831) triggered by 35.231.42.30 (30.42.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 10:01:11.412028 2026] [security2:error] [pid 5210:tid 5210] [client 35.231.42.30:8192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:user-agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.pizzadata.com|F|4"] [data "ContactBot/"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.pizzadata.com"] [uri "/"] [unique_id "auilt-0U7yaScTvb6IJuFgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 14:30:15
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 35.231.42.30 (30.42.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 09:30:12.265111 2026] [security2:error] [pid 1388145:tid ...
show more
(mod_security) mod_security (id:210831) triggered by 35.231.42.30 (30.42.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 09:30:12.265111 2026] [security2:error] [pid 1388145:tid 1388168] [client 35.231.42.30:8192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:user-agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.rodela.com|F|4"] [data "ContactBot/"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rodela.com"] [uri "/robots.txt"] [unique_id "auiedP9CHc0V0uMmfFPytQAAAM0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 12:30:24
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 35.231.42.30 (30.42.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 07:30:19.473012 2026] [security2:error] [pid 1812:tid 181 ...
show more
(mod_security) mod_security (id:210831) triggered by 35.231.42.30 (30.42.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 07:30:19.473012 2026] [security2:error] [pid 1812:tid 1812] [client 35.231.42.30:8192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:user-agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||marcastecnologia.com|F|4"] [data "ContactBot/"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "marcastecnologia.com"] [uri "/"] [unique_id "auiCW9qsPnbDaVYDWR6eygAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 11:50:13
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 35.231.42.30 (30.42.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:50:09.680690 2026] [security2:error] [pid 27952:tid 27 ...
show more
(mod_security) mod_security (id:210831) triggered by 35.231.42.30 (30.42.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:50:09.680690 2026] [security2:error] [pid 27952:tid 27952] [client 35.231.42.30:8192] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:user-agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||gonzalez.com|F|4"] [data "ContactBot/"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "gonzalez.com"] [uri "/"] [unique_id "auh48RRrBT7w54HC7hLbFAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-31 03:57:17
UTC ·
(1 week ago)
Malicious activity detected
Hacking
Web App Attack
2026-10-31 03:56:19
UTC ·
(1 week ago)
LH-Watcher: FAKE_ID [Fake Claude-User]
Bad Web Bot
🇳🇱
e.fierstra
2026-10-30 10:22:02
UTC ·
(1 week ago)
excessive HTTP 404 errors
Bad Web Bot
🇩🇪
LRob
2026-10-26 11:24:41
UTC ·
(2 weeks ago)
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0 Safari/537.36 | 2026-10-26 11:24 UTC
Bad Web Bot
2026-10-14 04:51:12
UTC ·
(3 weeks ago)
LH-Watcher: FAKE_ID [Fake Claude-User]
Bad Web Bot
🇨🇭
backslash
2026-10-13 13:21:01
UTC ·
(4 weeks ago)
block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8
Bad Web Bot
