🇦🇺
MAGIC
2025-03-30 17:02:52
(1 year ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2025-03-30 16:27:52
(1 year ago)
(mod_security) mod_security (id:210381) triggered by 35.233.121.128 (128.121.233.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210381) triggered by 35.233.121.128 (128.121.233.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 30 12:27:45.941540 2025] [security2:error] [pid 17283:tid 17283] [client 35.233.121.128:36254] [client 35.233.121.128] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "82"] [id "210381"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||bernsteinip.com|F|4"] [data "REQUEST_URI=/wp-content/cache/min/1/%url%"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "bernsteinip.com"] [uri "/wp-content/cache/min/1/%url%"] [unique_id "Z-lxAXJGesyrIOcmhwGpmgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-03-27 15:07:57
(1 year ago)
(mod_security) mod_security (id:210381) triggered by 35.233.121.128 (128.121.233.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210381) triggered by 35.233.121.128 (128.121.233.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 27 11:07:49.520905 2025] [security2:error] [pid 3201472:tid 3201472] [client 35.233.121.128:50126] [client 35.233.121.128] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "82"] [id "210381"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||pointillistic.com|F|4"] [data "REQUEST_URI=/static/js/%url%"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "pointillistic.com"] [uri "/static/js/%url%"] [unique_id "Z-VpxUkfGVvRIh4YLEpgjAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-03-24 08:19:04
(1 year ago)
(mod_security) mod_security (id:210381) triggered by 35.233.121.128 (128.121.233.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210381) triggered by 35.233.121.128 (128.121.233.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 24 04:18:56.589241 2025] [security2:error] [pid 6666:tid 6742] [client 35.233.121.128:55856] [client 35.233.121.128] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "82"] [id "210381"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||www.ainavelas.com|F|4"] [data "REQUEST_URI=/wp-content/themes/flatsome/assets/js/%url%"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ainavelas.com"] [uri "/wp-content/themes/flatsome/assets/js/%url%"] [unique_id "Z-EVcPTje8uRtX0V6sEfMgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
octageeks.com
2025-03-24 04:06:54
(1 year ago)
Wordpress malicious attack:[octa404]
Web App Attack
🇺🇸
TPI-Abuse
2025-03-22 15:15:37
(1 year ago)
(mod_security) mod_security (id:210381) triggered by 35.233.121.128 (128.121.233.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210381) triggered by 35.233.121.128 (128.121.233.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 22 11:15:32.597652 2025] [security2:error] [pid 23303:tid 23303] [client 35.233.121.128:44998] [client 35.233.121.128] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "82"] [id "210381"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||phuket-day-trip.com|F|4"] [data "REQUEST_URI=/js/%url%"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "phuket-day-trip.com"] [uri "/js/%url%"] [unique_id "Z97UFIlLdtz_8NgMfOfPIgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Carsten
2025-03-22 13:15:28
(1 year ago)
port scan with outdated browser [firefox/52.]
Port Scan
🇩🇪
Carsten
2025-03-22 13:15:28
(1 year ago)
port scan with outdated browser [firefox/52.]
Port Scan
🇺🇸
TPI-Abuse
2025-03-21 03:27:43
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 35.233.121.128 (128.121.233.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.233.121.128 (128.121.233.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 20 23:27:38.488594 2025] [security2:error] [pid 2412:tid 2412] [client 35.233.121.128:36946] [client 35.233.121.128] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cameronsol.com|F|2"] [data ".texasbordertours.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cameronsol.com"] [uri "/www.texasbordertours.com"] [unique_id "Z9zcqkFFi-RgxoVky2kHagAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2025-03-20 15:46:53
(1 year ago)
(WPLOGIN) WP Login Attack 35.233.121.128 (BE/Belgium/128.121.233.35.bc.googleusercontent.com): 5 in ...
show more
(WPLOGIN) WP Login Attack 35.233.121.128 (BE/Belgium/128.121.233.35.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇨🇦
polycoda
2025-03-19 18:08:39
(1 year ago)
📄 Probes for tons of inexistent files and/or PHP scripts
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-03-18 05:36:18
(1 year ago)
(mod_security) mod_security (id:210381) triggered by 35.233.121.128 (128.121.233.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210381) triggered by 35.233.121.128 (128.121.233.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 18 01:36:14.324899 2025] [security2:error] [pid 3426433:tid 3426433] [client 35.233.121.128:58072] [client 35.233.121.128] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "82"] [id "210381"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||marianozaro.com|F|4"] [data "REQUEST_URI=/wp-content/plugins/malina-elements/js/%url%"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "marianozaro.com"] [uri "/wp-content/plugins/malina-elements/js/%url%"] [unique_id "Z9kGTkZRfKZHKyAHI_IccwAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
COMAITE
2025-03-17 02:04:00
(1 year ago)
Multiple web server 400 error codes from same source ip 35.233.121.128.
Web App Attack
2025-03-16 06:47:51
(1 year ago)
Malicious activity detected
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2025-03-15 20:11:52
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 35.233.121.128 (128.121.233.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.233.121.128 (128.121.233.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 15 16:11:46.138169 2025] [security2:error] [pid 14930:tid 14960] [client 35.233.121.128:55358] [client 35.233.121.128] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.ajbruner.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.ajbruner.com"] [uri "/adventures/swrd/1/[email protected] "] [unique_id "Z9XfAm-QtrTq2w5Q4cpqtgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack