🇳🇱
homeshowdomain.nl
2026-06-16 21:59:12
(1 week ago)
Auto-ban: 400 malicious requests on 2026-06-15 (e.g., env/backup probes, brute-force, or error burst ...
show more
Auto-ban: 400 malicious requests on 2026-06-15 (e.g., env/backup probes, brute-force, or error bursts).
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-06-15 04:15:16
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.254.175.187 (187.175.254.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.254.175.187 (187.175.254.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 00:15:10.309247 2026] [security2:error] [pid 26870:tid 26870] [client 35.254.175.187:57964] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.bernardo.gonzalez.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.bernardo.gonzalez.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "ai98Tk7BEsL6ttLO-BIvbgAAAIA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 01:01:57
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.254.175.187 (187.175.254.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.254.175.187 (187.175.254.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 21:01:51.295914 2026] [security2:error] [pid 20543:tid 20543] [client 35.254.175.187:37412] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.oualie.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.oualie.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "ai9O_wGdwE8QO2WQ-b_AGQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-15 00:53:18
(2 weeks ago)
35.254.175.187 - - [15/Jun/2026:02:53:16 +0200] "GET /actuator/configprops HTTP/1.1" 404 184 "-" "Mo ...
show more
35.254.175.187 - - [15/Jun/2026:02:53:16 +0200] "GET /actuator/configprops HTTP/1.1" 404 184 "-" "Mozilla/5.0 (Linux; Android 9; PH-1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"
35.254.175.187 - - [15/Jun/2026:02:53:16 +0200] "GET /trace HTTP/1.1" 404 124 "-" "mukewang/7.2.0 (iPhone; iOS 12.3.1; Scale/2.00) webview"
35.254.175.187 - - [15/Jun/2026:02:53:16 +0200] "GET /app/actuator/logfile HTTP/1.1" 404 184 "-" "Mozilla/5.0 (X11; Linux i686 (x86_64)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.130 Safari/537.36"
35.254.175.187 - - [15/Jun/2026:02:53:16 +0200] "GET /internal/actuator/heapdump HTTP/1.1" 404 184 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3497.100 Safari/537.36"
35.254.175.187 - - [15/Jun/2026:02:53:16 +0200] "GET /actuator/heapdump HTTP/1.1" 404 124 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 7_1_2 like Mac OS X) AppleWebKit/537.51.2 (KHTML like Gecko) Version/7.0 Mobile/11D25
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 23:40:09
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 35.254.175.187 (187.175.254.35.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 35.254.175.187 (187.175.254.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 19:40:01.696479 2026] [security2:error] [pid 15910:tid 15910] [client 35.254.175.187:56536] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||angeltarrac.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "angeltarrac.com"] [uri "/.config/gcloud/credentials.db"] [unique_id "ai870VSXPplbPNtxT5ZAHgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kuj
2026-06-14 11:01:25
(2 weeks ago)
2026-06-14T05:01:25.144123-06:00 derp derper[226735]: 2026/06/14 05:01:25 http: TLS handshake error ...
show more
2026-06-14T05:01:25.144123-06:00 derp derper[226735]: 2026/06/14 05:01:25 http: TLS handshake error from 35.254.175.187:32912: acme/autocert: missing server name
2026-06-14T05:01:25.144611-06:00 derp derper[226735]: 2026/06/14 05:01:25 http: TLS handshake error from 35.254.175.187:32908: acme/autocert: missing server name
2026-06-14T05:01:25.162413-06:00 derp derper[226735]: 2026/06/14 05:01:25 http: TLS handshake error from 35.254.175.187:32928: acme/autocert: missing server name
...
show less
Port Scan
Brute-Force
2026-06-14 05:55:54
(2 weeks ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇫🇷
COMAITE
2026-06-14 03:25:53
(2 weeks ago)
Suspicious URL access.
Web App Attack
🇩🇪
on-com
2026-06-13 23:33:25
(2 weeks ago)
URL scan
Brute-Force
Web App Attack
🇳🇱
Cloud86 B.V.
2026-06-13 20:52:07
(2 weeks ago)
categories: DDoS Attack
DDoS Attack
🇳🇱
Savvii
2026-06-13 20:04:12
(2 weeks ago)
15 attempts against mh-modsecurity-ban on comet
Brute-Force
Web App Attack