🇫🇮
Christopher Hughes
2026-09-30 03:52:33
(36 minutes ago)
8.234.206.186 - - [30/Sep/2026:04:52:33 +0100] "GET /@fs/home/ec2-user/.aws/credentials?raw?? HTTP/2 ...
show more
8.234.206.186 - - [30/Sep/2026:04:52:33 +0100] "GET /@fs/home/ec2-user/.aws/credentials?raw?? HTTP/2.0" 401 410 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Web App Attack
🇩🇪
s@ch@
2026-09-30 03:45:02
(43 minutes ago)
Jail: plesk-modsecurity | Web application attack (Plesk ModSecurity)
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 02:47:48
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 8.234.206.186 (186.206.234.8.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 8.234.206.186 (186.206.234.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 22:47:43.293688 2026] [security2:error] [pid 24699:tid 24699] [client 8.234.206.186:33532] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whysong.net"] [uri "/userfiles"] [unique_id "arx4Ty4i_2seBeTGPpJkRgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 02:11:57
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 8.234.206.186 (186.206.234.8.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 8.234.206.186 (186.206.234.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 22:11:52.635929 2026] [security2:error] [pid 19070:tid 19070] [client 8.234.206.186:54142] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wherecaniget.xyz"] [uri "/.env.test"] [unique_id "arxv6ArqnaRfsTb2tDsFdwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-30 01:50:41
(2 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 01:46:39
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 8.234.206.186 (186.206.234.8.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 8.234.206.186 (186.206.234.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 21:46:35.290404 2026] [security2:error] [pid 28924:tid 28924] [client 8.234.206.186:53968] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whoore.com"] [uri "/userfiles"] [unique_id "arxp-0s9ZTyROTMFJNnEqQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 01:15:07
(3 hours ago)
(mod_security) mod_security (id:210730) triggered by 8.234.206.186 (186.206.234.8.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 8.234.206.186 (186.206.234.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 21:14:59.226813 2026] [security2:error] [pid 22399:tid 22399] [client 8.234.206.186:49362] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||willowcreekretreathouse.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "willowcreekretreathouse.com"] [uri "/z9x8c7v6b5-debug-trigger-willowcreekretreathouse.com"] [unique_id "arxik7qPHk75gurMM7l_KwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
arnisolutions
2026-09-30 01:09:45
(3 hours ago)
Vulnerability scanning (requests for admin panels, shells, backup files etc.) against a production s ...
show more
Vulnerability scanning (requests for admin panels, shells, backup files etc.) against a production server. Observed on 1 day(s) between 2026-09-30 and 2026-09-30 (UTC). Sample request: GET /env.js HTTP/2.0
show less
Web App Attack
Hacking
🇬🇧
andypiper
2026-09-30 01:02:38
(3 hours ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 00:11:48
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 8.234.206.186 (186.206.234.8.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 8.234.206.186 (186.206.234.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 20:11:44.584245 2026] [security2:error] [pid 5844:tid 5844] [client 8.234.206.186:41404] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||wexfordcap.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "wexfordcap.com"] [uri "/z9x8c7v6b5-debug-trigger-wexfordcap.com"] [unique_id "arxTwEGp-U9c7I7fln8h2gAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-09-29 23:48:12
(4 hours ago)
445 requests with url.path */@fs/*
Brute-Force
Bad Web Bot
🇬🇧
Aetherweb Ark
2026-09-29 23:37:45
(4 hours ago)
(mod_security) mod_security (id:949110) triggered by 8.234.206.186 (US/United States/186.206.234.8.b ...
show more
(mod_security) mod_security (id:949110) triggered by 8.234.206.186 (US/United States/186.206.234.8.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇧🇪
cmbplf
2026-09-29 23:23:07
(5 hours ago)
4.407 requests from abuseipdb.com blacklisted IP (3w5d14h)
Brute-Force
Bad Web Bot
🇳🇱
Alt255
2026-09-29 22:39:57
(5 hours ago)
[ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 8.2 ...
show more
[ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 8.234.206.186 - - \[30/Sep/2026:00:39:37 +0200\] "GET /api/console/api_server\?sense_version=%40%40SENSE_VERSION\&apis=../../../../../../.env HTTP/2.0" 404 1863 "-" "Mozilla/5.0 \(compatible\; Qwenbot/1.0\; +https://qwen.alibaba.com/\)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 22:35:49
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 8.234.206.186 (186.206.234.8.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 8.234.206.186 (186.206.234.8.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 18:35:42.098084 2026] [security2:error] [pid 16950:tid 16950] [client 8.234.206.186:55990] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||wiltoncheese.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "wiltoncheese.com"] [uri "/z9x8c7v6b5-debug-trigger-wiltoncheese.com"] [unique_id "arw9PrXuKV9K-2Lsc_-1tQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
