🇺🇸
TPI-Abuse
2026-10-03 08:17:48
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 136.108.241.135 (135.241.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 04:17:43.628292 2026] [security2:error] [pid 31222: ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.241.135 (135.241.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 04:17:43.628292 2026] [security2:error] [pid 31222:tid 31222] [client 136.108.241.135:47618] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.deubellzebub.com"] [uri "/dist/.env"] [unique_id "asC6J0yC7rNDfErfGkfWbwAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-03 07:35:19
(4 weeks ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇺🇸
TPI-Abuse
2026-10-03 07:23:39
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 136.108.241.135 (135.241.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 03:23:34.336299 2026] [security2:error] [pid 25265: ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.241.135 (135.241.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 03:23:34.336299 2026] [security2:error] [pid 25265:tid 25265] [client 136.108.241.135:45136] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.saletrender.com"] [uri "/static../.env"] [unique_id "asCtdhUBZdm-RYjw8rOhsgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-10-03 06:17:23
(4 weeks ago)
20 attempts against mh-misbehave-ban on ozone
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-03 05:37:20
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 136.108.241.135 (135.241.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 01:37:16.586492 2026] [security2:error] [pid 18724: ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.241.135 (135.241.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 01:37:16.586492 2026] [security2:error] [pid 18724:tid 18724] [client 136.108.241.135:39482] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "samuelcurtis.com"] [uri "/media../.env"] [unique_id "asCUjKuwkNn30lBC0dvJ7AAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-10-03 05:16:50
(4 weeks ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-10-03 04:57:42
(4 weeks ago)
(mod_security) mod_security (id:210730) triggered by 136.108.241.135 (135.241.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 00:57:36.578317 2026] [security2:error] [pid 16120: ...
show more
(mod_security) mod_security (id:210730) triggered by 136.108.241.135 (135.241.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 00:57:36.578317 2026] [security2:error] [pid 16120:tid 16191] [client 136.108.241.135:33552] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.sandiegosamband.com|F|2"] [data ".sandiegosamband.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.sandiegosamband.com"] [uri "/z9x8c7v6b5-debug-trigger-www.sandiegosamband.com"] [unique_id "asCLQLzlJuVuIsmEWxsKsQAAAZI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇽
octageeks.com
2026-10-03 04:24:08
(4 weeks ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇧🇪
cmbplf
2026-10-03 02:40:08
(4 weeks ago)
418 requests with url.path *.env
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-03 02:00:15
(4 weeks ago)
(mod_security) mod_security (id:210730) triggered by 136.108.241.135 (135.241.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 22:00:06.711347 2026] [security2:error] [pid 18480: ...
show more
(mod_security) mod_security (id:210730) triggered by 136.108.241.135 (135.241.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 22:00:06.711347 2026] [security2:error] [pid 18480:tid 18480] [client 136.108.241.135:44018] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.gulftelecom.com|F|2"] [data ".gulftelecom.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.gulftelecom.com"] [uri "/z9x8c7v6b5-debug-trigger-www.gulftelecom.com"] [unique_id "asBhpsJ2RkE2YhsNyaj1ZwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
dot.mg
2026-10-03 00:59:02
(4 weeks ago)
Bad behaviour
Web Spam
2026-10-02 21:49:10
(4 weeks ago)
Bot / scanning and/or hacking attempts: POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e, POST /php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_, POST /api/fs/exec HTTP/2.0, POST /feast/read-document HTTP/2.0, POST /api/v1/nod ...
show more
Bot / scanning and/or hacking attempts: POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e, POST /php-cgi/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_, POST /api/fs/exec HTTP/2.0, POST /feast/read-document HTTP/2.0, POST /api/v1/node-load-method/customMCP HTTP/2.0, POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_
show less
Hacking
Web App Attack
🇮🇹
VHosting
2026-10-02 20:10:03
(4 weeks ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇪🇸
masterguru
2026-10-02 19:28:43
(4 weeks ago)
BAD BOT - Detected and Blocked.. Matched phrase "applebot" at REQUEST_HEADERS:user-agent. (1100000-122)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-02 19:17:30
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 136.108.241.135 (135.241.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 15:17:23.297308 2026] [security2:error] [pid 17708: ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.241.135 (135.241.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 15:17:23.297308 2026] [security2:error] [pid 17708:tid 17708] [client 136.108.241.135:57684] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.jemsfood.com"] [uri "/.env.js"] [unique_id "asADQ0ZzWCeno0g9pEcP9AAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
