🇳🇱
Site.eu
2026-10-12 18:45:44
(2 weeks ago)
Excessive 404/403 errors
Brute-Force
🇧🇷
radardatelecom
2026-10-09 22:27:03
(2 weeks ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 22:14:29
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 136.87.43.12 (12.43.87.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 18:14:22.933324 2026] [security2:error] [pid 30764:tid 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 136.87.43.12 (12.43.87.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 18:14:22.933324 2026] [security2:error] [pid 30764:tid 30764] [client 136.87.43.12:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ruralcommunitycare.org"] [uri "/.htpasswd"] [unique_id "aslnPk43OzOcNkZvn4hdCAAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-10-09 22:14:04
(2 weeks ago)
Repeated requests for suspicious nonexistent URLs, for example: /.npmrc (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)")
Web App Attack
🇺🇸
rsa
2026-10-09 22:08:00
(2 weeks ago)
GET /api%2F.env HTTP/2.0
DDoS Attack
Exploited Host
Web App Attack
🇦🇹
nomzamo
2026-10-09 21:56:24
(2 weeks ago)
Fail2Ban reported: nginx-badbots
Brute-Force
🇺🇸
TPI-Abuse
2026-10-09 21:48:19
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 136.87.43.12 (12.43.87.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 17:48:12.920658 2026] [security2:error] [pid 7383:tid 738 ...
show more
(mod_security) mod_security (id:210492) triggered by 136.87.43.12 (12.43.87.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 17:48:12.920658 2026] [security2:error] [pid 7383:tid 7383] [client 136.87.43.12:45522] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rocketbattle.org"] [uri "/.htpasswd"] [unique_id "aslhHJ4H4mjhamT423BPjwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 21:27:09
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 136.87.43.12 (12.43.87.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 17:27:03.062220 2026] [security2:error] [pid 31999:tid 32 ...
show more
(mod_security) mod_security (id:210492) triggered by 136.87.43.12 (12.43.87.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 17:27:03.062220 2026] [security2:error] [pid 31999:tid 32012] [client 136.87.43.12:48004] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rightnews.org"] [uri "/.htpasswd"] [unique_id "aslcJygsOFOKoglNq_O_wgAAAQs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 20:44:03
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 136.87.43.12 (12.43.87.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 16:44:00.205468 2026] [security2:error] [pid 26757:tid 26 ...
show more
(mod_security) mod_security (id:210492) triggered by 136.87.43.12 (12.43.87.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 16:44:00.205468 2026] [security2:error] [pid 26757:tid 26757] [client 136.87.43.12:44072] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rharano.org"] [uri "/build../.env"] [unique_id "aslSECFPxPa2DA6NqmsGxAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-10-09 20:23:24
(2 weeks ago)
1.336 requests with url.path *.env
748 requests with url.path */@fs/*
270 requests with url.path */proc/*
175 requests with url.path *config.json
158 requests with url.path *.aws/*
153 requests with url.path *credentials.json
120 requests with ...
show more
1.336 requests with url.path *.env
748 requests with url.path */@fs/*
270 requests with url.path */proc/*
175 requests with url.path *config.json
158 requests with url.path *.aws/*
153 requests with url.path *credentials.json
120 requests with url.path *.ssh/*
show less
Brute-Force
Bad Web Bot
🇬🇧
consul.to
2026-10-09 20:09:10
(2 weeks ago)
Web attack/malicious scanning detected
Web App Attack
2026-10-09 19:53:36
(2 weeks ago)
Logfile match
Web App Attack
🇩🇪
ghostwarriors
2026-10-09 19:50:11
(2 weeks ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-10-09 19:34:34
(2 weeks ago)
136.87.43.12 - - [09/Oct/2026:21:34:28 +0200] "GET /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../proc/self/environ HTTP/2.0" 404 295 "-" "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)"
136.87.43.12 - - [09/Oct/ ...
show more
136.87.43.12 - - [09/Oct/2026:21:34:28 +0200] "GET /api/console/api_server?sense_version=@@SENSE_VERSION&apis=../../../../../../proc/self/environ HTTP/2.0" 404 295 "-" "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)"
136.87.43.12 - - [09/Oct/2026:21:34:28 +0200] "GET /static/../../../a/../../../../.env HTTP/2.0" 400 325 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexitybot)"
136.87.43.12 - - [09/Oct/2026:21:34:28 +0200] "GET /static/../../../a/../../../../proc/self/environ HTTP/2.0" 400 325 "-" "Mozilla/5.0 (compatible; Bytespider; [email]) AppleWebKit/537.36"
136.87.43.12 - - [09/Oct/2026:21:34:28 +0200] "GET /wp-json HTTP/2.0" 404 295 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
136.87.43.12 - - [09/Oct/2026:21:34:28 +0200] "GET /api/w/admins/jobs_u/get_log_file/../../../../proc/self/environ HTTP/2.0" 404 295 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"
136.
show less
Web App Attack
Hacking
2026-10-09 18:45:26
(2 weeks ago)
LogGuard auto-report | score=90 | flags=flood | reasons=[+15] burst_10s_suspicious: 92 req in 10s (threshold 50); [+25] error_ratio_severe: 82% error rate in 60s (75/92); [+25] path_diversity_severe: 78 unique paths in 60s (threshold 50); [+25] probe ...
show more
LogGuard auto-report | score=90 | flags=flood | reasons=[+15] burst_10s_suspicious: 92 req in 10s (threshold 50); [+25] error_ratio_severe: 82% error rate in 60s (75/92); [+25] path_diversity_severe: 78 unique paths in 60s (threshold 50); [+25] probe_paths: Hit 24 known probe paths: /%2Fapi/config, /.env, /.env.development, /.env.js, /.env.local
show less
DDoS Attack
