🇺🇸
jormaster3k
2026-11-06 07:30:54
UTC ·
(5 days ago)
Attack against Apache (too many 404s)
Web App Attack
🇩🇪
hidemail.app
2026-11-06 06:03:06
UTC ·
(5 days ago)
Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban.
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-06 05:42:40
UTC ·
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 136.107.190.44 (44.190.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 00:42:35.584140 2026] [security2:error] [pid 27210:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 136.107.190.44 (44.190.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 00:42:35.584140 2026] [security2:error] [pid 27210:tid 27210] [client 136.107.190.44:59410] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.pistonsociety.com|F|2"] [data ".pistonsociety.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.pistonsociety.com"] [uri "/z9x8c7v6b5-debug-trigger-www.pistonsociety.com"] [unique_id "au1oy_A58izNPJdTc9zaRgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
alessio loto
2026-11-06 04:35:58
UTC ·
(5 days ago)
WAF Detection: URI_Injection_Detected (High Risk IP). AI Confirmed Attack Payload.
Web App Attack
2026-11-06 04:17:16
UTC ·
(5 days ago)
Apache HTTP Server Directory Traversal.
Web App Attack
🇳🇱
Savvii
2026-11-06 03:11:13
UTC ·
(5 days ago)
20 attempts against mh-misbehave-ban on frost
Brute-Force
Bad Web Bot
Web App Attack
2026-11-06 03:08:18
UTC ·
(5 days ago)
GET /.env.production HTTP/1.1
...
Web App Attack
🇩🇪
svr
2026-11-06 02:28:48
UTC ·
(5 days ago)
HC-Flood Web Scanner
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 02:15:04
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 136.107.190.44 (44.190.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 21:14:57.711818 2026] [security2:error] [pid 15513:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.107.190.44 (44.190.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 21:14:57.711818 2026] [security2:error] [pid 15513:tid 15513] [client 136.107.190.44:42570] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.highspringtradingpost.com"] [uri "/portal/.env"] [unique_id "au04ITxm60q1x14emnZYigAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
andypiper
2026-11-06 02:02:53
UTC ·
(5 days ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
2026-11-06 01:19:24
UTC ·
(5 days ago)
2026-11-06: auto (probe_watch autoblock): api_enumeration,probe_path_traversal,probe_secret_config, 243 requests on consumer-host-unavailable, nginx-only + Data C. Observed against Billease APIs; source blocked. Datacenter IP (Google LLC), no legitim ...
show more
2026-11-06: auto (probe_watch autoblock): api_enumeration,probe_path_traversal,probe_secret_config, 243 requests on consumer-host-unavailable, nginx-only + Data C. Observed against Billease APIs; source blocked. Datacenter IP (Google LLC), no legitimate customer traffic. Automated report.
show less
Web App Attack
Hacking
🇧🇪
cmbplf
2026-11-06 01:09:29
UTC ·
(5 days ago)
9.675 requests from abuseipdb.com blacklisted IP (1w6d23h)
Brute-Force
Bad Web Bot
🇳🇱
Savvii
2026-11-06 00:48:37
UTC ·
(5 days ago)
20 attempts against mh-misbehave-ban on ozone
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-06 00:04:10
UTC ·
(5 days ago)
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 136.107.190.44 - - [06/Nov/2026:01:03:44 +0100] "GET /.env.backup HTTP/2.0" 403 81 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https:/ ...
show more
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 136.107.190.44 - - [06/Nov/2026:01:03:44 +0100] "GET /.env.backup HTTP/2.0" 403 81 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 23:55:51
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 136.107.190.44 (44.190.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 18:55:47.508055 2026] [security2:error] [pid 18525:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.107.190.44 (44.190.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 18:55:47.508055 2026] [security2:error] [pid 18525:tid 18525] [client 136.107.190.44:38924] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.picticon.com"] [uri "/.htpasswd"] [unique_id "au0Xg1lLOXWrnFqN3pDNKQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
