🇺🇸
TPI-Abuse
2026-06-15 05:26:35
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.107.42.28 (28.42.107.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 136.107.42.28 (28.42.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 01:26:29.036273 2026] [security2:error] [pid 32668:tid 32668] [client 136.107.42.28:33158] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.labelrecord.com"] [uri "/.env.dev"] [unique_id "ai-NBY6nDVme6_eKuxNVBQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Roper123
2026-06-15 05:26:18
(6 hours ago)
Web app attack
Web App Attack
🇳🇱
Site.eu
2026-06-15 04:53:04
(7 hours ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
mnsf
2026-06-15 00:08:58
(12 hours ago)
Scanning/Probing (71)
Brute-Force
Web App Attack
🇳🇱
ConsulHosting
2026-06-15 00:06:46
(12 hours ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇺🇸
TPI-Abuse
2026-06-14 23:32:49
(12 hours ago)
(mod_security) mod_security (id:949110) triggered by 136.107.42.28 (28.42.107.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:949110) triggered by 136.107.42.28 (28.42.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 14 19:32:41.694792 2026] [security2:error] [pid 23006:tid 23006] [client 136.107.42.28:54658] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "agoodsign.biz"] [uri "/.env.production.bak"] [unique_id "ai86GXgLCU464062Ysg37wAAAJE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-14 22:31:51
(13 hours ago)
Multiple web server 400 error codes from same source ip
Web App Attack
2026-06-14 21:58:17
(14 hours ago)
136.107.42.28 - - [14/Jun/2026:21:58:17 +0000] "GET /.env.prod.bak HTTP/1.1" 404 196 "-" "Mozilla/5. ...
show more
136.107.42.28 - - [14/Jun/2026:21:58:17 +0000] "GET /.env.prod.bak HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.142 Safari/537.36 OPR/62.0.3331.119"
136.107.42.28 - - [14/Jun/2026:21:58:17 +0000] "GET /api/.env.dev HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Linux; Android 9; ASUS_X00TD) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"
...
show less
Web App Attack
🇳🇱
Savvii
2026-06-14 17:50:05
(18 hours ago)
20 attempts against mh_ha-misbehave-ban on pf221105
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
gtheo99
2026-06-14 15:25:50
(21 hours ago)
(CT) IP 136.107.42.28 (US/United States/28.42.107.136.bc.googleusercontent.com) found to have 332 co ...
show more
(CT) IP 136.107.42.28 (US/United States/28.42.107.136.bc.googleusercontent.com) found to have 332 connections
show less
Port Scan
🇺🇸
itsnixk
2026-06-14 13:53:02
(22 hours ago)
(mod_security) mod_security (id:920350) triggered by 136.107.42.28 (US/United States/28.42.107.136.b ...
show more
(mod_security) mod_security (id:920350) triggered by 136.107.42.28 (US/United States/28.42.107.136.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Jun 14 09:53:00.205527 2026] [security2:error] [pid 331543:tid 331991] [client 136.107.42.28:41462] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.26.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.env.pre-production"] [unique_id "ai6yPMwcYeo_fCt8gzgXnAAAAKk"]
show less
Port Scan
🇧🇷
Halux
2026-06-14 12:35:27
(23 hours ago)
136.107.42.28 Probing protected path or service
Web App Attack
🇳🇱
Savvii
2026-06-14 11:29:18
(1 day ago)
20 attempts against mh-misbehave-ban on lunar
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Skyrider
2026-06-14 06:44:56
(1 day ago)
crowdsecurity/http-sensitive-files
Web App Attack
🇮🇹
VHosting
2026-06-14 04:00:05
(1 day ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack