🇺🇸
TPI-Abuse
2026-09-22 06:23:37
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 136.107.5.160 (160.5.107.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 136.107.5.160 (160.5.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 02:23:29.357009 2026] [security2:error] [pid 29983:tid 29983] [client 136.107.5.160:56926] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.rjhills.willowbrookins.com|F|2"] [data ".json.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.rjhills.willowbrookins.com"] [uri "/.codex/auth.json.old"] [unique_id "arIe4b0ETUDXj3E_xoqyiwAAAE4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-09-22 05:05:27
(2 days ago)
Abuse Detected (9)
Brute-Force
Web App Attack
🇬🇧
pearbright
2026-09-22 04:01:45
(2 days ago)
136.107.5.160 - - [22/Sep/2026:04:01:45 +0000] "GET /.claude/settings.local.json HTTP/1.1" 404 4635 ...
show more
136.107.5.160 - - [22/Sep/2026:04:01:45 +0000] "GET /.claude/settings.local.json HTTP/1.1" 404 4635 "-" "crusader-worker/1.0"
136.107.5.160 - - [22/Sep/2026:04:01:45 +0000] "GET /.codex/auth.json~ HTTP/1.1" 404 4636 "-" "crusader-worker/1.0"
136.107.5.160 - - [22/Sep/2026:04:01:45 +0000] "GET /.config/claude/credentials.json HTTP/1.1" 404 4636 "-" "crusader-worker/1.0"
136.107.5.160 - - [22/Sep/2026:04:01:45 +0000] "GET /www/.codex/auth.json HTTP/1.1" 404 4636 "-" "crusader-worker/1.0"
136.107.5.160 - - [22/Sep/2026:04:01:45 +0000] "GET /backup/.claude/credentials.json HTTP/1.1" 404 4636 "-" "crusader-worker/1.0"
136.107.5.160 - - [22/Sep/2026:04:01:45 +0000] "GET /old/.codex/auth.json HTTP/1.1" 404 4637 "-" "crusader-worker/1.0"
136.107.5.160 - - [22/Sep/2026:04:01:45 +0000] "GET /.codex/auth.json HTTP/1.1" 404 505 "-" "crusader-worker/1.0"
136.107.5.160 - - [22/Sep/2026:04:01:45 +0000] "GET /.codex/config.toml HTTP/1.1" 404 505 "-" "crusader-worker/1.0"
136.107.5.160 - - [22/Sep/2026
...
show less
Web App Attack
🇳🇱
Cloud86 B.V.
2026-09-22 01:18:02
(2 days ago)
categories: DDoS Attack
DDoS Attack
🇺🇸
TPI-Abuse
2026-09-21 21:13:12
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 136.107.5.160 (160.5.107.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 136.107.5.160 (160.5.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 17:13:06.759594 2026] [security2:error] [pid 26032:tid 26032] [client 136.107.5.160:42822] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.vittariaart.vittariadesign.com|F|2"] [data ".json.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.vittariaart.vittariadesign.com"] [uri "/.codex/auth.json.old"] [unique_id "arGd4khKRhnP7lSqjXzBSQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-09-21 14:29:14
(3 days ago)
20 attempts against mh-misbehave-ban on comet
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-21 12:42:59
(3 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
Starburst SysOp Team
2026-09-21 11:33:53
(3 days ago)
Restricted File Access Attempt: AI Coding Assistant Artifact. Matched phrase ".claude/" at REQUEST_F ...
show more
Restricted File Access Attempt: AI Coding Assistant Artifact. Matched phrase ".claude/" at REQUEST_FILENAME. (930140-stl2-14)
show less
Hacking
🇳🇱
Alt255
2026-09-21 10:55:45
(3 days ago)
[ti-04al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apac ...
show more
[ti-04al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 136.107.5.160 - - [21/Sep/2026:12:55:14 +0200] "GET /bak/.claude/credentials.json HTTP/1.1" 404 79193 "-" "crusader-worker/1.0"
136.107.5.160 - - [21/Sep/2026:12:55:13 +0200] "GET /.codex/config.toml HTTP/1.1" 404 101656 "-" "crusader-worker/1.0"
136.107.5.160 - - [21/Sep/2026:12:55:13 +0200] "GET /.claude.json HTTP/1.1" 404 101656 "-" "crusader-worker/1.0"
136.107.5.160 - - [21/Sep/2026:12:55:13 +0200] "GET /.codex/auth.json HTTP/1.1" 404 101422 "-" "crusader-worker/1.0"
136.107.5.160 - - [21/Sep/2026:12:55:13 +0200] "GET /.claude/credentials.json HTTP/1.1" 404 101656 "-" "crusader-worker/1.0"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-21 06:20:28
(3 days ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /backup/.claude/credentials.json (+9 more) | 2026-09-21 06:20 UTC
show less
Hacking
Web App Attack
🇺🇸
mnsf
2026-09-21 06:05:45
(3 days ago)
Too many Status 40X (11)
Brute-Force
Web App Attack
🇩🇪
svr
2026-09-21 05:31:50
(3 days ago)
HC-Flood Web Scanner
Web App Attack
2026-09-21 05:18:03
(3 days ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking