🇩🇪
Jochen Pretli
2026-09-14 22:18:56
UTC ·
(1 month ago)
connection to honeypot
Email Spam
Port Scan
🇩🇪
Jochen Pretli
2026-09-12 14:24:34
UTC ·
(1 month ago)
connection to honeypot
Email Spam
Port Scan
🇳🇱
homeshowdomain.nl
2026-09-04 22:00:41
UTC ·
(2 months ago)
Auto-ban: >3000 req/min op 2026-09-04
Web App Attack
SSH
Hacking
🇺🇸
mnsf
2026-09-04 18:05:33
UTC ·
(2 months ago)
Too many Status 40X (31)
Scanning/Probing (26)
Brute-Force
Web App Attack
2026-09-04 15:35:17
UTC ·
(2 months ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇩🇪
updown.io
2026-09-04 13:22:22
UTC ·
(2 months ago)
{"level":"info","ts":1788528118.657277,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.108.48.232","remote_port":"10672","client_ip":"136.108.48.232","proto":"HTTP/1.1","method":"GET","host":"status.ebas.unf.se","u ...
show more
{"level":"info","ts":1788528118.657277,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.108.48.232","remote_port":"10672","client_ip":"136.108.48.232","proto":"HTTP/1.1","method":"GET","host":"status.ebas.unf.se","uri":"/@fs/../.env?raw??","headers":{"User-Agent":["Mozilla/5.0 (compatible; ClaudeBot/1.0; [email protected] )"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"Accept-Language":["en-US,en;q=0.9"],"Accept-Encoding":["gzip"]},"tls":{"resumed":true,"version":772,"cipher_suite":4865,"proto":"","server_name":"status.ebas.unf.se","ech":false}},"bytes_read":0,"user_id":"","duration":0.000116873,"size":0,"status":429,"resp_headers":{"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"],"Server":["Caddy"]}}
{"level":"info","ts":1788528118.6596317,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.108.48.232","remote_port":"10820","client_ip":"136.108.48.232","proto":"HTTP/1.1"
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 13:13:23
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 136.108.48.232 (232.48.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:13:15.001760 2026] [security2:error] [pid 11073:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.48.232 (232.48.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:13:15.001760 2026] [security2:error] [pid 11073:tid 11073] [client 136.108.48.232:3252] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "callyourmomimlost.org"] [uri "/@fs/../.env"] [unique_id "aprD60JUR8gq7BFlHRxsjAAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-04 11:35:12
UTC ·
(2 months ago)
Bot / seems abusive / Apache connections: 50
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇯🇵
VXG-NET
2026-09-04 11:29:22
UTC ·
(2 months ago)
port=80, indicator_type=info-leak
Hacking
🇺🇸
TPI-Abuse
2026-09-04 11:15:12
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 136.108.48.232 (232.48.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:15:06.960778 2026] [security2:error] [pid 19930:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.48.232 (232.48.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 07:15:06.960778 2026] [security2:error] [pid 19930:tid 19930] [client 136.108.48.232:26096] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.drstilesdds.com"] [uri "/@fs/..%252f..%252f..%252f..%252f..%252fapp/.env"] [unique_id "apqoOvYtIjDL0OVYZvyv5AAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 10:41:06
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 136.108.48.232 (232.48.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 06:41:00.299563 2026] [security2:error] [pid 14260:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.48.232 (232.48.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 06:41:00.299563 2026] [security2:error] [pid 14260:tid 14260] [client 136.108.48.232:24326] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.cienmalos.com"] [uri "/@fs/.env.development"] [unique_id "apqgPDiFQEx8ipLOWv2GewAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
IRISIO
2026-09-04 09:12:20
UTC ·
(2 months ago)
scans/SQL injection/spam posts : 2562 queries
Web App Attack
SQL Injection
🇩🇪
rh24
2026-09-04 09:08:06
UTC ·
(2 months ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 136.108.48.232 (US/United States/232.48.108.136.bc.googleusercontent.com)
Bad Web Bot
🇩🇪
Jochen Pretli
2026-09-04 08:59:01
UTC ·
(2 months ago)
connection to honeypot
Email Spam
Port Scan
🇺🇸
TPI-Abuse
2026-09-04 07:40:19
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 136.108.48.232 (232.48.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 03:40:12.134365 2026] [security2:error] [pid 13418:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.48.232 (232.48.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 03:40:12.134365 2026] [security2:error] [pid 13418:tid 13418] [client 136.108.48.232:28858] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.garretthillary.com"] [uri "/@fs/root/.env"] [unique_id "app13GIocxsL871lcgBZWAAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
