🇺🇸
TPI-Abuse
2026-09-22 01:28:39
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.108.70.222 (222.70.108.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.70.222 (222.70.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 21:28:35.062885 2026] [security2:error] [pid 7961:tid 7961] [client 136.108.70.222:43128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "horneman.org"] [uri "/backend/.env"] [unique_id "arHZw0dKvdW_H94FrBWDVAAAAFs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 00:56:32
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.108.70.222 (222.70.108.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.70.222 (222.70.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 20:56:28.686442 2026] [security2:error] [pid 5250:tid 5250] [client 136.108.70.222:38110] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.helpkccare.org"] [uri "/@fs/app/.env"] [unique_id "arHSPNY55X1cMhHeNPgWagAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
bazter.pro
2026-09-21 23:58:54
(10 hours ago)
Fail2Ban: apache-ratelimit - 20 failures
Port Scan
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 23:52:09
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.108.70.222 (222.70.108.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.70.222 (222.70.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 19:52:02.485441 2026] [security2:error] [pid 4815:tid 4815] [client 136.108.70.222:49348] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.bipocmentalhealthcoalition.org"] [uri "/data/.env"] [unique_id "arHDItrADD7INdYtP5gQTQAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 23:22:38
(11 hours ago)
(mod_security) mod_security (id:210730) triggered by 136.108.70.222 (222.70.108.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 136.108.70.222 (222.70.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 19:22:33.413530 2026] [security2:error] [pid 15316:tid 15316] [client 136.108.70.222:45882] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||intnlc.org|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "intnlc.org"] [uri "/rclone.conf"] [unique_id "arG8OcMcJRZHksM6OLCOOAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-21 22:44:20
(12 hours ago)
Aggressive web scan
Web App Attack
🇫🇷
SpaceHost-Server
2026-09-21 22:16:02
(12 hours ago)
Brute-Force
Web App Attack
🇩🇪
macrob
2026-09-21 21:48:23
(13 hours ago)
2026/09/21 21:48:22 [error] 1144020#1144020: *22842355 access forbidden by rule, client: 136.108.70. ...
show more
2026/09/21 21:48:22 [error] 1144020#1144020: *22842355 access forbidden by rule, client: 136.108.70.222, server: fn.binixo.es, request: "GET /.aws/config HTTP/2.0", host: "cd.wellbin.org"
2026/09/21 21:48:22 [error] 1144020#1144020: *22842355 access forbidden by rule, client: 136.108.70.222, server: fn.binixo.es, request: "GET /.aws/credentials HTTP/2.0", host: "cd.wellbin.org"
2026/09/21 21:48:22 [error] 1144020#1144020: *22842358 access forbidden by rule, client: 136.108.70.222, server: fn.binixo.es, request: "GET /static/.env HTTP/2.0", host: "cd.wellbin.org"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 21:47:26
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.108.70.222 (222.70.108.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.70.222 (222.70.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 17:47:19.844346 2026] [security2:error] [pid 23485:tid 23485] [client 136.108.70.222:46210] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.intelibiz.org"] [uri "/.next/.env"] [unique_id "arGl5_TJeW3FeeJtVu6V3gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
SoteriaCovenant
2026-09-21 19:51:59
(14 hours ago)
Automated probe: /actuator/configprops on Soteria Global infrastructure. No vulnerable software pres ...
show more
Automated probe: /actuator/configprops on Soteria Global infrastructure. No vulnerable software present.
show less
Hacking
2026-09-21 19:50:02
(15 hours ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 19:27:55
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.108.70.222 (222.70.108.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.70.222 (222.70.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 15:27:50.550133 2026] [security2:error] [pid 10567:tid 10692] [client 136.108.70.222:46888] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cityofmiddleton.org"] [uri "/web/.env"] [unique_id "arGFNqwQYSIoQZ0rFuLFkwAAAFY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
middelkoopcc
2026-09-21 18:55:00
(15 hours ago)
2026-09-21 20:53:09 GET /.aws/config [301] && 2026-09-21 20:53:09 GET /__/firebase/init.json [301] & ...
show more
2026-09-21 20:53:09 GET /.aws/config [301] && 2026-09-21 20:53:09 GET /__/firebase/init.json [301] && 2026-09-21 20:53:09 GET /.git/config [301] && 181 more within 20 minutes
show less
Web App Attack
🇦🇹
René Hickersberger
2026-09-21 18:21:48
(16 hours ago)
malicious bot detected: violations="ignored-robots-policy"; user_agent="Mozilla/5.0 AppleWebKit/537. ...
show more
malicious bot detected: violations="ignored-robots-policy"; user_agent="Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot)"
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-21 18:14:58
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.108.70.222 (222.70.108.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.70.222 (222.70.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 14:14:52.988896 2026] [security2:error] [pid 22414:tid 22414] [client 136.108.70.222:35110] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.allisonstiles.org"] [uri "/pkg/.env"] [unique_id "arF0HAo77K4zFCe01yvuiQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
