🇺🇸
TPI-Abuse
2026-11-15 21:50:17
UTC ·
(11 minutes ago)
(mod_security) mod_security (id:210492) triggered by 136.108.81.226 (226.81.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 16:50:10.405126 2026] [security2:error] [pid 6146:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.81.226 (226.81.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 16:50:10.405126 2026] [security2:error] [pid 6146:tid 6146] [client 136.108.81.226:52874] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mathewyoung.com"] [uri "/.git/config"] [unique_id "avopEocvr9-UwY_G4tAoMQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
j-tap
2026-11-15 21:44:08
UTC ·
(17 minutes ago)
WordPress honeypot: automated scanner (xmlrpc / installer / .env / direct login POST)
Web App Attack
🇹🇷
nazemes
2026-11-15 21:15:59
UTC ·
(45 minutes ago)
Honeypot path probe: /.git/config on master.misago.com.tr
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-15 21:14:49
UTC ·
(46 minutes ago)
(web_sensitive_file) srv102 Sensitive file probe (.env/.git/backup) 136.108.81.226 (US/United States/226.81.108.136.bc.googleusercontent.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 21:12:25
UTC ·
(48 minutes ago)
(mod_security) mod_security (id:210492) triggered by 136.108.81.226 (226.81.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 16:12:18.664402 2026] [security2:error] [pid 23999:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.81.226 (226.81.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 16:12:18.664402 2026] [security2:error] [pid 23999:tid 23999] [client 136.108.81.226:41584] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "masterfulenlighteningfreestudies.org"] [uri "/.git/config"] [unique_id "avogMk4zdX8nCsvHF311awAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
2000cn.com.au
2026-11-15 21:02:01
UTC ·
(59 minutes ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇮🇹
CoreTech srl
2026-11-15 20:53:56
UTC ·
(1 hour ago)
cloudlinux2 fail2ban: 2026-11-15 21:48:57,952 fail2ban.filter [1647]: INFO [plesk-wordpress] Found 209.87.169.46 - 2026-11-15 21:48:57cloudlinux2 fail2ban: 2026-11-15 21:49:32,864 fail2ban.filter [1647]: INFO [plesk-modsecurity] ...
show more
cloudlinux2 fail2ban: 2026-11-15 21:48:57,952 fail2ban.filter [1647]: INFO [plesk-wordpress] Found 209.87.169.46 - 2026-11-15 21:48:57cloudlinux2 fail2ban: 2026-11-15 21:49:32,864 fail2ban.filter [1647]: INFO [plesk-modsecurity] Found 136.108.81.226 - 2026-11-15 21:49:32cloudlinux2 fail2ban: 2026-11-15 21:50:17,766 fail2ban.filter [1647]: INFO [plesk-wordpress] Found 103.133.207.20 - 2026-11-15 21:50:15cloudlinux2 fail2ban: 2026-11-15 21:50:16,895 fail2ban.filter [1647]: INFO [plesk-wordpress] Found 102.96.221.18 - 2026-11-15 21:50:16cloudlinux2 fail2ban: 2026-11-15 21:51:03,370 fail2ban.filter [1647]: INFO [plesk-wordpress] Found 185.139.61.116 - 2026-11-15 21:51:02cloudlinux2 fail2ban: 2026-11-15 21:51:20,222 fail2ban.filter [1647]: INFO [plesk-wordpress] Found 188.225.122.103 - 2026-11-15 21:51:19cloudlinux2 fail2ban: 2026-11-15 21:52:12,138 fail2ban.actions [1647]: NOTICE [plesk-modsecurity] Unban 188.166.214.92cloudlinux2 fail2ban:
show less
Web App Attack
🇩🇪
paissangroup
2026-11-15 20:49:22
UTC ·
(1 hour ago)
Multiple WAF Violations
Web App Attack
🇩🇪
LRob
2026-11-15 20:36:22
UTC ·
(1 hour ago)
Secret file probe | method: GET | path: /.git/config | ua: -
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 20:20:57
UTC ·
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 136.108.81.226 (226.81.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 15:20:52.469013 2026] [security2:error] [pid 15417:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.81.226 (226.81.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 15:20:52.469013 2026] [security2:error] [pid 15417:tid 15417] [client 136.108.81.226:49632] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "marydealfineart.com"] [uri "/.git/config"] [unique_id "avoUJIOteoCNln3SGatjLwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-15 20:17:45
UTC ·
(1 hour ago)
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 136.108.81.226 - - \[15/Nov/2026:21:17:24 +0100\] "GET /.git/config HTTP/1.1" 301 4658 "-" "-"
...
Bad Web Bot
Web App Attack
2026-11-15 20:07:03
UTC ·
(1 hour ago)
Automated web scanner. Requested suspicious paths: /.git/config. UTC: 2026-11-15 19:10:54.
Web App Attack
🇫🇷
masterguru
2026-11-15 19:57:09
UTC ·
(2 hours ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 19:55:45
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.108.81.226 (226.81.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 14:55:38.795702 2026] [security2:error] [pid 31566:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.81.226 (226.81.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 14:55:38.795702 2026] [security2:error] [pid 31566:tid 31571] [client 136.108.81.226:53904] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "martinbenes.com"] [uri "/.git/config"] [unique_id "avoOOhmQQqkU0CW4vNAwVgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 19:37:30
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.108.81.226 (226.81.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 14:37:26.231277 2026] [security2:error] [pid 25516:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.108.81.226 (226.81.108.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 14:37:26.231277 2026] [security2:error] [pid 25516:tid 25516] [client 136.108.81.226:52360] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "marriedtv.com.whoore.com"] [uri "/.git/config"] [unique_id "avoJ9lLHmWJzYYl8AiK90AAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
