2026-09-26 19:45:33
UTC ·
(1 month ago)
"Packet Flood; Triggered WAF; Persistent 404 Attempts"
DDoS Attack
2026-09-21 06:20:01
UTC ·
(1 month ago)
"Packet Flood; Triggered WAF; Persistent 404 Attempts"
DDoS Attack
🇺🇸
TPI-Abuse
2026-09-20 15:13:22
UTC ·
(1 month ago)
(mod_security) mod_security (id:243320) triggered by 136.109.13.202 (202.13.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 11:13:16.929069 2026] [security2:error] [pid 13783:ti ...
show more
(mod_security) mod_security (id:243320) triggered by 136.109.13.202 (202.13.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 11:13:16.929069 2026] [security2:error] [pid 13783:tid 13783] [client 136.109.13.202:48610] ModSecurity: Access denied with code 403 (phase 2). String match "/.profile" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6621"] [id "243320"] [rev "1"] [msg "COMODO WAF: Information disclosure vulnerability in Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242, as used in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products (CVE-2016-6639)||lodge84.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "lodge84.org"] [uri "/.profile"] [unique_id "aq_4DG_2xN-lw98Fs6uTSQAAAEc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Sonoflet
2026-09-20 15:06:36
UTC ·
(1 month ago)
CrowdSec detection | scenario: http-bad-user-agent
Bad Web Bot
🇫🇮
Kimmo Rieskaniemi
2026-09-20 15:06:15
UTC ·
(1 month ago)
CrowdSec triggered crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-20 14:57:27
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.109.13.202 (202.13.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 10:57:21.223205 2026] [security2:error] [pid 26300:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.13.202 (202.13.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 10:57:21.223205 2026] [security2:error] [pid 26300:tid 26300] [client 136.109.13.202:57830] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "joshuashands.org"] [uri "/.env.bak"] [unique_id "aq_0UbWJR20S55UozGgC5AAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Rocky Mountain Bioengineering Symposium
2026-09-20 14:47:44
UTC ·
(1 month ago)
[Sun Sep 20 08:47:43.392571 2026] [authz_core:error] [pid 207859:tid 140604182054464] [client 136.109.13.202:45310] AH01630: client denied by server configuration: /var/www/public_html/symposium/userfiles
[Sun Sep 20 08:47:43.397478 2026] [authz_core ...
show more
[Sun Sep 20 08:47:43.392571 2026] [authz_core:error] [pid 207859:tid 140604182054464] [client 136.109.13.202:45310] AH01630: client denied by server configuration: /var/www/public_html/symposium/userfiles
[Sun Sep 20 08:47:43.397478 2026] [authz_core:error] [pid 207859:tid 140604182054464] [client 136.109.13.202:45310] AH01630: client denied by server configuration: /var/www/public_rsrc/assets/RMBS-Server-Error.html
[Sun Sep 20 08:47:43.483044 2026] [authz_core:error] [pid 207859:tid 140604215625280] [client 136.109.13.202:45310] AH01630: client denied by server configuration: /var/www/public_html/symposium/userfiles
...
show less
Bad Web Bot
🇳🇱
Savvii
2026-09-20 14:40:22
UTC ·
(1 month ago)
20 attempts against mh-misbehave-ban on redirect
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
alsmanifesto
2026-09-20 14:26:26
UTC ·
(1 month ago)
Requested paths that exist only in scanner wordlists (/.aws/config, /.aws/credentials, /.env, /.env.backup, /.env.bak) against fluentops.org. 55 requests, 2026-09-20 14:26:26 UTC. Blocked at our edge.
Web App Attack
Hacking
🇫🇷
dynamix
2026-09-20 14:19:26
UTC ·
(1 month ago)
Multiple WAF Violations
Web App Attack
🇸🇪
vaia.cloud
2026-09-20 14:15:02
UTC ·
(1 month ago)
crowdsecurity/http-cve-2021-41773
Brute-Force
Web App Attack
🇫🇷
masterguru
2026-09-20 14:13:09
UTC ·
(1 month ago)
Fake Googlebot UA from non-Google IP. Match of "ipMatchFromFile /etc/modsecurity/crs/plugins/googlebot_ranges.txt" against "REMOTE_ADDR" required. (780130-133)
Hacking
🇺🇸
TPI-Abuse
2026-09-20 14:04:35
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 136.109.13.202 (202.13.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 10:04:27.622252 2026] [security2:error] [pid 25933:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 136.109.13.202 (202.13.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 10:04:27.622252 2026] [security2:error] [pid 25933:tid 26019] [client 136.109.13.202:39122] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ennerdale.org|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ennerdale.org"] [uri "/ssl/localhost.key"] [unique_id "aq_n66a0y_6900sRq9TbEQAAAMk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Comberton
2026-09-20 14:02:59
UTC ·
(1 month ago)
Ban via by F2B apache-wordfence jail
Brute-Force
🇩🇪
ghostwarriors
2026-09-20 13:50:15
UTC ·
(1 month ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
