🇺🇸
TPI-Abuse
2026-09-21 06:33:14
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 136.109.253.73 (73.253.109.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.253.73 (73.253.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 02:33:08.605753 2026] [security2:error] [pid 22222:tid 22222] [client 136.109.253.73:45952] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.thenewplantation.org"] [uri "/.env.production"] [unique_id "arDPpFHSWldfIT1muBwZ7AAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 06:09:17
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 136.109.253.73 (73.253.109.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.253.73 (73.253.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 02:09:12.633491 2026] [security2:error] [pid 18745:tid 18745] [client 136.109.253.73:35810] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.hbgmccormickfoundation.org"] [uri "/@fs/app/.env"] [unique_id "arDKCBOSsRHbBenYi77w-wAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-21 04:09:41
(1 day ago)
[ti-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 136.109.253.73 - - [21/Sep/2026:06:09:24 +0200] "GET /userfiles?path=../../../.env HTTP/2.0" 404 1358 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 04:04:14
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 136.109.253.73 (73.253.109.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.253.73 (73.253.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 00:04:10.890719 2026] [security2:error] [pid 20306:tid 20306] [client 136.109.253.73:47090] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.thejuniverse.org"] [uri "/userfiles"] [unique_id "arCsupthRxljf0-BlQNvFgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
grassau.com
2026-09-21 04:01:46
(1 day ago)
*Port Scan* detected from 136.109.253.73 (US/United States/Oregon/The Dalles/73.253.109.136.bc.googl ...
show more
*Port Scan* detected from 136.109.253.73 (US/United States/Oregon/The Dalles/73.253.109.136.bc.googleusercontent.com).
show less
Port Scan
🇫🇮
Markus Media
2026-09-21 03:50:58
(1 day ago)
{"level":"info","ts":1789962657.7387123,"logger":"http.log.access.log0","msg":"handled request","req ...
show more
{"level":"info","ts":1789962657.7387123,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"172.71.150.205","remote_port":"12977","client_ip":"136.109.253.73","proto":"HTTP/2.0","method":"GET","host":"extranet.kotisivu.org","uri":"/.ssh/id_rsa","headers":{"Cf-Ipcountry":["US"],"Cf-Iplatitude":["45.59456"],"Accept-Encoding":["gzip, br"],"Cf-Ipcity":["The Dalles"],"X-Forwarded-For":["136.109.253.73"],"Cf-Iplongitude":["-121.17868"],"Cf-Metro-Code":["820"],"Cf-Region-Code":["OR"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Cdn-Loop":["cloudflare; loops=1"],"X-Nextjs-Data":["1"],"X-Forwarded-Proto":["https"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"User-Agent":["Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"],"Cookie":["REDACTED"],"Cf-Region":["Oregon"],"Cf-Ray":["a3e61bd19d9b55d1
...
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 03:24:41
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 136.109.253.73 (73.253.109.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.253.73 (73.253.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 23:24:37.118961 2026] [security2:error] [pid 14328:tid 14328] [client 136.109.253.73:35428] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.thecollective.org"] [uri "/.env"] [unique_id "arCjdY0nWIAWXLeqEV7UXwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
grassau.com
2026-09-21 03:22:55
(1 day ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 136.109.253.73 (US/U ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 136.109.253.73 (US/United States/Oregon/The Dalles/73.253.109.136.bc.googleusercontent.com)
show less
Bad Web Bot
🇩🇪
updown.io
2026-09-21 03:15:47
(1 day ago)
{"level":"info","ts":1789960541.1903982,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1789960541.1903982,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.109.253.73","remote_port":"60180","client_ip":"136.109.253.73","proto":"HTTP/2.0","method":"GET","host":"status.lioctad.org","uri":"/manifest.json","headers":{"Sec-Fetch-Site":["none"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Priority":["u=0, i"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"Sec-Ch-Ua-Mobile":["?0"],"Upgrade-Insecure-Requests":["1"],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Brave\";v=\"153\", \"Not_A Brand\";v=\"8\""],"Sec-Fetch-User":["?1"],"Accept-Language":["en-US,en;q=0.9"],"X-Nextjs-Data":["1"],"Sec-Fetch-Dest":["document"],"Accept-Encoding":["gzip, deflate, br, zstd"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"],"Sec-Fetch-Mode":["navigate"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/mi
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 02:51:43
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 136.109.253.73 (73.253.109.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.253.73 (73.253.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 22:51:36.224154 2026] [security2:error] [pid 20438:tid 20438] [client 136.109.253.73:41264] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.flinthillsveterans.org"] [uri "/%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env"] [unique_id "arCbuLH_0j2U8Uo8_-8pGwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 01:13:27
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 136.109.253.73 (73.253.109.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.253.73 (73.253.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 21:13:21.213639 2026] [security2:error] [pid 11258:tid 11258] [client 136.109.253.73:32978] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.yeswedeliver.org"] [uri "/temp/.env"] [unique_id "arCEsUf59uzAyBTXvQ810gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-20 21:59:03
(2 days ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 21:54:22
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 136.109.253.73 (73.253.109.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.109.253.73 (73.253.109.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 17:54:18.169437 2026] [security2:error] [pid 22217:tid 22217] [client 136.109.253.73:50134] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.bowlinggreenrosesociety.org"] [uri "/config/.env"] [unique_id "arBWCl9-g7q3dZ6HiGNtOAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2026-09-20 21:40:20
(2 days ago)
Attempted access to sensitive endpoint (/.env.old) detected. Automated scan or unauthorized probing.
Web App Attack
🇳🇱
melroy89
2026-09-20 21:32:34
(2 days ago)
2026/09/20 23:32:33 [error] 423884#423884: *530559 limiting requests, excess: 5.148 by zone "ip", cl ...
show more
2026/09/20 23:32:33 [error] 423884#423884: *530559 limiting requests, excess: 5.148 by zone "ip", client: "136.109.253.73", server: "_", request_line: "GET /settings.js HTTP/1.1", host: "media.libreweb.org"
2026/09/20 23:32:34 [error] 423884#423884: *530564 limiting requests, excess: 5.050 by zone "ip", client: "136.109.253.73", server: "_", request_line: "GET /environment.js HTTP/1.1", host: "media.libreweb.org"
2026/09/20 23:32:34 [error] 423884#423884: *530566 limiting requests, excess: 5.441 by zone "ip", client: "136.109.253.73", server: "_", request_line: "GET /service-worker.js HTTP/1.1", host: "media.libreweb.org"
...
show less
Web App Attack
