Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
{"level":"info","ts":1794772043.2448628,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.109.28.82","remote_port":"56636","client_ip":"136.109.28.82","proto":"HTTP/2.0","method":"GET","host":"status.bitbee.ch","uri" ...
show more{"level":"info","ts":1794772043.2448628,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.109.28.82","remote_port":"56636","client_ip":"136.109.28.82","proto":"HTTP/2.0","method":"GET","host":"status.bitbee.ch","uri":"/api/.env/public/.env","headers":{"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"Cookie":["REDACTED"],"Accept-Encoding":["gzip"],"User-Agent":["Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"],"Accept":["*/*"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.bitbee.ch","ech":false}},"bytes_read":0,"user_id":"","duration":0.000093618,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1794772043.2500055,"logger":"http.log.access.log1",
...
show less
[SunNov1516:40:31.7102602026][security2:error][pid1459982:tid1460033][client136.109.28.82:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htacc ...
show more[SunNov1516:40:31.7102602026][security2:error][pid1459982:tid1460033][client136.109.28.82:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"webdisk.beyondsecurity.ch\"][uri\"/.//.env\"][unique_id\"avnSb53Yi8vVzVBhGEAgfQAAAY4\"]
show less
Observed automated probing of web application/configuration paths over completed HTTP requests. UTC 2026-11-15T14:10:41.436000+00:00 to 2026-11-15T14:10:42.742000+00:00: 10 distinct paths in 1.306s, denied HTTP 404. Trusted client-IP processing; forw ...
show moreObserved automated probing of web application/configuration paths over completed HTTP requests. UTC 2026-11-15T14:10:41.436000+00:00 to 2026-11-15T14:10:42.742000+00:00: 10 distinct paths in 1.306s, denied HTTP 404. Trusted client-IP processing; forwarding headers accepted only from official configured Cloudflare networks. No successful compromise established. Examples: /.vite/manifest.json, /build/manifest.json, /dist/manifest.json, /dist/.vite/manifest.json, /graphql, /config.json, /api/config, /settings.json, /api/graphql, /..../..../..../..../proc/self/environ.
show less
[SunNov1514:33:47.7032192026][security2:error][pid4067811:tid4067994][client136.109.28.82:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchedphrase\"proc/self/\"atARGS_NAMES:\<\?phpechoshell_exec\(\'env2\>/dev/null\|\|set2\>nul\;cat/proc/self/env ...
show more[SunNov1514:33:47.7032192026][security2:error][pid4067811:tid4067994][client136.109.28.82:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchedphrase\"proc/self/\"atARGS_NAMES:\<\?phpechoshell_exec\(\'env2\>/dev/null\|\|set2\>nul\;cat/proc/self/environ2\>/dev/null\;cat/proc/1/environ2\>/dev/null\;cat\~/.aws/credentials2\>/dev/null\;cat\~/.aws/config2\>/dev/null\;cat\~/.boto2\>/dev/null\;cat/etc/boto.cfg2\>/dev/null\;cat\~/.s3cfg2\>/dev/null\;cat.env2\>/dev/null\;cat/app/.env2\>/dev/null\;cat.env.local2\>/dev/null\;cat.env.production2\>/dev/null\;catdocker-compose.yml2\>/dev/null\;cat\~/.config/gcloud/application_default_credentials.json2\>/dev/null\'\)\;die\(\)\;\?\>.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"135\"][id\"344360\"][rev\"5\"][msg\"Atomicorp.comWAFRules:UnauthorizedOperatingSystemFileAccessAttempt\"][data\"MatchedData:proc/self/foundwithinARGS_NAMES:\<\?phpechoshell_exec\(\'env2\>/dev/null\|\|set2\>nul\;cat/proc/self/environ2\>/dev/null\;cat/proc/1/environ2\>/dev/null\;c
show less
Hacking
Web App Attack
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown
