2026-09-26 19:45:33
UTC ·
(1 month ago)
"Packet Flood; Triggered WAF; Persistent 404 Attempts"
DDoS Attack
2026-09-21 06:20:01
UTC ·
(1 month ago)
"Packet Flood; Triggered WAF; Persistent 404 Attempts"
DDoS Attack
🇺🇸
TPI-Abuse
2026-09-21 04:12:35
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.111.10.159 (159.10.111.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 00:12:30.596020 2026] [security2:error] [pid 19558:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.111.10.159 (159.10.111.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 00:12:30.596020 2026] [security2:error] [pid 19558:tid 19558] [client 136.111.10.159:47792] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.globalvillagecambodia.org"] [uri "/.git/config"] [unique_id "arCurku1U2wAiLHLS7tnbwAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Rocky Mountain Bioengineering Symposium
2026-09-21 03:10:59
UTC ·
(1 month ago)
[Sun Sep 20 21:10:59.308139 2026] [authz_core:error] [pid 766610:tid 140604148483648] [client 136.111.10.159:44010] AH01630: client denied by server configuration: /var/www/horde/.gitconfig
[Sun Sep 20 21:10:59.358991 2026] [authz_core:error] [pid 76 ...
show more
[Sun Sep 20 21:10:59.308139 2026] [authz_core:error] [pid 766610:tid 140604148483648] [client 136.111.10.159:44010] AH01630: client denied by server configuration: /var/www/horde/.gitconfig
[Sun Sep 20 21:10:59.358991 2026] [authz_core:error] [pid 766610:tid 140604190447168] [client 136.111.10.159:44010] AH01630: client denied by server configuration: /var/www/horde/rclone.conf
[Sun Sep 20 21:10:59.427659 2026] [authz_core:error] [pid 766610:tid 140604215625280] [client 136.111.10.159:44010] AH01630: client denied by server configuration: /var/www/horde/.env.development
...
show less
Bad Web Bot
🇺🇸
IndigoRidge
2026-09-21 03:08:44
UTC ·
(1 month ago)
[20/Sep/2026:23:08:43.563755 --0400] arCfu1-Wad1f-l4J6d9qJgAAAMg 136.111.10.159 33360 205.233.18.17 7081
[20/Sep/2026:23:08:43.564058 --0400] arCfu4YCEwiA1ejxqRbeyAAAAEk 136.111.10.159 33392 205.233.18.17 7081
[20/Sep/2026:23:08:43.597976 --0400] arC ...
show more
[20/Sep/2026:23:08:43.563755 --0400] arCfu1-Wad1f-l4J6d9qJgAAAMg 136.111.10.159 33360 205.233.18.17 7081
[20/Sep/2026:23:08:43.564058 --0400] arCfu4YCEwiA1ejxqRbeyAAAAEk 136.111.10.159 33392 205.233.18.17 7081
[20/Sep/2026:23:08:43.597976 --0400] arCfu5VE7CW1WlVdXj1U@wAAAAg 136.111.10.159 33394 205.233.18.17 7081
[20/Sep/2026:23:08:44.076776 --0400] arCfvDJxiyb8x7DILp2TKwAAA4o 136.111.10.159 33680 205.233.18.17 7081
[20/Sep/2026:23:08:44.156022 --0400] arCfvJVE7CW1WlVdXj1VCAAAAAE 136.111.10.159 33720 205.233.18.17 7081
...
show less
Hacking
🇳🇱
Alt255
2026-09-21 02:52:02
UTC ·
(1 month ago)
[ti-01ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 136.111.10.159 - - \[21/Sep/2026:04:51:49 +0200\] "GET /.gitconfig HTTP/1.1" 403 618 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit/ ...
show more
[ti-01ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 136.111.10.159 - - \[21/Sep/2026:04:51:49 +0200\] "GET /.gitconfig HTTP/1.1" 403 618 "-" "Mozilla/5.0 \(Macintosh\; Intel Mac OS X 10_15_7\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Safari/537.36\; compatible\; OAI-SearchBot/1.4\; +https://openai.com/searchbot"
...
show less
Bad Web Bot
Web App Attack
🇫🇷
conseilgouz
2026-09-21 02:36:24
UTC ·
(1 month ago)
hae-88 : Bloc AI bots=>/rclone.conf(Hunyuan)
Hacking
🇬🇧
andypiper
2026-09-21 00:45:34
UTC ·
(1 month ago)
CrowdSec ban for crowdsecurity/netgear-router-bruteforce
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 00:33:53
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.111.10.159 (159.10.111.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 20:33:46.915513 2026] [security2:error] [pid 7753:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.111.10.159 (159.10.111.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 20:33:46.915513 2026] [security2:error] [pid 7753:tid 7753] [client 136.111.10.159:38744] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.humans2humans.org"] [uri "/src/.env"] [unique_id "arB7aot-r-EwrKgEJBEFygAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-21 00:02:43
UTC ·
(1 month ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 23:45:10
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.111.10.159 (159.10.111.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 19:44:56.673880 2026] [security2:error] [pid 7808:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.111.10.159 (159.10.111.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 19:44:56.673880 2026] [security2:error] [pid 7808:tid 7808] [client 136.111.10.159:52790] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.michalovic.org"] [uri "/.env.bak"] [unique_id "arBv-CsaW4MhnCfSlU3JJAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2026-09-20 22:50:06
UTC ·
(1 month ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
4server
2026-09-20 22:28:06
UTC ·
(1 month ago)
[MonSep2100:28:00.8481022026][security2:error][pid2633981:tid2634091][client136.111.10.159:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchedphrase\"proc/self/\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"135\"][i ...
show more
[MonSep2100:28:00.8481022026][security2:error][pid2633981:tid2634091][client136.111.10.159:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchedphrase\"proc/self/\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"135\"][id\"344360\"][rev\"5\"][msg\"Atomicorp.comWAFRules:UnauthorizedOperatingSystemFileAccessAttempt\"][data\"MatchedData:proc/self/foundwithinARGS:0:{\\\\x22then\\\\x22:\\\\x22\$1:__proto__:then\\\\x22\,\\\\x22status\\\\x22:\\\\x22resolved_model\\\\x22\,\\\\x22reason\\\\x22:-1\,\\\\x22value\\\\x22:\\\\x22{/\\\\x22then/\\\\x22:/\\\\x22\$b1337/\\\\x22}\\\\x22\,\\\\x22_response\\\\x22:{\\\\x22_prefix\\\\x22:\\\\x22process.mainmodule.require\(\'child_process\'\).execsync\(\'env2\>/dev/null\|\|cat/proc/self/environ2\>/dev/null\'\)\;\\\\x22\,\\\\x22_formdata\\\\x22:{\\\\x22get\\\\x22:\\\\x22\$1:constructor:constructor\\\\x22}}}\"][severity\"CRITICAL\"][tag\"attack-lfi\"][hostname\"hopitalprovidence.org\"][uri\"/\"][unique_id\"arBd8G9IiECrMbtFE0pEbwAAAMc\"]
show less
Port Scan
Brute-Force
Web App Attack
🇫🇮
Kotisivu.org
2026-09-20 22:26:23
UTC ·
(1 month ago)
{"level":"info","ts":1789943173.9926672,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"104.22.62.20","remote_port":"11835","client_ip":"136.111.10.159","proto":"HTTP/2.0","method":"GET","host":"sec.kotisivu.org","uri" ...
show more
{"level":"info","ts":1789943173.9926672,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"104.22.62.20","remote_port":"11835","client_ip":"136.111.10.159","proto":"HTTP/2.0","method":"GET","host":"sec.kotisivu.org","uri":"/.aws/credentials","headers":{"Cf-Ipcity":["Council Bluffs"],"Accept-Encoding":["gzip, br"],"Cf-Iplongitude":["-95.86083"],"Cf-Ipcontinent":["NA"],"X-Nextjs-Data":["1"],"Cf-Ipcountry":["US"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"Cf-Iplatitude":["41.26194"],"Cf-Region-Code":["IA"],"X-Forwarded-For":["136.111.10.159"],"Cf-Connecting-Ip":["136.111.10.159"],"Cf-Region":["Iowa"],"Cf-Postal-Code":["51503"],"X-Forwarded-Proto":["https"],"Cf-Metro-Code":["652"],"Cookie":["REDACTED"],"Cf-Ray":["a3e44024f9b1ee24-ORD"],"Cdn-Loop":["cloudflare; loops=1"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"User-
...
show less
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-09-20 22:24:57
UTC ·
(1 month ago)
136.111.10.159 - - [21/Sep/2026:00:24:54 +0200] "GET /api/graphql HTTP/2.0" 404 298 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
136.111.10.159 - - [21/Sep/2026:00:24:55 +0200] "GET /i.php HTTP/2.0" 404 78 "-" "Mozilla/5.0 (compatib ...
show more
136.111.10.159 - - [21/Sep/2026:00:24:54 +0200] "GET /api/graphql HTTP/2.0" 404 298 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
136.111.10.159 - - [21/Sep/2026:00:24:55 +0200] "GET /i.php HTTP/2.0" 404 78 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
136.111.10.159 - - [21/Sep/2026:00:24:55 +0200] "GET /api/4/config HTTP/2.0" 403 300 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
136.111.10.159 - - [21/Sep/2026:00:24:55 +0200] "GET /env.json HTTP/2.0" 403 300 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexitybot)"
136.111.10.159 - - [21/Sep/2026:00:24:55 +0200] "GET /pkg/.env HTTP/2.0" 404 298 "-" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)"
136.111.10.159 - - [21/Sep/2026:00:24:55 +0200] "GET /graphql/console HTTP/2.0" 404 298 "-" "Mozilla/5.0 (compatible; YiBot/1.0; +https://01.ai/)"
136.111.10.159 - - [21/Sep/2026:00:24:55 +0200] "
show less
Web App Attack
Hacking
