🇳🇱
homeshowdomain.nl
2026-09-02 21:59:37
UTC ·
(2 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-01.
Web App Attack
SSH
Hacking
🇺🇸
mnsf
2026-09-02 03:05:26
UTC ·
(2 months ago)
Scanning/Probing (20)
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-09-01 21:59:20
UTC ·
(2 months ago)
Auto-ban: >3000 req/min op 2026-09-01
Web App Attack
SSH
Hacking
🇷🇴
iulianh
2026-09-01 13:54:04
UTC ·
(2 months ago)
80,443
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-09-01 13:51:29
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 136.112.131.106 (106.131.112.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 09:51:23.398732 2026] [security2:error] [pid 13882: ...
show more
(mod_security) mod_security (id:210492) triggered by 136.112.131.106 (106.131.112.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 09:51:23.398732 2026] [security2:error] [pid 13882:tid 13882] [client 136.112.131.106:44676] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.slovenia-boat-registration.com"] [uri "/.env.old"] [unique_id "apbYW2T_uM22MtYORALDQgAAAGw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2026-09-01 13:05:35
UTC ·
(2 months ago)
(mod_security) mod_security (id:949110) triggered by 136.112.131.106 (US/United States/106.131.112.136.bc.googleusercontent.com): N in the last X secs
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 12:46:43
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 136.112.131.106 (106.131.112.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 08:46:36.756333 2026] [security2:error] [pid 22967: ...
show more
(mod_security) mod_security (id:210492) triggered by 136.112.131.106 (106.131.112.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 08:46:36.756333 2026] [security2:error] [pid 22967:tid 22967] [client 136.112.131.106:36270] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "citrineartstudio.com"] [uri "/.env"] [unique_id "apbJLKZZ_HgXXC2ff8clGwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 10:58:06
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 136.112.131.106 (106.131.112.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 06:58:01.342728 2026] [security2:error] [pid 26183: ...
show more
(mod_security) mod_security (id:210492) triggered by 136.112.131.106 (106.131.112.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 06:58:01.342728 2026] [security2:error] [pid 26183:tid 26183] [client 136.112.131.106:34730] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.restorationclinic1.com"] [uri "/.env"] [unique_id "apavuTpOf3GQKLIjeIQCCQAAADo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Petros Stefanakis
2026-09-01 10:57:06
UTC ·
(2 months ago)
(mod_security) mod_security triggered on hostname [redacted] 136.112.131.106 (US/United States/106.131.112.136.bc.googleusercontent.com)
SQL Injection
🇩🇪
4server
2026-09-01 10:29:10
UTC ·
(2 months ago)
[TueSep0112:29:05.7469472026][security2:error][pid4029684:tid4029739][client136.112.131.106:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.hta ...
show more
[TueSep0112:29:05.7469472026][security2:error][pid4029684:tid4029739][client136.112.131.106:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"albertiarnaldoluigi.ch\"][uri\"/.env.bak\"][unique_id\"apao8cgWEJdfcrb6ExT11gAAAFM\"]
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-01 09:50:33
UTC ·
(2 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-01 08:51:06
UTC ·
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 136.112.131.106 (106.131.112.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 04:50:57.985874 2026] [security2:error] [pid 3975:t ...
show more
(mod_security) mod_security (id:210730) triggered by 136.112.131.106 (106.131.112.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 04:50:57.985874 2026] [security2:error] [pid 3975:tid 3975] [client 136.112.131.106:51890] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||shafoo.com.sentientresearch.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "shafoo.com.sentientresearch.com"] [uri "/storage/logs/laravel.log"] [unique_id "apaR8TmKktpz5-pWn_1jnAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-09-01 08:45:34
UTC ·
(2 months ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-01 08:20:22
UTC ·
(2 months ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
tsZero
2026-09-01 07:46:33
UTC ·
(2 months ago)
Scan example: path=/.env.local status=403
Hacking