🇩🇪
FeG Deutschland
2026-09-25 16:28:25
UTC ·
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 27
Exploited Host
Web App Attack
🇺🇸
SX Communications
2026-09-25 14:16:10
UTC ·
(1 month ago)
Web vulnerability scanning / probing from 136.114.153.242: automated requests for CMS admin paths, login endpoints, xmlrpc, and common scanner fingerprints over HTTPS. 1 hits; paths: /api/session/properties.
Port Scan
Hacking
Web App Attack
🇺🇸
SX Communications
2026-09-25 14:16:10
UTC ·
(1 month ago)
HTTP application-layer DoS / botnet traffic from 136.114.153.242: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇬🇷
setupgr
2026-09-25 14:00:36
UTC ·
(1 month ago)
(mod_security) mod_security (id:11000011) triggered by 136.114.153.242 (US/United States/Iowa/Council Bluffs/-/[AS396982 Google LLC]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Fri Sep 25 17:00:32.15 ...
show more
(mod_security) mod_security (id:11000011) triggered by 136.114.153.242 (US/United States/Iowa/Council Bluffs/-/[AS396982 Google LLC]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Fri Sep 25 17:00:32.159053 2026] [security2:error] [pid 172234:tid 172420] [client 136.114.153.242:46614] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "googleusercontent.com" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "141"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: 242.153.114.136.bc.googleusercontent.com"] [severity "CRITICAL"] [hostname "pankoskal.gr"] [uri "/api/session/properties"] [unique_id "arZ-gKGFKcFu-udhr2aJtQAAA5Y"]
show less
Port Scan
2026-09-25 14:00:09
UTC ·
(1 month ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-25 13:17:14
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.114.153.242 (242.153.114.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 09:17:08.395999 2026] [security2:error] [pid 24112: ...
show more
(mod_security) mod_security (id:210492) triggered by 136.114.153.242 (242.153.114.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 09:17:08.395999 2026] [security2:error] [pid 24112:tid 24112] [client 136.114.153.242:40152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mobileonlinecasinos.co"] [uri "/wp-config.php.bak"] [unique_id "arZ0VNVfdJo9ujx3PUWFygAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-09-25 07:05:20
UTC ·
(1 month ago)
Too many Status 40X (12)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-25 04:01:13
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.114.153.242 (242.153.114.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 00:01:05.069615 2026] [security2:error] [pid 22568: ...
show more
(mod_security) mod_security (id:210492) triggered by 136.114.153.242 (242.153.114.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 00:01:05.069615 2026] [security2:error] [pid 22568:tid 22568] [client 136.114.153.242:48732] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.ultratecnologia.activethinkers.net"] [uri "/wp-config.php.bak"] [unique_id "arXyAcANUd_KO0jp57qYDQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-25 00:19:04
UTC ·
(1 month ago)
This address requests our sites over plain http, is answered with a redirect to https, and never follows it — over and over. A browser follows redirects; a scanner enumerating hosts does not. It reads nothing it asks for and only loads the server; bl ...
show more
This address requests our sites over plain http, is answered with a redirect to https, and never follows it — over and over. A browser follows redirects; a scanner enumerating hosts does not. It reads nothing it asks for and only loads the server; blocked. Please check what runs on this address. | method: GET | path: /api/session/properties | 2026-09-25 00:19 UTC
show less
Bad Web Bot
🇩🇪
Vegascosmetics
2026-09-25 00:15:18
UTC ·
(1 month ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after high AbuseIPDB reputation + local block policy. Evidence: High Abuse + Suspicion (63, Abuse: 57)
Hacking
Exploited Host
Web App Attack
🇦🇺
Terrier
2026-09-24 23:00:00
UTC ·
(1 month ago)
Blocked for HTTP vulnerability scanning (excessive 40x)
Web App Attack
🇫🇮
6kilowatti
2026-09-24 21:26:37
UTC ·
(1 month ago)
2026-09-25T00:26:37.228957+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:78:9a:18:bd:57:7e:08:00 SRC=136.114.153.242 DST=5.61.88.83 LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=48124 DF PROTO=TCP SPT=42760 DPT=3000 WINDOW=65320 RES=0x00 SYN ...
show more
2026-09-25T00:26:37.228957+03:00 6kw kernel: [UFW BLOCK] IN=eth0 OUT= MAC=00:16:3e:b6:e7:09:78:9a:18:bd:57:7e:08:00 SRC=136.114.153.242 DST=5.61.88.83 LEN=60 TOS=0x00 PREC=0x00 TTL=57 ID=48124 DF PROTO=TCP SPT=42760 DPT=3000 WINDOW=65320 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇬🇧
consul.to
2026-09-24 21:25:02
UTC ·
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
cloudmax
2026-09-24 20:43:41
UTC ·
(1 month ago)
Cloudmax IPS Block - Suspicious activity. Possible port scanning, service reconnaissance, or vulnerability probing
Port Scan
2026-09-24 19:15:09
UTC ·
(1 month ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
