🇺🇸
TPI-Abuse
2026-09-23 02:08:36
(14 hours ago)
(mod_security) mod_security (id:210730) triggered by 136.116.251.237 (237.251.116.136.bc.googleuserc ...
show more
(mod_security) mod_security (id:210730) triggered by 136.116.251.237 (237.251.116.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 22:08:30.403120 2026] [security2:error] [pid 13795:tid 13795] [client 136.116.251.237:59234] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.garanta.co|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.garanta.co"] [uri "/rclone.conf"] [unique_id "arM0ntBzMQn8jsw_XhWQ1AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-23 01:50:07
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.116.251.237 (237.251.116.136.bc.googleuserc ...
show more
(mod_security) mod_security (id:210492) triggered by 136.116.251.237 (237.251.116.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 21:50:00.152514 2026] [security2:error] [pid 29732:tid 29732] [client 136.116.251.237:54178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.forwardfusion.co"] [uri "/.env.backup"] [unique_id "arMwSFu4cbq2CeF4GHVUNwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-23 01:22:38
(15 hours ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: Back ...
show more
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: Backup file probing, Cloud secrets probing, Directory traversal
show less
Bad Web Bot
Web App Attack
🇺🇸
IndigoRidge
2026-09-22 22:52:56
(17 hours ago)
136.116.251.237 - - [22/Sep/2026:18:52:55 -0400] "GET /admin/.env HTTP/1.1" 404 81161 "https://www.c ...
show more
136.116.251.237 - - [22/Sep/2026:18:52:55 -0400] "GET /admin/.env HTTP/1.1" 404 81161 "https://www.civility.co/admin/.env" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
136.116.251.237 - - [22/Sep/2026:18:52:55 -0400] "GET /api/.env HTTP/1.1" 404 81157 "https://www.civility.co/api/.env" "Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.com/search/spider.html)"
136.116.251.237 - - [22/Sep/2026:18:52:55 -0400] "GET /backend/.env HTTP/1.1" 404 81165 "https://www.civility.co/backend/.env" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"
...
show less
Web App Attack
🇬🇧
Marten Mark
2026-09-22 22:39:47
(18 hours ago)
136.116.251.237 - - [22/Sep/2026:22:39:43 +0000] "POST /api/fs/exec HTTP/2.0" 404 22778 "-" "Mozilla ...
show more
136.116.251.237 - - [22/Sep/2026:22:39:43 +0000] "POST /api/fs/exec HTTP/2.0" 404 22778 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
136.116.251.237 - - [22/Sep/2026:22:39:43 +0000] "GET /esus50uxgieob5r01n16 HTTP/2.0" 404 22988 "https://www.cfi.co/esus50uxgieob5r01n16" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
136.116.251.237 - - [22/Sep/2026:22:39:43 +0000] "GET /esus50uxgieob5r01n16 HTTP/2.0" 404 22988 "https://www.cfi.co/esus50uxgieob5r01n16" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
136.116.251.237 - - [22/Sep/2026:22:39:43 +0000] "GET /build/manifest.json HTTP/2.0" 404 22988 "https://www.cfi.co/build/manifest.json" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36"
136.116.251.237 - - [22/Sep/2026:22:39:43 +0000] "GET /build/manifest.json HTTP/2.0" 404 22988 "https://www.cfi.co/build/manifest.json" "Mozilla/5.0 (Linux;
...
show less
Port Scan
Web App Attack
🇫🇷
SpaceHost-Server
2026-09-22 22:17:18
(18 hours ago)
Brute-Force
Web App Attack
🇺🇸
Victor López
2026-09-22 22:09:59
(18 hours ago)
www.buscaempresas.co 136.116.251.237 - - [22/Sep/2026:17:09:37 -0500] "GET /api/console/api_server?s ...
show more
www.buscaempresas.co 136.116.251.237 - - [22/Sep/2026:17:09:37 -0500] "GET /api/console/api_server?sense_version=%40%40SENSE_VERSION&apis=../../../../../../.env HTTP/2.0" 403 6709 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)" MISS
buscaempresas.co 136.116.251.237 - - [22/Sep/2026:17:09:39 -0500] "GET /__vite_rsc_findSourceMapURL?filename=file:///app/.env&environmentName=rsc HTTP/2.0" 404 8197 "https://www.buscaempresas.co/__vite_rsc_findSourceMapURL?filename=file:///app/.env&environmentName=rsc" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)" MISS
buscaempresas.co 136.116.251.237 - - [22/Sep/2026:17:09:58 -0500] "GET /__vite_rsc_findSourceMapURL?filename=file:///app/.env&environmentName=rsc HTTP/2.0" 404 8197 "https://www.buscaempresas.co/__vite_rsc_findSourceMapURL?filename=file:///app/.env&environmentName=rsc" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)" MISS
...
show less
Hacking
Web App Attack
🇩🇪
macrob
2026-09-22 21:27:14
(19 hours ago)
2026/09/22 21:26:18 [error] 1636368#1636368: *26265996 access forbidden by rule, client: 136.116.251 ...
show more
2026/09/22 21:26:18 [error] 1636368#1636368: *26265996 access forbidden by rule, client: 136.116.251.237, server: binixo.co, request: "GET /.vite/manifest.json HTTP/2.0", host: "www.binixo.co"
2026/09/22 21:26:18 [error] 1636368#1636368: *26265998 access forbidden by rule, client: 136.116.251.237, server: binixo.co, request: "GET /dist/.vite/manifest.json HTTP/2.0", host: "www.binixo.co"
2026/09/22 21:26:18 [error] 1636368#1636368: *26266013 access forbidden by rule, client: 136.116.251.237, server: binixo.co, request: "GET /.env.old HTTP/2.0", host: "www.binixo.co"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 20:20:37
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.116.251.237 (237.251.116.136.bc.googleuserc ...
show more
(mod_security) mod_security (id:210492) triggered by 136.116.251.237 (237.251.116.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 16:20:32.543611 2026] [security2:error] [pid 13470:tid 13470] [client 136.116.251.237:45918] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.arabou.co"] [uri "/static//.env"] [unique_id "arLjEFoD9b08oLpZ-m6xYQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
interbiznw.com
2026-09-22 17:05:30
(23 hours ago)
malicious-web-requests-vulnerability-scanning
Hacking
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 15:01:15
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 136.116.251.237 (237.251.116.136.bc.googleuserc ...
show more
(mod_security) mod_security (id:210492) triggered by 136.116.251.237 (237.251.116.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 11:01:07.006698 2026] [security2:error] [pid 24195:tid 24195] [client 136.116.251.237:33188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ccancun.co"] [uri "/api/.env/public/.env"] [unique_id "arKYM5Rt8Ed9Dkk90WsNJwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Marten Mark
2026-09-22 14:55:39
(1 day ago)
136.116.251.237 - - [22/Sep/2026:14:55:38 +0000] "GET /@fs/home/ubuntu/.aws/credentials?raw?? HTTP/2 ...
show more
136.116.251.237 - - [22/Sep/2026:14:55:38 +0000] "GET /@fs/home/ubuntu/.aws/credentials?raw?? HTTP/2.0" 404 22988 "-" "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)"
...
show less
Web App Attack
Bad Web Bot
🇺🇸
IndigoRidge
2026-09-22 14:41:41
(1 day ago)
136.116.251.237 - - [22/Sep/2026:10:41:39 -0400] "GET /phpinfo.php HTTP/1.1" 404 81161 "-" "Mozilla/ ...
show more
136.116.251.237 - - [22/Sep/2026:10:41:39 -0400] "GET /phpinfo.php HTTP/1.1" 404 81161 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)"
136.116.251.237 - - [22/Sep/2026:10:41:39 -0400] "GET /info.php HTTP/1.1" 404 81155 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot"
136.116.251.237 - - [22/Sep/2026:10:41:40 -0400] "GET /test.php HTTP/1.1" 404 81155 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 14:32:37
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 136.116.251.237 (237.251.116.136.bc.googleuserc ...
show more
(mod_security) mod_security (id:210492) triggered by 136.116.251.237 (237.251.116.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 10:32:32.309420 2026] [security2:error] [pid 12866:tid 12866] [client 136.116.251.237:36744] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cmexico.co"] [uri "/@fs/app/.env"] [unique_id "arKRgKmrwjyTuDLlMVsxPwAAAEQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 14:11:30
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 136.116.251.237 (237.251.116.136.bc.googleuserc ...
show more
(mod_security) mod_security (id:210492) triggered by 136.116.251.237 (237.251.116.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 10:11:22.765686 2026] [security2:error] [pid 13567:tid 13567] [client 136.116.251.237:34300] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cookes.co"] [uri "/@fs/src/.env"] [unique_id "arKMilrMtbvZ52Ot3GOicAAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack