🇫🇷
SpaceHost-Server
2026-09-21 22:16:20
UTC ·
(1 month ago)
Brute-Force
Web App Attack
🇿🇦
conure.sh
2026-09-21 12:13:56
UTC ·
(1 month ago)
csagent: score 21.7: 404 noise floor x7, secrets grab x2; 1 domain(s) in 5s
Web App Attack
🇺🇸
gamabe
2026-09-21 06:01:22
UTC ·
(1 month ago)
Detected crowdsecurity/http-sensitive-files attack pattern. Reported by CrowdSec IDS.
Hacking
🇺🇸
snappic
2026-09-21 05:07:53
UTC ·
(1 month ago)
Scanning for config [GET /config.json.js] [Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)]
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 04:57:58
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.118.13.15 (15.13.118.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 00:57:52.862414 2026] [security2:error] [pid 26083:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.118.13.15 (15.13.118.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 00:57:52.862414 2026] [security2:error] [pid 26083:tid 26083] [client 136.118.13.15:46632] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.mobileonlinecasinos.co"] [uri "/.git/config"] [unique_id "arC5UO9ShkvJAFXIucGc0QAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
snappic
2026-09-21 04:13:55
UTC ·
(1 month ago)
Scanning for config [GET /config.json.js] [Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)]
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 03:55:23
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.118.13.15 (15.13.118.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 23:55:19.200715 2026] [security2:error] [pid 11847:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.118.13.15 (15.13.118.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 23:55:19.200715 2026] [security2:error] [pid 11847:tid 11847] [client 136.118.13.15:58318] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cookes.co"] [uri "/.git/config"] [unique_id "arCqpxxOFdbcQ0llSa8d7gAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
snappic
2026-09-21 03:11:27
UTC ·
(1 month ago)
Scanning for config [GET /config.json.js] [Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)]
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 03:00:29
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.118.13.15 (15.13.118.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 23:00:21.510955 2026] [security2:error] [pid 32355:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.118.13.15 (15.13.118.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 23:00:21.510955 2026] [security2:error] [pid 32355:tid 32355] [client 136.118.13.15:59892] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.genesis7.co"] [uri "/userfiles"] [unique_id "arCdxZRdjcsi1LF5uGYGJAAAACs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 01:18:52
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.118.13.15 (15.13.118.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 21:18:48.142392 2026] [security2:error] [pid 31488:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.118.13.15 (15.13.118.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 21:18:48.142392 2026] [security2:error] [pid 31488:tid 31488] [client 136.118.13.15:57948] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.globalhotels.com.co"] [uri "/.env.example"] [unique_id "arCF-Mk4ANvNORteQAaS7QAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-21 01:04:20
UTC ·
(1 month ago)
Aggressive web scan
Web App Attack
🇩🇪
updown.io
2026-09-21 00:35:59
UTC ·
(1 month ago)
{"level":"info","ts":1789950955.434198,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.118.13.15","remote_port":"47328","client_ip":"136.118.13.15","proto":"HTTP/2.0","method":"GET","host":"status.selia.co","uri":" ...
show more
{"level":"info","ts":1789950955.434198,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.118.13.15","remote_port":"47328","client_ip":"136.118.13.15","proto":"HTTP/2.0","method":"GET","host":"status.selia.co","uri":"/app/.env","headers":{"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"],"Accept":["*/*"],"Accept-Encoding":["gzip"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.selia.co","ech":false}},"bytes_read":0,"user_id":"","duration":0.000611867,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1789950955.4375596,"logger":"http.log.access.log1","msg":"handled request","reques
...
show less
DDoS Attack
Web App Attack
🇬🇧
Marten Mark
2026-09-21 00:25:51
UTC ·
(1 month ago)
136.118.13.15 - - [21/Sep/2026:00:25:48 +0000] "GET /z9x8c7v6b5-debug-trigger-www.cfi.co HTTP/2.0" 404 22988 "https://www.cfi.co/z9x8c7v6b5-debug-trigger-www.cfi.co" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)"
136.118.13.15 - ...
show more
136.118.13.15 - - [21/Sep/2026:00:25:48 +0000] "GET /z9x8c7v6b5-debug-trigger-www.cfi.co HTTP/2.0" 404 22988 "https://www.cfi.co/z9x8c7v6b5-debug-trigger-www.cfi.co" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)"
136.118.13.15 - - [21/Sep/2026:00:25:48 +0000] "GET /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw?? HTTP/2.0" 404 22988 "https://www.cfi.co/@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??" "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)"
136.118.13.15 - - [21/Sep/2026:00:25:48 +0000] "GET /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw?? HTTP/2.0" 404 22988 "https://www.cfi.co/@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw??" "Mozilla/5.0 (compatible; xAI-Grok/1.0; +https://x.ai/)"
136.118.13.15 - - [21/Sep/2026:00:25:48 +0000] "GET /ssl/localhost.key HTTP/2.0" 404 22988 "https://www.cfi.co/ssl/localhost.key" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
136.118.13.15 - - [21/
...
show less
Port Scan
Web App Attack
🇺🇸
snappic
2026-09-21 00:14:33
UTC ·
(1 month ago)
Scanning for config [GET /config.json.js] [Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)]
Bad Web Bot
Web App Attack
🇺🇸
gamabe
2026-09-21 00:03:45
UTC ·
(1 month ago)
Detected crowdsecurity/http-dos-swithcing-ua attack pattern. Reported by CrowdSec IDS.
Hacking
