🇩🇪
jeannelboutique
2026-08-27 22:18:07
(12 minutes ago)
(mod_security) mod_security triggered on hostname [redacted] 136.64.149.111 (US/United States/111.14 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 136.64.149.111 (US/United States/111.149.64.136.bc.googleusercontent.com)
show less
SQL Injection
🇵🇱
dzpk
2026-08-27 22:06:42
(23 minutes ago)
[28/Aug/2026:00:06:41 +0200] 178786840181.952734 136.64.149.111 44594 HOST 443 [28/Aug/2026:00:06:41 ...
show more
[28/Aug/2026:00:06:41 +0200] 178786840181.952734 136.64.149.111 44594 HOST 443 [28/Aug/2026:00:06:41 +0200] 178786840116.306352 136.64.149.111 44654 HOST 443 [28/Aug/2026:00:06:41 +0200] 178786840136.551130 136.64.149.111 44616 HOST 443
show less
Web App Attack
🇳🇱
homeshowdomain.nl
2026-08-27 22:02:42
(27 minutes ago)
Auto-ban: >3000 req/min op 2026-08-27
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-08-27 20:56:59
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 136.64.149.111 (111.149.64.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.64.149.111 (111.149.64.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 16:56:54.709546 2026] [security2:error] [pid 15304:tid 15304] [client 136.64.149.111:39536] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "trafficstopper.com"] [uri "/.env.old"] [unique_id "apCklsbVOPHdTo64wo1J3QAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-27 19:25:03
(3 hours ago)
suspicious request in access.log
Web App Attack
🇬🇧
gws-hostmaster
2026-08-27 19:00:01
(3 hours ago)
ModSecurity OWASP CRS (Anomaly Score: 10): Attempt to access a backup or working file;Restricted Fil ...
show more
ModSecurity OWASP CRS (Anomaly Score: 10): Attempt to access a backup or working file;Restricted File Access Attempt;URL file extension is restricted by policy;
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 18:28:43
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.64.149.111 (111.149.64.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.64.149.111 (111.149.64.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 14:28:34.862945 2026] [security2:error] [pid 31306:tid 31306] [client 136.64.149.111:38058] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.glamorgirl.net"] [uri "/.env.production"] [unique_id "apCB0gIic58G9slD3Uvr1gAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇴
jad-abuse
2026-08-27 18:06:19
(4 hours ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: env_probe, scanner_ua, source_backup, config_backup, ignition_debug, actuator. Observed by 1 sensor(s); 19 hits.
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 17:21:37
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.64.149.111 (111.149.64.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.64.149.111 (111.149.64.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 13:21:31.843282 2026] [security2:error] [pid 7791:tid 7791] [client 136.64.149.111:52644] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.eb3d.net.lahamradio.com"] [uri "/wp-config.php.swp"] [unique_id "apByG-eIqB4WJ_jzzyypTgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 16:49:07
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.64.149.111 (111.149.64.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.64.149.111 (111.149.64.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 12:49:00.410938 2026] [security2:error] [pid 23922:tid 24028] [client 136.64.149.111:51598] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.wrongfuldeathlawsuit.net.aafm.us"] [uri "/.env.local"] [unique_id "apBqfHqMvx2qG4D9bQee4wAAAk4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-08-27 16:27:32
(6 hours ago)
Try to access /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 16:20:49
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.64.149.111 (111.149.64.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.64.149.111 (111.149.64.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 12:20:46.134449 2026] [security2:error] [pid 21719:tid 21719] [client 136.64.149.111:47036] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rocketfuelpartners.com"] [uri "/.env.local"] [unique_id "apBj3gpKVgPagvyHr1ntSAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇹
nomzamo
2026-08-27 16:17:55
(6 hours ago)
Fail2Ban reported: nginx-credential-scan
Brute-Force
🇬🇧
Aetherweb Ark
2026-08-27 16:04:59
(6 hours ago)
(mod_security) mod_security (id:949110) triggered by 136.64.149.111 (US/United States/111.149.64.136 ...
show more
(mod_security) mod_security (id:949110) triggered by 136.64.149.111 (US/United States/111.149.64.136.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-27 14:07:25
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.64.149.111 (111.149.64.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.64.149.111 (111.149.64.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 27 10:07:19.607276 2026] [security2:error] [pid 2722:tid 2722] [client 136.64.149.111:54478] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aroilcontrolsystem.com"] [uri "/.env.old"] [unique_id "apBElyuHRG5tVoD0F25y4AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack