🇺🇸
lavnet.net
2026-09-11 18:22:55
(2 hours ago)
136.66.58.185 - - [11/Sep/2026:18:22:55 +0000] "GET /auth/login HTTP/2.0" 404 1878 "-" "Mozilla/5.0 ...
show more
136.66.58.185 - - [11/Sep/2026:18:22:55 +0000] "GET /auth/login HTTP/2.0" 404 1878 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36"
136.66.58.185 - - [11/Sep/2026:18:22:55 +0000] "GET /api/uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2fproc/self/environ HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)"
136.66.58.185 - - [11/Sep/2026:18:22:55 +0000] "GET /uploads/%2e%2e%2f%2e%2e%2f%2e%2e%2f%2e%2e%2f.env HTTP/2.0" 404 1855 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )"
136.66.58.185 - - [11/Sep/2026:18:22:55 +0000] "GET /wp-json HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
136.66.58.185 - - [11/Sep/2026:18:22:55 +0000] "GET /account/login HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobi
...
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-09-11 18:18:11
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.66.58.185 (185.58.66.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 136.66.58.185 (185.58.66.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 14:18:04.051657 2026] [security2:error] [pid 525:tid 525] [client 136.66.58.185:45758] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "intellian.us"] [uri "/@fs/proc/self/cwd/.env"] [unique_id "aqRF3HFEp24A7hm8eLHmNwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-09-11 18:05:25
(2 hours ago)
Scanning/Probing (14)
Brute-Force
Web App Attack
🇺🇸
IndigoRidge
2026-09-11 18:01:25
(2 hours ago)
136.66.58.185 - - [11/Sep/2026:14:01:23 -0400] "GET /.git/config HTTP/1.1" 403 5681 "-" "Mozilla/5.0 ...
show more
136.66.58.185 - - [11/Sep/2026:14:01:23 -0400] "GET /.git/config HTTP/1.1" 403 5681 "-" "Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)"
136.66.58.185 - - [11/Sep/2026:14:01:22 -0400] "GET /.aws/credentials HTTP/1.1" 404 42987 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.3; +https://openai.com/gptbot)"
136.66.58.185 - - [11/Sep/2026:14:01:24 -0400] "GET /static//home/user/.env HTTP/1.1" 403 5681 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-11 17:54:18
(2 hours ago)
(mod_security) mod_security (id:210730) triggered by 136.66.58.185 (185.58.66.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 136.66.58.185 (185.58.66.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 13:54:11.292299 2026] [security2:error] [pid 1926:tid 1926] [client 136.66.58.185:54622] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||greensandbeans.us|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "greensandbeans.us"] [uri "/rclone.conf"] [unique_id "aqRAQxekbXnhye3lFWJp8wAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-11 17:32:35
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.66.58.185 (185.58.66.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 136.66.58.185 (185.58.66.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 13:32:27.512763 2026] [security2:error] [pid 357562:tid 357562] [client 136.66.58.185:36170] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fresh-cut.us"] [uri "/.git/HEAD"] [unique_id "aqQ7K8PfgShxbB_TCc_PqQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-11 16:58:26
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.66.58.185 (185.58.66.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 136.66.58.185 (185.58.66.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 12:58:20.496303 2026] [security2:error] [pid 4559:tid 4559] [client 136.66.58.185:39580] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "englishmagic.us"] [uri "/.env.js"] [unique_id "aqQzLJgmd1IDvLa7AnRF1QAAAEQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-09-11 16:55:04
(3 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇫🇷
ELYAZ
2026-09-11 16:54:36
(3 hours ago)
(y3) Failed access -byebye- from 136.66.58.185 (US/United States/185.58.66.136.bc.googleusercontent. ...
show more
(y3) Failed access -byebye- from 136.66.58.185 (US/United States/185.58.66.136.bc.googleusercontent.com): (CF_ENABLE)
show less
Hacking
🇺🇸
TPI-Abuse
2026-09-11 16:30:48
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.66.58.185 (185.58.66.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 136.66.58.185 (185.58.66.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 12:30:40.554997 2026] [security2:error] [pid 29268:tid 29268] [client 136.66.58.185:34654] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "curtchristian.us"] [uri "/.//.env"] [unique_id "aqQssLq8GXeBAledqqk4zQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-09-11 16:11:41
(4 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-09-11 16:10:41
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 136.66.58.185 (185.58.66.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 136.66.58.185 (185.58.66.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 12:10:36.577713 2026] [security2:error] [pid 16817:tid 16817] [client 136.66.58.185:34478] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||chatsupply.us|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "chatsupply.us"] [uri "/rclone.conf"] [unique_id "aqQn_EOBw4tSnzYAtTUgfgAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
WellSpring
2026-09-11 16:02:31
(4 hours ago)
env leak on careenough.us/@fs/src/.env — WellSpr.ing/NetSentinel civic-AI security layer
Web App Attack