๐ง๐ช
cmbplf
2026-10-13 00:53:39
(2 days ago)
105 requests with url.path */@fs/*
Brute-Force
Bad Web Bot
๐ฉ๐ช
Gwyneth Llewelyn
2026-10-12 17:39:16
(2 days ago)
2026/10/12 18:39:14 [error] 4060693#4060693: *2566895 access forbidden by rule, client: 136.67.48.50 ...
show more
2026/10/12 18:39:14 [error] 4060693#4060693: *2566895 access forbidden by rule, client: 136.67.48.50, server: api.betatechnologies.info, request: "GET /static/..;/..;/.env HTTP/2.0", host: "api.betatechnologies.info"
2026/10/12 18:39:14 [error] 4060693#4060693: *2566895 access forbidden by rule, client: 136.67.48.50, server: api.betatechnologies.info, request: "GET /static../.env HTTP/2.0", host: "api.betatechnologies.info"
2026/10/12 18:39:14 [error] 4060693#4060693: *2566895 access forbidden by rule, client: 136.67.48.50, server: api.betatechnologies.info, request: "GET /assets../.env HTTP/2.0", host: "api.betatechnologies.info"
show less
Brute-Force
Web App Attack
๐ฉ๐ช
rh24
2026-10-12 17:01:41
(2 days ago)
(badbots) Bad bot user-agent [redacted] from 136.67.48.50 (US/United States/50.48.67.136.bc.googleus ...
show more
(badbots) Bad bot user-agent [redacted] from 136.67.48.50 (US/United States/50.48.67.136.bc.googleusercontent.com)
show less
Hacking
๐บ๐ธ
TPI-Abuse
2026-10-12 16:17:14
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 136.67.48.50 (50.48.67.136.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 136.67.48.50 (50.48.67.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 12:17:08.400881 2026] [security2:error] [pid 26941:tid 26941] [client 136.67.48.50:53600] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "praiseworthy.info"] [uri "/media../.env"] [unique_id "as0IBL828AYd5foSMpbrFQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฆ๐บ
paulshipley.com.au
2026-10-12 16:04:13
(2 days ago)
[Tue Oct 13 03:04:13.036872 2026] [security2:error] [pid 138700] [client 136.67.48.50:41024] [client ...
show more
[Tue Oct 13 03:04:13.036872 2026] [security2:error] [pid 138700] [client 136.67.48.50:41024] [client 136.67.48.50] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "paulshipley.info"] [uri "/.git/HEAD"] [unique_id "as0E_UGlfsaGUEEhoO4MMQAAABg"]
...
show less
Web App Attack
๐ฉ๐ช
ger-stg-sifi1
2026-10-12 15:31:21
(2 days ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
๐บ๐ธ
hyena
2026-10-12 15:30:54
(2 days ago)
Repeated mod_security events.
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-12 15:19:09
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 136.67.48.50 (50.48.67.136.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 136.67.48.50 (50.48.67.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 11:19:05.120525 2026] [security2:error] [pid 10313:tid 10313] [client 136.67.48.50:53666] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "michaelholdawayvideos.info"] [uri "/css../.env"] [unique_id "asz6ac4kr6AetX9GPCBmnwAAAC0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-12 14:56:03
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 136.67.48.50 (50.48.67.136.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 136.67.48.50 (50.48.67.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 10:55:55.832039 2026] [security2:error] [pid 14098:tid 14098] [client 136.67.48.50:39196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "livesteamtracks.info"] [uri "/appearance/../../.env"] [unique_id "asz0-1TS9nV7kLkw8OHmfwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ซ๐ท
j-tap
2026-10-12 14:51:41
(2 days ago)
WordPress honeypot: automated scanner (xmlrpc / installer / .env / direct login POST)
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-12 14:39:07
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 136.67.48.50 (50.48.67.136.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 136.67.48.50 (50.48.67.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 10:39:02.919961 2026] [security2:error] [pid 24809:tid 24809] [client 136.67.48.50:48948] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "khodel.info"] [uri "/files../.env"] [unique_id "aszxBstJBjFDg_jbYK76rQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
technojoe99
2026-10-12 14:29:48
(2 days ago)
Exploit scan from 136.67.48.50. GET /portal HTTP/2.0.
Web App Attack
๐บ๐ธ
Mundo Bueno
2026-10-12 14:22:43
(2 days ago)
[ISILIA Protection v2.3] Tentative d'accรจs: /css../.env [RATE LIMITED - 1800s quarantine] | Pays: US ...
show more
[ISILIA Protection v2.3] Tentative d'accรจs: /css../.env [RATE LIMITED - 1800s quarantine] | Pays: US | UA: Mozilla/5.0 (compatible; KimiBot/1.0; +https://kimi.ai/)
show less
Hacking
Web App Attack
Anonymous
2026-10-12 14:13:01
(2 days ago)
Bot / scanning and/or hacking attempts: POST /cgi-bin/php?-d+allow_url_include%3don+-d+auto_prepend_ ...
show more
Bot / scanning and/or hacking attempts: POST /cgi-bin/php?-d+allow_url_include%3don+-d+auto_prepend_fil, GET /.docker/secrets.json HTTP/2.0
show less
Hacking
Web App Attack
๐ฆ๐บ
AWW-Admin
2026-10-12 13:51:11
(3 days ago)
(mod_security) mod_security triggered on hostname [redacted] 136.67.48.50 (US/United States/50.48.67 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 136.67.48.50 (US/United States/50.48.67.136.bc.googleusercontent.com)
show less
SQL Injection