🇬🇧
noise.agency
2026-10-02 11:04:03
(7 minutes ago)
136.67.67.76 (US/United States/76.67.67.136.bc.googleusercontent.com), more than 10 Apache 403 hits
Hacking
🇮🇪
Coolnagour
2026-10-02 10:57:35
(14 minutes ago)
http-probing: /z9x8c7v6b5-debug-trigger-console3.icabbicanada.com
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 10:30:34
(41 minutes ago)
(mod_security) mod_security (id:210730) triggered by 136.67.67.76 (76.67.67.136.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 136.67.67.76 (76.67.67.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 06:30:30.089128 2026] [security2:error] [pid 27974:tid 27974] [client 136.67.67.76:52552] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||coretermite.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "coretermite.com"] [uri "/z9x8c7v6b5-debug-trigger-coretermite.com"] [unique_id "ar-Hxt4i1qoQmlpqwkSmLgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nasset
2026-10-02 08:53:34
(2 hours ago)
136.67.67.76 - - [02/Oct/2026:01:53:33 -0700] "GET /__/firebase/init.json HTTP/1.1" 403 584 "-" "Moz ...
show more
136.67.67.76 - - [02/Oct/2026:01:53:33 -0700] "GET /__/firebase/init.json HTTP/1.1" 403 584 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
136.67.67.76 - - [02/Oct/2026:01:53:33 -0700] "GET /api/v1/settings HTTP/1.1" 403 584 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
136.67.67.76 - - [02/Oct/2026:01:53:33 -0700] "GET /config.json HTTP/1.1" 403 584 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
136.67.67.76 - - [02/Oct/2026:01:53:33 -0700] "GET /static//app/.env HTTP/1.1" 403 584 "-" "Mozilla/5.0 (compatible; Bytespider; [email protected] ) AppleWebKit/537.36"
136.67.67.76 - - [02/Oct/2026:01:53:33 -0700] "GET /api/config HTTP/1.1" 403 584 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot"
...
show less
Bad Web Bot
Web App Attack
2026-10-02 08:06:21
(3 hours ago)
XSS Attempt
Hacking
🇺🇸
mnsf
2026-10-02 08:05:21
(3 hours ago)
Scanning/Probing (13)
Brute-Force
Web App Attack
2026-10-02 07:31:52
(3 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 136.67.67.76 (US/United States/76.67.67 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 136.67.67.76 (US/United States/76.67.67.136.bc.googleusercontent.com)
show less
SQL Injection
🇩🇪
thesimonmanuel
2026-10-02 07:11:27
(4 hours ago)
136.67.67.76 - - [02/Oct/2026:12:41:26 +0530] "GET /.ssh/config HTTP/2.0" 404 87 "-" "Mozilla/5.0 (c ...
show more
136.67.67.76 - - [02/Oct/2026:12:41:26 +0530] "GET /.ssh/config HTTP/2.0" 404 87 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "136.67.67.76"
show less
Web App Attack
🇩🇪
paissangroup
2026-10-02 06:54:20
(4 hours ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 06:44:44
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 136.67.67.76 (76.67.67.136.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 136.67.67.76 (76.67.67.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 02:44:37.824306 2026] [security2:error] [pid 29840:tid 29840] [client 136.67.67.76:43620] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||coolerboxes.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "coolerboxes.com"] [uri "/z9x8c7v6b5-debug-trigger-coolerboxes.com"] [unique_id "ar9S1WslgTYIT6neAxXbggAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-02 06:36:51
(4 hours ago)
IP matched detection query many 3xx errors.
Brute-Force
🇺🇸
TPI-Abuse
2026-10-02 06:26:07
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 136.67.67.76 (76.67.67.136.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 136.67.67.76 (76.67.67.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 02:26:02.977891 2026] [security2:error] [pid 4538:tid 4538] [client 136.67.67.76:55880] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.gisur.com|F|2"] [data ".gisur.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.gisur.com"] [uri "/z9x8c7v6b5-debug-trigger-www.gisur.com"] [unique_id "ar9OegPoFduvdHPkWuipwgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-10-02 06:25:03
(4 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
JustMeHere
2026-10-02 06:23:57
(4 hours ago)
[Fri Oct 02 02:23:52.570650 2026] [security2:error] [pid 795:tid 918] [client 136.67.67.76:55838] Mo ...
show more
[Fri Oct 02 02:23:52.570650 2026] [security2:error] [pid 795:tid 918] [client 136.67.67.76:55838] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.15.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "member.yorknation.com"] [uri "/"] [unique_id "ar9N-JfzjXxaE2RosqlDWQAAAE0"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 05:49:11
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 136.67.67.76 (76.67.67.136.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 136.67.67.76 (76.67.67.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 01:49:05.903236 2026] [security2:error] [pid 23780:tid 23780] [client 136.67.67.76:58280] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||internetnameregistration.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "internetnameregistration.com"] [uri "/z9x8c7v6b5-debug-trigger-internetnameregistration.com"] [unique_id "ar9F0QM6lib57kDJDXLzaAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
