🇳🇱
homeshowdomain.nl
2026-09-30 22:01:23
(2 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-09-29.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-09-30 04:50:31
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 136.70.172.248 (248.172.70.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.70.172.248 (248.172.70.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 00:50:23.486222 2026] [security2:error] [pid 11307:tid 11307] [client 136.70.172.248:49638] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tech-servusa.com"] [uri "/.env.example"] [unique_id "aryVD2DJYCK_H5cbIkRuIAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 04:31:41
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 136.70.172.248 (248.172.70.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 136.70.172.248 (248.172.70.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 00:31:34.660862 2026] [security2:error] [pid 11377:tid 11377] [client 136.70.172.248:48908] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||thrivebeyondtoxic.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "thrivebeyondtoxic.com"] [uri "/z9x8c7v6b5-debug-trigger-thrivebeyondtoxic.com"] [unique_id "aryQpgDSeL2bUMl_gKAw1AAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 04:03:48
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 136.70.172.248 (248.172.70.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 136.70.172.248 (248.172.70.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 00:03:43.253586 2026] [security2:error] [pid 16996:tid 17004] [client 136.70.172.248:60824] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||theyogicat.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "theyogicat.com"] [uri "/z9x8c7v6b5-debug-trigger-theyogicat.com"] [unique_id "aryKH17RAD5sN-UfORQFuAAAAEY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 02:39:50
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 136.70.172.248 (248.172.70.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.70.172.248 (248.172.70.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 22:39:43.971735 2026] [security2:error] [pid 19178:tid 19178] [client 136.70.172.248:49642] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thn.rcto.us"] [uri "/.env"] [unique_id "arx2b4a-IKwQLYhzikLrkAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
factor1
2026-09-30 02:27:30
(2 weeks ago)
CrowdSec at thor Reports Abuse
Web App Attack
🇩🇪
raph
2026-09-30 02:26:57
(2 weeks ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 01:06:48
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 136.70.172.248 (248.172.70.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210730) triggered by 136.70.172.248 (248.172.70.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 21:06:43.672587 2026] [security2:error] [pid 23646:tid 23646] [client 136.70.172.248:44310] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||thorndikestudio.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "thorndikestudio.com"] [uri "/z9x8c7v6b5-debug-trigger-thorndikestudio.com"] [unique_id "arxgo3bURVtPEgAjDCBJxAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2026-09-30 00:23:14
(2 weeks ago)
(mod_security) mod_security (id:949110) triggered by 136.70.172.248 (US/United States/248.172.70.136 ...
show more
(mod_security) mod_security (id:949110) triggered by 136.70.172.248 (US/United States/248.172.70.136.bc.googleusercontent.com): N in the last X secs
show less
Web App Attack
🇳🇱
Site.eu
2026-09-30 00:22:44
(2 weeks ago)
Excessive multi-domain requests
Brute-Force
🇳🇱
e.fierstra
2026-09-30 00:05:24
(2 weeks ago)
excessive HTTP 404 errors
Bad Web Bot
🇧🇪
cmbplf
2026-09-29 23:02:19
(2 weeks ago)
7.614 requests from abuseipdb.com blacklisted IP (9mos2w23h)
Brute-Force
Bad Web Bot
🇫🇷
Catalin Negru
2026-09-29 22:32:24
(2 weeks ago)
2026-09-30 01:32:17,230 fail2ban.actions [289529]: NOTICE [apache-scan] Ban 136.70.172.248
2 ...
show more
2026-09-30 01:32:17,230 fail2ban.actions [289529]: NOTICE [apache-scan] Ban 136.70.172.248
2026-09-30 01:32:17,565 fail2ban.actions [289529]: NOTICE [apache-404] Ban 136.70.172.248
2026-09-30 01:32:17,738 fail2ban.actions [289529]: NOTICE [web-scanner] Ban 136.70.172.248
2026-09-30 01:32:21,786 fail2ban.actions [289529]: NOTICE [apache-security] Ban 136.70.172.248
2026-09-30 01:32:22,510 fail2ban.actions [289529]: NOTICE [apache-dirscan] Ban 136.70.172.248
...
show less
Brute-Force
Web App Attack
🇧🇷
radardatelecom
2026-09-29 22:26:04
(2 weeks ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2026-09-29 21:36:34
(2 weeks ago)
(mod_security) mod_security triggered on hostname [redacted] 136.70.172.248 (US/United States/248.17 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 136.70.172.248 (US/United States/248.172.70.136.bc.googleusercontent.com)
show less
SQL Injection
