🇺🇸
Charlesiv
2026-09-07 02:49:13
(37 minutes ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Prot ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (GET method)
Endpoint: /.aws/config
Timestamp: 2026-09-07T01:08:57Z
Ray ID: a371d3453a3afdec
UA: Mozilla/5.0 (compatible; MistralAI-User/1.0; +https://mistral.ai/)
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-07 01:21:45
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.85.12.60 (60.12.85.136.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 136.85.12.60 (60.12.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 21:21:41.798403 2026] [security2:error] [pid 2783:tid 2783] [client 136.85.12.60:39166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "headcount.dev"] [uri "/.github/.env"] [unique_id "ap4RpU_gh5Uhgu5Zf2iRyQAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-09-07 01:05:26
(2 hours ago)
Abuse Detected (10)
Brute-Force
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-09-06 23:47:40
(3 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-path-traversal-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-06 21:28:04
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 136.85.12.60 (60.12.85.136.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 136.85.12.60 (60.12.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 17:27:59.016598 2026] [security2:error] [pid 1298769:tid 1298852] [client 136.85.12.60:55250] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||howiek.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "howiek.com"] [uri "/z9x8c7v6b5-debug-trigger-howiek.com"] [unique_id "ap3a3-zpUE8uChzG_Tyu-wAAAJM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-09-06 20:54:14
(6 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-09-06 19:46:42
(7 hours ago)
(mod_security) mod_security (id:210730) triggered by 136.85.12.60 (60.12.85.136.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 136.85.12.60 (60.12.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 15:46:38.889339 2026] [security2:error] [pid 10486:tid 10486] [client 136.85.12.60:39310] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||modeltdr.com|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "modeltdr.com"] [uri "/ssl/localhost.key"] [unique_id "ap3DHnjb9jqOpFs0_jVqQwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-09-06 16:55:23
(10 hours ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
Charlesiv
2026-09-06 14:17:48
(13 hours ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Prot ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (GET method)
Endpoint: /app/settings.py
Timestamp: 2026-09-06T12:42:07Z
Ray ID: a36d8d45cd40ca12
UA: Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)
show less
Bad Web Bot
🇨🇭
backslash
2026-09-06 12:57:00
(14 hours ago)
block ruleset WAF detection and high score on abuseIPDB 149EB1B42C242111FADBBC2EF8F90219570691E1
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-06 10:12:39
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.85.12.60 (60.12.85.136.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 136.85.12.60 (60.12.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 06:12:34.985338 2026] [security2:error] [pid 5255:tid 5255] [client 136.85.12.60:48258] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.starrmail.net"] [uri "/@fs/.env"] [unique_id "ap08ks-N-HtXoAgXnZM2_wAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-09-06 10:11:30
(17 hours ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
Anonymous
2026-09-06 09:01:41
(18 hours ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-06 08:32:11
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.85.12.60 (60.12.85.136.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 136.85.12.60 (60.12.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 06 04:32:06.075321 2026] [security2:error] [pid 15789:tid 15789] [client 136.85.12.60:41990] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.digbie.com"] [uri "/%2E%2E/%2E%2E/%2E%2E/%2E%2E/.env"] [unique_id "ap0lBomLWGxvP6uOvT1-xgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-09-06 07:53:51
(19 hours ago)
Multiple WAF Violations
Web App Attack