🇬🇧
openstrike.co.uk
2026-09-30 05:14:00
(11 hours ago)
15 attacks on password/key grabbing URLs:
GET /id_dsa HTTP/1.1
Hacking
🇨🇭
🇨🇭 Hosting
2026-09-30 05:10:38
(12 hours ago)
Automated WAF report: 100-125 blocked requests from this IP detected by our WAF.
Bad Web Bot
Web App Attack
2026-09-30 05:10:22
(12 hours ago)
[BestVouchers.net] Honeypot trap triggered | Path: /.env | Time: 2026-09-30T05:10:22.943Z | UA: Mozi ...
show more
[BestVouchers.net] Honeypot trap triggered | Path: /.env | Time: 2026-09-30T05:10:22.943Z | UA: Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/) | Action: Automatically blocked for 24h and reported
show less
Bad Web Bot
Web App Attack
🇩🇪
reznekcs
2026-09-30 05:01:18
(12 hours ago)
Blocked by UFW firewall
Brute-Force
🇺🇸
TPI-Abuse
2026-09-30 04:28:51
(12 hours ago)
(mod_security) mod_security (id:243320) triggered by 136.85.64.105 (105.64.85.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:243320) triggered by 136.85.64.105 (105.64.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 00:28:47.905587 2026] [security2:error] [pid 959:tid 959] [client 136.85.64.105:47506] ModSecurity: Access denied with code 403 (phase 2). String match "/.profile" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6621"] [id "243320"] [rev "1"] [msg "COMODO WAF: Information disclosure vulnerability in Cloud Foundry PHP Buildpack (aka php-buildpack) before 4.3.18 and PHP Buildpack Cf-release before 242, as used in Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.6.38 and 1.7.x before 1.7.19 and other products (CVE-2016-6639)||www.bernarrmacfadden.riverflow.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.bernarrmacfadden.riverflow.com"] [uri "/.profile"] [unique_id "aryP_3i7VRN93Cso7DYSFAAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-09-30 03:35:07
(13 hours ago)
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encod ...
show more
HTTP header is restricted by policy (/x-middleware-subrequest/). String match within "/content-encoding/ /proxy/ /lock-token/ /content-range/ /if/ /x-http-method-override/ /x-http-method/ /x-method-override/ /x-middleware-subrequest/ /expect/" at TX:header_name_920450_x-middleware-subrequest. (920450-201)
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-30 03:17:28
(13 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.85.64.105 (105.64.85.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 136.85.64.105 (105.64.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 23:17:24.778141 2026] [security2:error] [pid 27085:tid 27085] [client 136.85.64.105:54586] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "glassicannex.org"] [uri "/@fs/src/.env"] [unique_id "arx_RAvTNF6lf5_7TBoMoAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 02:57:21
(14 hours ago)
(mod_security) mod_security (id:210730) triggered by 136.85.64.105 (105.64.85.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 136.85.64.105 (105.64.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 22:57:14.171914 2026] [security2:error] [pid 3948:tid 3948] [client 136.85.64.105:33776] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.bad.banis-associates.com|F|2"] [data ".bad.banis-associates.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.bad.banis-associates.com"] [uri "/z9x8c7v6b5-debug-trigger-www.bad.banis-associates.com"] [unique_id "arx6ihuv6YNPtjoHxNPwvgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
noise.agency
2026-09-30 02:02:16
(15 hours ago)
136.85.64.105 (SG/Singapore/105.64.85.136.bc.googleusercontent.com), more than 10 Apache 403 hits
Hacking
🇺🇸
TPI-Abuse
2026-09-30 01:40:40
(15 hours ago)
(mod_security) mod_security (id:210730) triggered by 136.85.64.105 (105.64.85.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 136.85.64.105 (105.64.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 21:40:33.393715 2026] [security2:error] [pid 26815:tid 26815] [client 136.85.64.105:60032] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||pamplonaserviciotecnico.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pamplonaserviciotecnico.com"] [uri "/z9x8c7v6b5-debug-trigger-pamplonaserviciotecnico.com"] [unique_id "arxokb6Cgf9CWH1ynoSAgwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-30 01:18:41
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.85.64.105 (105.64.85.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 136.85.64.105 (105.64.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 21:18:36.587906 2026] [security2:error] [pid 26486:tid 26506] [client 136.85.64.105:53400] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aafm.us"] [uri "/userfiles"] [unique_id "arxjbNuLsKcx5u-PwRUCWQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-09-30 01:15:58
(15 hours ago)
136.85.64.105 - - [30/Sep/2026:02:15:56 +0100] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1 ...
show more
136.85.64.105 - - [30/Sep/2026:02:15:56 +0100] "POST /cgi-bin/php-cgi.exe?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input HTTP/2.0" 404 994 "-" "Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)"
show less
Bad Web Bot
🇫🇷
masterguru
2026-09-30 00:53:56
(16 hours ago)
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .compositefont/ .config/ .conf/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .scr/ .sct/ .shs/ .sql/ .swp/ .sys/ .tlb/ .tmp/ .url/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-196)
show less
Hacking
2026-09-30 00:29:20
(16 hours ago)
Aggressive web scan
Web App Attack
🇳🇱
Alt255
2026-09-30 00:23:05
(16 hours ago)
[cb-06al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail ngin ...
show more
[cb-06al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail nginx-404. Example: 136.85.64.105 - - [30/Sep/2026:02:22:40 +0200] "POST /lib/terminal-xhr.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"
136.85.64.105 - - [30/Sep/2026:02:22:40 +0200] "GET /dist/.vite/manifest.json HTTP/2.0" 404 1338 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0"
136.85.64.105 - - [30/Sep/2026:02:22:40 +0200] "GET /.vite/manifest.json HTTP/2.0" 404 1338 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0"
136.85.64.105 - - [30/Sep/2026:02:22:41 +0200] "POST /icecoder/lib/terminal-xhr.php HTTP/2.0" 404 36 "-" "Mozilla/5.0 (compatible; PanguBot/1.0; +https://www.huaweicloud.com/)"
136.
...
show less
Bad Web Bot
Web App Attack