🇺🇸
TPI-Abuse
2026-10-09 03:35:45
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 136.85.85.167 (167.85.85.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 136.85.85.167 (167.85.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 23:35:42.162973 2026] [security2:error] [pid 23916:tid 23916] [client 136.85.85.167:42462] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aiinlocal.com.verdadesreales.com|F|2"] [data ".com.verdadesreales.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aiinlocal.com.verdadesreales.com"] [uri "/z9x8c7v6b5-debug-trigger-aiinlocal.com.verdadesreales.com"] [unique_id "ashhDp3WXWZAVh8Nv6LTewAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 03:10:05
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 136.85.85.167 (167.85.85.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 136.85.85.167 (167.85.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 23:09:57.591197 2026] [security2:error] [pid 2420:tid 2420] [client 136.85.85.167:37080] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aiamur.com.aiamur.photo"] [uri "/.htpasswd"] [unique_id "ashbBcjp-rh2L0detr6EKgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
Saec
2026-10-09 02:54:47
(2 weeks ago)
Honeypot caught: /.env via ai.saec.me. UA: Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https:/ ...
show more
Honeypot caught: /.env via ai.saec.me. UA: Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler).
show less
Port Scan
Brute-Force
Bad Web Bot
Web App Attack
IoT Targeted
🇮🇩
Chasserr
2026-10-09 02:20:20
(2 weeks ago)
Port Scan
SSH
IoT Targeted
🇩🇪
updown.io
2026-10-09 02:09:08
(2 weeks ago)
{"level":"info","ts":1791511742.2240045,"logger":"http.log.access.log0","msg":"handled request","req ...
show more
{"level":"info","ts":1791511742.2240045,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"136.85.85.167","remote_port":"49818","client_ip":"136.85.85.167","proto":"HTTP/2.0","method":"GET","host":"ahmu.status.updown.io","uri":"/wp-json","headers":{"Accept-Encoding":["gzip"],"Accept":["*/*"],"Cookie":["REDACTED"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Nextjs-Data":["1"],"User-Agent":["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"ahmu.status.updown.io","ech":false}},"bytes_read":0,"user_id":"","duration":0.000228426,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1791
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 01:57:42
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 136.85.85.167 (167.85.85.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 136.85.85.167 (167.85.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 21:57:36.475913 2026] [security2:error] [pid 17088:tid 17113] [client 136.85.85.167:56876] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ahmedabdelsattar.newtrendmag.org"] [uri "/.htpasswd"] [unique_id "ashKENTdweFe72KbqQyakgAAAVM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-09 01:44:42
(2 weeks ago)
Aggressive web scan
Web App Attack
🇧🇪
Saec
2026-10-09 01:36:47
(2 weeks ago)
Honeypot caught: //.env via adminer.saec.me. UA: Mozilla/5.0 (compatible; Bravebot/1.0; +https://bra ...
show more
Honeypot caught: //.env via adminer.saec.me. UA: Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/).
show less
Port Scan
Brute-Force
Bad Web Bot
Web App Attack
IoT Targeted
🇺🇸
dot.mg
2026-10-09 01:29:02
(2 weeks ago)
Bad behaviour
Web Spam
🇬🇧
andypiper
2026-10-09 01:01:20
(2 weeks ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇫🇮
000rosiu
2026-10-09 00:30:17
(2 weeks ago)
Triggered Cloudflare WAF (firewallManaged) from SG.
Action: BLOCK | Protocol: HTTP/2 (POST) | Endpoi ...
show more
Triggered Cloudflare WAF (firewallManaged) from SG.
Action: BLOCK | Protocol: HTTP/2 (POST) | Endpoint: /index.php | UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; GPTBot/1.4; +https://openai.com/gptbot • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-09 00:30:11
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 136.85.85.167 (167.85.85.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 136.85.85.167 (167.85.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 20:30:04.505161 2026] [security2:error] [pid 7598:tid 7598] [client 136.85.85.167:59922] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vjrott.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vjrott.com"] [uri "/z9x8c7v6b5-debug-trigger-vjrott.com"] [unique_id "asg1jB5m-N-hI-u3jctOEgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-09 00:30:08
(2 weeks ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇧🇪
Saec
2026-10-09 00:14:48
(2 weeks ago)
Jarvis auto-ban: Honeypot /.env via saec.me [SG] ASN:Google LLC
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-10-08 23:22:09
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 136.85.85.167 (167.85.85.136.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210730) triggered by 136.85.85.167 (167.85.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 08 19:22:05.550889 2026] [security2:error] [pid 21242:tid 21242] [client 136.85.85.167:48712] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||greighhouse.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "greighhouse.com"] [uri "/z9x8c7v6b5-debug-trigger-greighhouse.com"] [unique_id "asglncW3VbBR-JDyP6ktdAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack