🇩🇪
Gwyneth Llewelyn
2026-10-02 15:43:01
UTC ·
(1 month ago)
2026/10/02 16:42:58 [error] 2513#2513: *294989 access forbidden by rule, client: 136.90.52.145, server: [redacted], request: "GET /cache/original/%2e%2e/%2e%2e/.env HTTP/2.0", host: "fashcon.betatechnologies.info"
2026/10/02 16:42:58 [error] 2513#251 ...
show more
2026/10/02 16:42:58 [error] 2513#2513: *294989 access forbidden by rule, client: 136.90.52.145, server: [redacted], request: "GET /cache/original/%2e%2e/%2e%2e/.env HTTP/2.0", host: "fashcon.betatechnologies.info"
2026/10/02 16:42:58 [error] 2513#2513: *294989 access forbidden by rule, client: 136.90.52.145, server: [redacted], request: "GET /static//.env HTTP/2.0", host: "fashcon.betatechnologies.info"
2026/10/02 16:42:58 [error] 2513#2513: *294989 access forbidden by rule, client: 136.90.52.145, server: [redacted], request: "GET /css../.env HTTP/2.0", host: "fashcon.betatechnologies.info"
show less
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 15:37:15
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 11:37:08.644538 2026] [security2:error] [pid 3772:tid 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 11:37:08.644538 2026] [security2:error] [pid 3772:tid 3772] [client 136.90.52.145:49532] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.smartradios.info"] [uri "/.htpasswd"] [unique_id "ar_PpPCUEgHKaAFoWPduAwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-10-02 15:30:17
UTC ·
(1 month ago)
{"level":"info","ts":1790955014.4542158,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.90.52.145","remote_port":"46192","client_ip":"136.90.52.145","proto":"HTTP/2.0","method":"GET","host":"status.menorca.info","u ...
show more
{"level":"info","ts":1790955014.4542158,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.90.52.145","remote_port":"46192","client_ip":"136.90.52.145","proto":"HTTP/2.0","method":"GET","host":"status.menorca.info","uri":"/model/info","headers":{"Authorization":["REDACTED"],"Accept-Encoding":["gzip"],"User-Agent":["Mozilla/5.0 (compatible; Qwenbot/1.0; +https://qwen.alibaba.com/)"],"Accept":["*/*"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.menorca.info","ech":false}},"bytes_read":0,"user_id":"","duration":0.001794585,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1790955014.4915786,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"136.90.52.145","remote_port":"46192","client_ip":"136.90.52.145","proto":"HTTP/2.0","method":"GET","host":"status.menorca.info","uri":"/users/login","header
...
show less
DDoS Attack
Web App Attack
🇳🇱
RobotOilInc
2026-10-02 14:41:16
UTC ·
(1 month ago)
[Coraza - Automated] Found User-Agent associated with restricted user agent. Data: Matched Data: found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (compatible; Bytespider;
[email protected] ) AppleWebKit/537.36
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-02 13:44:13
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 09:44:09.454154 2026] [security2:error] [pid 14420:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 09:44:09.454154 2026] [security2:error] [pid 14420:tid 14420] [client 136.90.52.145:48600] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.wildemar.info"] [uri "/userfiles"] [unique_id "ar-1KbtEqfV17TPyQEALhQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
grassau.com
2026-10-02 13:27:11
UTC ·
(1 month ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 136.90.52.145 (US/United States/District of Columbia/Washington/145.52.90.136.bc.googleusercontent.com)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-02 13:16:19
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 09:16:12.908797 2026] [security2:error] [pid 28559:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 09:16:12.908797 2026] [security2:error] [pid 28559:tid 28571] [client 136.90.52.145:51988] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "doorways.info"] [uri "/.//.env"] [unique_id "ar-unMrqiB5S2FsszPgxagAAAQk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 12:54:39
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 08:54:33.350892 2026] [security2:error] [pid 7330:tid 7 ...
show more
(mod_security) mod_security (id:210492) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 08:54:33.350892 2026] [security2:error] [pid 7330:tid 7330] [client 136.90.52.145:34834] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.studio716.info"] [uri "/.env.local"] [unique_id "ar-piSSG6_fOegU2GM7sbgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 11:59:59
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 07:59:56.008617 2026] [security2:error] [pid 726437:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 07:59:56.008617 2026] [security2:error] [pid 726437:tid 726437] [client 136.90.52.145:40642] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.finner.info"] [uri "/wp-config.php.bak"] [unique_id "ar-cvDbwX-Cocp8cQcYHVgAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 11:40:42
UTC ·
(1 month ago)
(mod_security) mod_security (id:949110) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 07:40:34.644735 2026] [security2:error] [pid 9431:tid 9 ...
show more
(mod_security) mod_security (id:949110) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 07:40:34.644735 2026] [security2:error] [pid 9431:tid 9431] [client 136.90.52.145:57064] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "everszuidweg.info"] [uri "/assets../.env"] [unique_id "ar-YMmenNRueJG1TtA3bcAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Mundo Bueno
2026-10-02 10:54:37
UTC ·
(1 month ago)
[ISILIA Protection v2.3] Tentative d'accès: /img../.env [RATE LIMITED - 1800s quarantine] | Pays: US | UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; +claudebot@anth
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 10:29:52
UTC ·
(1 month ago)
(mod_security) mod_security (id:210580) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 06:29:45.258510 2026] [security2:error] [pid 11713:tid ...
show more
(mod_security) mod_security (id:210580) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 06:29:45.258510 2026] [security2:error] [pid 11713:tid 11713] [client 136.90.52.145:52236] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "proc/self/environ" at ARGS:apis. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||sfee.info|F|2"] [data "Matched Data: proc/self/environ found within ARGS:apis: ../../../../../../proc/self/environ"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "sfee.info"] [uri "/api/console/api_server"] [unique_id "ar-HmVsFWzKoCZo36gKfagAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-10-02 10:24:06
UTC ·
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 10:03:35
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 06:03:30.783156 2026] [security2:error] [pid 27321:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 06:03:30.783156 2026] [security2:error] [pid 27321:tid 27321] [client 136.90.52.145:42776] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.chassell.info"] [uri "/files../.env"] [unique_id "ar-BciSZniK_UU7QJS4FsgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 09:12:25
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 05:12:19.918613 2026] [security2:error] [pid 19063:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 136.90.52.145 (145.52.90.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 05:12:19.918613 2026] [security2:error] [pid 19063:tid 19063] [client 136.90.52.145:45944] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.marat.info"] [uri "/wp-config.php.bak"] [unique_id "ar91c1cggd91p1NY3_4dFQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
