🇺🇸
Starburst SysOp Team
2026-06-04 13:27:19
(1 month ago)
Malware host (X-Forwarded-For) detected by rbl.malware.expert. RBL lookup of 104.44.207.104.rbl.malw ...
show more
Malware host (X-Forwarded-For) detected by rbl.malware.expert. RBL lookup of 104.44.207.104.rbl.malware.expert succeeded at REQUEST_HEADERS:x-forwarded-for. (1001000-mnz6-3)
show less
Hacking
🇪🇸
librebit
2026-06-01 01:15:03
(1 month ago)
Brute force
Brute-Force
🇧🇪
cmbplf
2026-04-17 08:28:47
(3 months ago)
1.815 POST requests with url.path */wp-login.php
Brute-Force
Bad Web Bot
🇳🇱
i-turnradio.nl
2026-02-16 11:37:37
(5 months ago)
2026-02-16 12:37:36 (CET) ~ Blocked by abusescan risk assessment
Web App Attack
🇺🇸
TPI-Abuse
2026-02-11 23:52:44
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 11 18:52:08.796348 2026] [security2:error] [pid 27625:tid 27625] [client 104.207.44.104:20071] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arkml.com"] [uri "/test/.git/config"] [unique_id "aY0WKPL4v3xSYACImXbHbgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-10 04:34:35
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 23:34:28.955960 2026] [security2:error] [pid 19302:tid 19302] [client 104.207.44.104:56707] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "icwcruisersguide.com"] [uri "/.env.local"] [unique_id "aYq1VNwy1XwBdRCeMP64oAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-10 04:08:25
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 23:08:17.836141 2026] [security2:error] [pid 3047:tid 3047] [client 104.207.44.104:40971] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "iceofparadise.com"] [uri "/.env"] [unique_id "aYqvMQdYYIM1JcPi7BLwBgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-10 03:03:39
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 22:03:33.044740 2026] [security2:error] [pid 9650:tid 9650] [client 104.207.44.104:22743] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "madrigalscripts.com"] [uri "/.env.staging"] [unique_id "aYqgBd3txIOAhygCDyul3QAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-09 22:58:58
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 17:58:56.207105 2026] [security2:error] [pid 1570:tid 1595] [client 104.207.44.104:30413] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kcscomputer.com"] [uri "/new/.git/config"] [unique_id "aYpmsHeVpx3S5SN-NSqeyQAAAM4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-09 22:16:29
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 17:16:21.019781 2026] [security2:error] [pid 21463:tid 21463] [client 104.207.44.104:55531] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hotline-srm.com"] [uri "/app/.git/config"] [unique_id "aYpctTJ41M3JC1_Ej7r1hgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-09 20:48:07
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 15:47:58.814520 2026] [security2:error] [pid 243352:tid 243352] [client 104.207.44.104:60189] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "honweneedthis.com"] [uri "/.env.save"] [unique_id "aYpH_gRcynukZA_YvVTbGQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-12-09 03:22:08
(7 months ago)
botnet
DDoS Attack
2025-12-03 14:46:55
(7 months ago)
botnet
DDoS Attack
🇩🇪
Hydra-Shield.fr
2025-11-29 16:13:12
(7 months ago)
Directory Traversal on: /.git/config
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 09:38:40
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.44.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 04:38:33.517410 2025] [security2:error] [pid 11044:tid 11044] [client 104.207.44.104:52273] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.stagemadrid.com"] [uri "/.svn/wc.db"] [unique_id "aSbKmbHY2931fNiWUCYU-QAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack