🇧🇪
madeit
2026-11-12 10:17:27
UTC ·
(2 days ago)
Web App Attack
🇧🇪
madeit
2026-10-08 03:48:55
UTC ·
(1 month ago)
Web App Attack
2026-10-07 00:20:29
UTC ·
(1 month ago)
IP matched detection query many 3xx errors.
Brute-Force
🇫🇷
arsonist
2026-09-21 09:51:44
UTC ·
(1 month ago)
[fail2ban]
2026-09-21T09:51:44.340813+00:00 arson caddy[1890453]: {"level":"info","ts":1789984304.3407772,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"104.22.100.160","remote_port":"14159","client_ip":"104.22.100 ...
show more
[fail2ban]
2026-09-21T09:51:44.340813+00:00 arson caddy[1890453]: {"level":"info","ts":1789984304.3407772,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"104.22.100.160","remote_port":"14159","client_ip":"104.22.100.160","proto":"HTTP/2.0","method":"GET","host":"ayuworks.xyz","uri":"/wp-admin/css/","headers":{"Cdn-Loop":["cloudflare; loops=1"],"Upgrade-Insecure-Requests":["1"],"Cache-Control":["max-age=0"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8"],"Cf-Connecting-Ip":["100.31.241.154"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36"],"X-Forwarded-Proto":["https"],"Cf-Ipcountry":["US"],"Cf-Ray":["a3e82c4dc86eb7be-IAD"],"X-Forwarded-For":["100.31.241.154"],"Accept-Language":["en-US,en;q=0.9
...
show less
Bad Web Bot
🇧🇪
madeit
2026-09-20 12:35:27
UTC ·
(1 month ago)
Web App Attack
🇫🇷
arsonist
2026-09-13 21:13:48
UTC ·
(2 months ago)
[fail2ban]
2026-09-13T21:13:47.800050+00:00 arson caddy[1890453]: {"level":"info","ts":1789334027.800016,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"104.22.100.160","remote_port":"12999","client_ip":"104.22.100. ...
show more
[fail2ban]
2026-09-13T21:13:47.800050+00:00 arson caddy[1890453]: {"level":"info","ts":1789334027.800016,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"104.22.100.160","remote_port":"12999","client_ip":"104.22.100.160","proto":"HTTP/2.0","method":"GET","host":"ayuworks.xyz","uri":"/@fs/home/ubuntu/.env?raw??","headers":{"Accept-Encoding":["gzip, br"],"Accept-Language":["en-US,en;q=0.9"],"Cdn-Loop":["cloudflare; loops=1"],"Cf-Connecting-Ip":["34.182.238.31"],"X-Forwarded-Proto":["https"],"X-Forwarded-For":["34.182.238.31"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8"],"Cf-Ray":["a3aa28697b28f371-IAD"],"Cf-Ipcountry":["US"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"User-Agent":["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; +https://www.anthropic.com/claude-user)"]},"tls":{"resumed":false,"version":772
...
show less
Bad Web Bot
🇫🇷
arsonist
2026-09-11 02:20:04
UTC ·
(2 months ago)
[fail2ban]
2026-09-11T02:20:04.370409+00:00 arson caddy[1890453]: {"level":"info","ts":1789093204.3703759,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"104.22.100.160","remote_port":"10445","client_ip":"104.22.100 ...
show more
[fail2ban]
2026-09-11T02:20:04.370409+00:00 arson caddy[1890453]: {"level":"info","ts":1789093204.3703759,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"104.22.100.160","remote_port":"10445","client_ip":"104.22.100.160","proto":"HTTP/2.0","method":"GET","host":"ayuworks.xyz","uri":"/.env","headers":{"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9"],"Cf-Ipcountry":["US"],"Sec-Ch-Ua-Platform":["\"macOS\""],"Sec-Fetch-Mode":["navigate"],"Cdn-Loop":["cloudflare; loops=1"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36"],"Sec-Ch-Ua":["\"Chromium\";v=\"142\", \"Google Chrome\";v=\"142\", \"Not_A Brand\";v=\"99\""],"Cf-Connecting-Ip":["54.146.159.153"],"Cf-Visitor":["{\"scheme\":\"https\"
...
show less
Bad Web Bot
🇧🇪
madeit
2026-09-08 10:27:07
UTC ·
(2 months ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-08-18 01:29:20
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 104.22.100.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 21:29:13.236186 2026] [security2:error] [pid 24052:tid 24052] [client 104.22.100.160:11923] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.100.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 21:29:13.236186 2026] [security2:error] [pid 24052:tid 24052] [client 104.22.100.160:11923] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.lmffl.com"] [uri "/.git/config"] [unique_id "aoO1aUzCynuqx6OltaLMfwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-18 01:08:15
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 104.22.100.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 21:08:05.577387 2026] [security2:error] [pid 28177:tid 28177] [client 104.22.100.160:10952] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.100.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 21:08:05.577387 2026] [security2:error] [pid 28177:tid 28177] [client 104.22.100.160:10952] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.transportdelivery.com"] [uri "/.git/config"] [unique_id "aoOwdb5TXUFQqYX-AqVQEAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-17 15:42:16
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 104.22.100.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 11:42:10.667649 2026] [security2:error] [pid 12985:tid 12985] [client 104.22.100.160:13260] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.100.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 11:42:10.667649 2026] [security2:error] [pid 12985:tid 12985] [client 104.22.100.160:13260] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stlrosesociety.org"] [uri "/.git/config"] [unique_id "aoMr0mBYmvDfLzKLt7EzNgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-17 13:43:17
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 104.22.100.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 09:43:13.850375 2026] [security2:error] [pid 31910:tid 31910] [client 104.22.100.160:13367] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.100.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 09:43:13.850375 2026] [security2:error] [pid 31910:tid 31910] [client 104.22.100.160:13367] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.ballast-capital.com"] [uri "/.git/HEAD"] [unique_id "aoMP8fcfE3xw1nTYlFa0GAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-17 11:08:15
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 104.22.100.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 07:08:10.575928 2026] [security2:error] [pid 19757:tid 19757] [client 104.22.100.160:10857] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.100.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 07:08:10.575928 2026] [security2:error] [pid 19757:tid 19757] [client 104.22.100.160:10857] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.macau-muaythai.com"] [uri "/.git/HEAD"] [unique_id "aoLrmvDnbHuf4BFeqL3_fQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-17 07:10:44
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 104.22.100.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 03:10:36.295123 2026] [security2:error] [pid 30656:tid 30687] [client 104.22.100.160:13961] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.100.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 03:10:36.295123 2026] [security2:error] [pid 30656:tid 30687] [client 104.22.100.160:13961] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.dbestcarting.com"] [uri "/.git/config"] [unique_id "aoKz7JmbTdxM8V8JZ_l-MQAAANY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-17 06:33:36
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 104.22.100.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 02:33:28.137090 2026] [security2:error] [pid 15857:tid 15857] [client 104.22.100.160:10238] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.100.160 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 02:33:28.137090 2026] [security2:error] [pid 15857:tid 15857] [client 104.22.100.160:10238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "iyp-home.com"] [uri "/.git/HEAD"] [unique_id "aoKrOFVnQlxxSQtgv8n_wAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
