🇩🇪
4server
2026-10-15 23:37:44
UTC ·
(3 weeks ago)
[FriOct1601:37:38.0363622026][security2:error][pid427765:tid427863][client104.22.23.48:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess ...
show more
[FriOct1601:37:38.0363622026][security2:error][pid427765:tid427863][client104.22.23.48:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"www.giuseppeasaro.com\"][uri\"/wp-config.php\"][unique_id\"atFjws8HlFTxG6gVSm6zjwAAAQM\"]
show less
Port Scan
Brute-Force
Web App Attack
🇮🇹
Inartis
2026-10-15 22:59:20
UTC ·
(3 weeks ago)
104.22.23.48 - - [16/Oct/2026:00:59:18 +0200] "GET /.env.dev HTTP/1.1" 302 459 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
...
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 15:31:47
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.22.23.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 11:31:31.943122 2026] [security2:error] [pid 30084:tid 30084] [client 104.22.23.48:10022] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.23.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 11:31:31.943122 2026] [security2:error] [pid 30084:tid 30084] [client 104.22.23.48:10022] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.whatifandwhynot.xyz"] [uri "/.env.staging"] [unique_id "atDx08mOldhkU4Cpm-234QAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 15:08:58
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.22.23.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 11:08:40.878425 2026] [security2:error] [pid 8403:tid 8403] [client 104.22.23.48:11604] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.23.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 11:08:40.878425 2026] [security2:error] [pid 8403:tid 8403] [client 104.22.23.48:11604] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jkperis.com"] [uri "/.env.production"] [unique_id "atDseMUbYyoobAxak29HPAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
on-com
2026-10-15 14:14:14
UTC ·
(3 weeks ago)
URL scan
Brute-Force
Web App Attack
🇩🇪
ghostwarriors
2026-10-15 12:20:09
UTC ·
(3 weeks ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-10-15 12:11:04
UTC ·
(3 weeks ago)
104.22.23.48 - - [15/Oct/2026:14:10:52 +0200] "GET /wp-config.php.bak HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0"
104.22.23.48 - - [15/Oct/2026:14:10:51 +0200] "GET /.kube/config HTTP/2.0" 40 ...
show more
104.22.23.48 - - [15/Oct/2026:14:10:52 +0200] "GET /wp-config.php.bak HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0"
104.22.23.48 - - [15/Oct/2026:14:10:51 +0200] "GET /.kube/config HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0"
104.22.23.48 - - [15/Oct/2026:14:10:53 +0200] "GET /index.php~ HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"
104.22.23.48 - - [15/Oct/2026:14:10:53 +0200] "GET /phpinfo.php HTTP/2.0" 200 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15"
104.22.23.48 - - [15/Oct/2026:14:10:54 +0200] "GET /index%20copy.php HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0"
104.22.23.48 - - [15/Oct/2026:14:10:56 +0200] "GET /.env.old HTTP/1.1" 3
show less
Web App Attack
Brute-Force
🇺🇸
TPI-Abuse
2026-10-15 11:56:18
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.22.23.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 07:56:10.864968 2026] [security2:error] [pid 19920:tid 19920] [client 104.22.23.48:11211] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.23.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 07:56:10.864968 2026] [security2:error] [pid 19920:tid 19920] [client 104.22.23.48:11211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "davidsonmanagement.net"] [uri "/.env.production"] [unique_id "atC_WqPlTnUOSupBX-Xl-AAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 08:46:21
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.22.23.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 04:45:53.659348 2026] [security2:error] [pid 23136:tid 23136] [client 104.22.23.48:12750] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.23.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 04:45:53.659348 2026] [security2:error] [pid 23136:tid 23136] [client 104.22.23.48:12750] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wasabioldies.com"] [uri "/wp-config.php"] [unique_id "atCSwXtZyi8iZu1wcF2CkwAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 05:37:55
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.22.23.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 01:37:46.710746 2026] [security2:error] [pid 20700:tid 20700] [client 104.22.23.48:10243] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 104.22.23.48 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 01:37:46.710746 2026] [security2:error] [pid 20700:tid 20700] [client 104.22.23.48:10243] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tristarus.com"] [uri "/.env.old"] [unique_id "atBmqhdbOYju044HxsXD8gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-15 04:12:38
UTC ·
(3 weeks ago)
Sensitive Configuration File Disclosure.
Hacking
🇧🇷
paradoxnetworks
2026-10-06 04:53:12
UTC ·
(1 month ago)
2026-10-06T04:52:22.735022+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[528337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.22.23.48
2026-10-06T04:52:25.401923+00:00 edge-con-sao01.int.pdx.net.uk s ...
show more
2026-10-06T04:52:22.735022+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[528337]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=104.22.23.48
2026-10-06T04:52:25.401923+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[528337]: Failed password for invalid user moltuser from 104.22.23.48 port 51160 ssh2
2026-10-06T04:53:11.612830+00:00 edge-con-sao01.int.pdx.net.uk sshd-session[528477]: Invalid user username from 104.22.23.48 port 62852
...
show less
Brute-Force
SSH
🇧🇪
madeit
2026-08-16 01:57:28
UTC ·
(2 months ago)
Web App Attack
🇺🇸
mawan
2026-08-13 01:01:52
UTC ·
(2 months ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
🇺🇸
mawan
2026-08-07 05:52:32
UTC ·
(3 months ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
