๐บ๐ธ
TPI-Abuse
2026-09-29 07:14:14
(26 minutes ago)
(mod_security) mod_security (id:210492) triggered by 104.23.170.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.170.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 03:14:08.898162 2026] [security2:error] [pid 20466:tid 20494] [client 104.23.170.56:12575] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wicca-love-spells.com"] [uri "/.env.staging"] [unique_id "artlQLHUxPNpJTn4fou4DgAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-29 03:46:30
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.23.170.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.170.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 23:46:24.339742 2026] [security2:error] [pid 15884:tid 15884] [client 104.23.170.56:10192] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "weddingsuppliescanada.com"] [uri "/.env.local"] [unique_id "ars0kAFK2o2FIGE141HuKwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฎ๐น
Inartis
2026-09-29 03:35:23
(4 hours ago)
104.23.170.56 - - [29/Sep/2026:05:35:22 +0200] "GET /config.php HTTP/2.0" 403 0 "-" "Mozilla/5.0 (Wi ...
show more
104.23.170.56 - - [29/Sep/2026:05:35:22 +0200] "GET /config.php HTTP/2.0" 403 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
๐น๐ท
ScchutzZ
2026-09-28 22:05:15
(9 hours ago)
Fail2Ban banฤฑ. Jail: plesk-modsecurity.
Brute-Force
๐ซ๐ท
arsonist
2026-09-28 20:45:49
(10 hours ago)
[fail2ban]
2026-09-28T20:45:49.601585+00:00 arson caddy[1890453]: {"level":"info","ts":1790628349.60 ...
show more
[fail2ban]
2026-09-28T20:45:49.601585+00:00 arson caddy[1890453]: {"level":"info","ts":1790628349.6015546,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"104.23.170.56","remote_port":"11051","client_ip":"104.23.170.56","proto":"HTTP/2.0","method":"GET","host":"ayuworks.xyz","uri":"/%2f%2eenv","headers":{"Cf-Visitor":["{\"scheme\":\"https\"}"],"Cf-Ray":["a4259810baab7a96-AMS"],"Cdn-Loop":["cloudflare; loops=1"],"Accept-Encoding":["gzip, br"],"Cf-Connecting-Ip":["185.218.86.27"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"],"Accept":["*/*"],"Cf-Ipcountry":["NL"],"X-Forwarded-Proto":["https"],"X-Forwarded-For":["185.218.86.27"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"ayuworks.xyz","ech":false}},"bytes_read":0,"user_id":"","duration":0.00013
...
show less
Bad Web Bot
๐บ๐ธ
TPI-Abuse
2026-09-28 16:42:02
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.23.170.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.170.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 12:41:55.214012 2026] [security2:error] [pid 16905:tid 16925] [client 104.23.170.56:10006] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "freeziyadyaghi.info"] [uri "/.env.local"] [unique_id "arqY02Yc1n4bR14xNxZ_VAAAAM0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-28 14:15:37
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.23.170.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.170.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 10:15:32.399335 2026] [security2:error] [pid 10431:tid 10431] [client 104.23.170.56:13904] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.belgiophar.com"] [uri "/.env.staging"] [unique_id "arp2hFbTAoocgI2sKpM_YgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-28 12:02:43
(19 hours ago)
apache vulnerability scan
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-28 08:29:30
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.23.170.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.170.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 28 04:29:22.966592 2026] [security2:error] [pid 16640:tid 16640] [client 104.23.170.56:11813] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mykelmilur.com"] [uri "/.svn/entries"] [unique_id "arolYtKME9CJ9up870-aWQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-28 00:29:59
(1 day ago)
Aggressive web scan
Web App Attack
๐บ๐ธ
JCB
2026-09-27 07:53:00
(1 day ago)
104.23.170.56 - - [27/Sep/2026:06:14:12 +0300] "GET /app-config.json HTTP/1.1" 404 260 "-" "Mozilla/ ...
show more
104.23.170.56 - - [27/Sep/2026:06:14:12 +0300] "GET /app-config.json HTTP/1.1" 404 260 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
...
show less
Web App Attack
Hacking
๐บ๐ฆ
URAN Publishing Service
2026-09-26 13:31:05
(2 days ago)
[26/Sep/2026:16:31:04 +0300] -- 104.23.170.56 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.env ...
show more
[26/Sep/2026:16:31:04 +0300] -- 104.23.170.56 Ban reason: Scanner [CMS_GENERIC] | Request: GET /.env.production HTTP/1.1
show less
Bad Web Bot
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-09-26 13:12:06
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 104.23.170.56 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.170.56 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 09:11:58.916195 2026] [security2:error] [pid 4051:tid 4151] [client 104.23.170.56:10322] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.landmarkocchealth.com"] [uri "/.env.local"] [unique_id "arfEnsIJA4Z0b1pXPxL74QAAAMg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
๐ฉ๐ช
Viveronese
2026-09-26 09:56:12
(2 days ago)
HTTP vulnerability scanning
Web App Attack
2026-09-26 08:50:24
(2 days ago)
apache vulnerability scan
Web App Attack
