🇧🇪
madeit
2026-08-22 05:38:09
(15 hours ago)
Web App Attack
🇲🇽
octageeks.com
2026-08-22 04:21:35
(16 hours ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇩🇪
netclix.gr
2026-08-15 03:49:39
(1 week ago)
(security_scan) Sensitive File Scan Blocked 104.23.187.2 (US/United States/-): 1 in the last 4600 se ...
show more
(security_scan) Sensitive File Scan Blocked 104.23.187.2 (US/United States/-): 1 in the last 4600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 104.23.187.2 - - [15/Aug/2026:06:49:25 +0300] "GET /.git/config HTTP/2.0" 404 532 "-" "Mozilla/5.0 (l9scan/2.0.7393e2330323e27363e2237313; +https://leakix.net)" "165.22.34.189"'/error_docs/404.html' '' '/opt/psa/admin/htdocs'
show less
Port Scan
🇲🇽
octageeks.com
2026-07-31 04:20:47
(3 weeks ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇩🇪
acadeova
2026-05-01 11:59:15
(3 months ago)
🚨 Recon detected (nft drop)
SRC=104.23.187.2
Observed=TCP dpt=80 in=enp0s6 ttl=57
Time=recent(journa ...
show more
🚨 Recon detected (nft drop)
SRC=104.23.187.2
Observed=TCP dpt=80 in=enp0s6 ttl=57
Time=recent(journalctl: 10 minutes ago)
Assessment=Generic scanning / reconnaissance (PORT_SCAN)
show less
Port Scan
🇺🇸
TPI-Abuse
2026-04-01 15:41:05
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 11:40:57.718042 2026] [security2:error] [pid 8582:tid 8582] [client 104.23.187.2:11280] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.ditchthediaper.com"] [uri "/home/.env"] [unique_id "ac08iYVAjaJI54V8Hedf2QAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-01 01:06:49
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 21:06:45.816531 2026] [security2:error] [pid 30694:tid 30694] [client 104.23.187.2:13112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.tankercontrol.com"] [uri "/site/.env"] [unique_id "acxvpbtroGetRtGbbBcZ7wAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 01:18:10
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 21:17:59.354256 2026] [security2:error] [pid 21713:tid 21713] [client 104.23.187.2:10509] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.flightclaimservices.com"] [uri "/var/www/.env"] [unique_id "ab3xx1vpoQQItvkvgdEavQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 06:51:39
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 02:51:35.090959 2026] [security2:error] [pid 24233:tid 24233] [client 104.23.187.2:10271] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.berntson.org"] [uri "/server/.env"] [unique_id "abzudwjks9B8UPGJ70PFnQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 05:04:42
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 01:04:35.138358 2026] [security2:error] [pid 6266:tid 6266] [client 104.23.187.2:13341] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.wmodradio.com"] [uri "/home/.env"] [unique_id "abzVY7G9UndFKLEQHVXw8gAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 04:45:16
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 00:45:04.275675 2026] [security2:error] [pid 10059:tid 10070] [client 104.23.187.2:14079] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "powercoupling.pwrcoupling.com"] [uri "/.env.php"] [unique_id "abzQ0BVJXC6QG5opubt_sAAAAQk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 03:37:57
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 23:37:53.145677 2026] [security2:error] [pid 15860:tid 15860] [client 104.23.187.2:14321] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.agapeaccountingllc.com"] [uri "/root/.env"] [unique_id "abzBEbSX41OerVEVbxVQXQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 02:45:22
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 22:45:16.460956 2026] [security2:error] [pid 22127:tid 22127] [client 104.23.187.2:13474] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.jessicalevant.com"] [uri "/.env.test"] [unique_id "aby0vPguZR2mn69-zDUVVQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 01:43:15
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 21:42:45.659970 2026] [security2:error] [pid 5607:tid 5607] [client 104.23.187.2:11031] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.wiknwax.com"] [uri "/.env.backup"] [unique_id "abymFdWnRWEF0Y87gatSFQAAACw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 10:37:25
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 06:37:19.409280 2026] [security2:error] [pid 11755:tid 11755] [client 104.23.187.2:11859] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dropzllc.directnic-support.rocks"] [uri "/.env.prod"] [unique_id "abvR35C26HYrth1SwZGpZgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack