🇮🇩
securejdprop
2026-08-24 23:07:22
(8 hours ago)
This IP was detected by CrowdSec triggering custom/vpatch-bad-cloudflare.
Hacking
🇩🇪
Ha1fdan
2026-08-21 20:58:28
(3 days ago)
{"level":"info","ts":1787345891.4618795,"logger":"http.log.access","msg":"handled request","request" ...
show more
{"level":"info","ts":1787345891.4618795,"logger":"http.log.access","msg":"handled request","request":{"remote_ip":"104.23.187.207","remote_port":"13861","client_ip":"104.23.187.207","proto":"HTTP/2.0","method":"GET","host":"gre1.vserver.dk","uri":"/login.action","headers":{"Cf-Ray":["a2ec8deacc876e2f-EWR"],"Cf-Ipcountry":["US"],"X-Forwarded-For":["157.245.113.227"],"User-Agent":["Mozilla/5.0 (l9scan/2.0.236313e26343e21323e2430313; +https://leakix.net)"],"Cf-Connecting-Ip":["157.245.113.227"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"X-Forwarded-Proto":["https"],"Accept-Encoding":["gzip, br"],"Cdn-Loop":["cloudflare; loops=1"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"gre1.vserver.dk","ech":false}},"bytes_read":0,"user_id":"","duration":0.000077949,"size":13,"status":404,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Content-Type":["text/plain; charset=utf-8"]}}
{"level":"info","ts":1787345892.849545,"logger":"http.lo
...
show less
Brute-Force
Web App Attack
🇺🇸
almazick
2026-08-20 00:57:25
(5 days ago)
Fail2Ban jail window on srv1.windowrepair.us banned 104.23.187.207 after 1 attempts
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-08-19 18:43:20
(5 days ago)
Web App Attack
🇧🇪
madeit
2026-08-06 04:17:57
(2 weeks ago)
Web App Attack
🇳🇱
wolfemium
2026-06-20 05:11:32
(2 months ago)
104.23.187.207 - - [20/Jun/2026:08:10:55 +0300] "GET /green1.php HTTP/1.1" 502 150 "-" "-"
104.23.18 ...
show more
104.23.187.207 - - [20/Jun/2026:08:10:55 +0300] "GET /green1.php HTTP/1.1" 502 150 "-" "-"
104.23.187.207 - - [20/Jun/2026:08:10:55 +0300] "GET /xb.php HTTP/1.1" 502 150 "-" "-"
104.23.187.207 - - [20/Jun/2026:08:10:56 +0300] "GET /ultradybbuks.php HTTP/1.1" 502 150 "-" "-"
104.23.187.207 - - [20/Jun/2026:08:10:56 +0300] "GET /mosty.php HTTP/1.1" 502 150 "-" "-"
104.23.187.207 - - [20/Jun/2026:08:11:31 +0300] "GET /wander.php HTTP/1.1" 502 150 "-" "-"
104.23.187.207 - - [20/Jun/2026:08:11:31 +0300] "GET /ha.php HTTP/1.1" 502 150 "-" "-"
...
show less
DDoS Attack
2026-04-04 12:19:25
(4 months ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇺🇸
LotPhantom
2026-03-31 08:54:37
(4 months ago)
104.23.187.207 - - [31/Mar/2026:08:53:36 +0000] "GET / HTTP/2.0" 200 5199 "-" "Go-http-client/1.1" " ...
show more
104.23.187.207 - - [31/Mar/2026:08:53:36 +0000] "GET / HTTP/2.0" 200 5199 "-" "Go-http-client/1.1" "0"
...
show less
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-03-29 22:09:21
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.207 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.207 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 18:09:08.886454 2026] [security2:error] [pid 1270:tid 1270] [client 104.23.187.207:12029] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bespoke-ss.com"] [uri "/.env.json"] [unique_id "acmjBIVoRzSEfAsNv00gPwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 00:58:35
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.207 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.207 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 20:58:27.443747 2026] [security2:error] [pid 10552:tid 10552] [client 104.23.187.207:13391] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "time.ggisoft.com"] [uri "/.env.local"] [unique_id "ab3tMyH2QqpimAXHEXA1ywAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 08:42:18
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.207 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.207 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 04:42:12.093829 2026] [security2:error] [pid 5176:tid 5176] [client 104.23.187.207:9268] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.homeswithhorton.garretthillary.com"] [uri "/docker/.env"] [unique_id "ab0IZLLv21USFpPZyW6-4gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 07:33:04
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.207 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.207 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 03:32:59.249894 2026] [security2:error] [pid 30611:tid 30611] [client 104.23.187.207:13605] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.ichi51e.net"] [uri "/.git/refs/heads/main"] [unique_id "abz4K7DFU67Kz_mFxiRydgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 06:28:56
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.207 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.207 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 02:28:50.655202 2026] [security2:error] [pid 22838:tid 22838] [client 104.23.187.207:11871] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.allynrealty.com"] [uri "/.env.prod"] [unique_id "abzpIozXHFD37X76HUNFqAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 01:48:37
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.207 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.207 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 21:48:24.346884 2026] [security2:error] [pid 23141:tid 23167] [client 104.23.187.207:9315] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.arthansl.com"] [uri "/.env.dist"] [unique_id "abynaKZS8i2WYfKhKjLNsgAAAJc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 01:22:29
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.207 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.207 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 21:22:21.592369 2026] [security2:error] [pid 2297:tid 2297] [client 104.23.187.207:10875] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.fortwaynepartybuses.com"] [uri "/.env.orig"] [unique_id "abyhTYIaJ7twptp7rnYGVgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack