🇧🇪
madeit
2026-10-06 15:40:09
(14 hours ago)
Web App Attack
🇵🇰
sbk97 (https://sayor.net)
2026-10-04 07:42:32
(2 days ago)
SAYOR honeypot: observed attack /wp-content/themes/travel/issue.php
Brute-Force
🇧🇪
madeit
2026-09-26 00:38:43
(1 week ago)
Web App Attack
🇧🇪
madeit
2026-09-09 12:17:57
(3 weeks ago)
Web App Attack
🇧🇪
madeit
2026-08-20 05:14:13
(1 month ago)
Web App Attack
🇧🇪
madeit
2026-08-06 02:10:23
(2 months ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-04-17 16:12:00
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 17 12:11:52.034018 2026] [security2:error] [pid 2015691:tid 2015691] [client 104.23.187.211:13068] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "onlineteacher.info"] [uri "/.env.dev"] [unique_id "aeJbyJujlWy3AztJUqc9sAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
acadeova
2026-04-10 12:41:17
(5 months ago)
🚨 Recon detected (nft drop)
SRC=104.23.187.211
Observed=TCP dpt=80 in=enp0s6 ttl=57
Time=recent(jour ...
show more
🚨 Recon detected (nft drop)
SRC=104.23.187.211
Observed=TCP dpt=80 in=enp0s6 ttl=57
Time=recent(journalctl: 10 minutes ago)
Assessment=Generic scanning / reconnaissance (PORT_SCAN)
show less
Port Scan
🇺🇸
TPI-Abuse
2026-03-22 07:22:00
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 03:21:53.649041 2026] [security2:error] [pid 4885:tid 4907] [client 104.23.187.211:12553] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.saemed.com"] [uri "/.env.local.backup"] [unique_id "ab-YkYX1C7aDJFRH88qgEgAAANM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 05:25:35
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 01:25:28.761179 2026] [security2:error] [pid 29103:tid 29103] [client 104.23.187.211:13911] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "xyncom.com"] [uri "/.env_secret"] [unique_id "ab4ryKejHBOxvrPsoLy0qQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 02:09:05
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 22:08:57.548021 2026] [security2:error] [pid 24420:tid 24420] [client 104.23.187.211:12347] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cursoastrologia.verdadesreales.com"] [uri "/.env.production"] [unique_id "ab39uatTC9JlpyLBS_dOMQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 09:13:34
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 05:13:28.445386 2026] [security2:error] [pid 7986:tid 7986] [client 104.23.187.211:10871] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.emailautomationworkflow.com"] [uri "/.env_secret"] [unique_id "ab0PuLHJLkSScOw58eygqQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 08:02:38
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 04:02:30.906135 2026] [security2:error] [pid 11194:tid 11194] [client 104.23.187.211:10375] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.forestvalleyfarm.com"] [uri "/server/.env"] [unique_id "abz_FpFZuz_RFPH6R2JXGgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 06:41:44
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 02:41:35.731042 2026] [security2:error] [pid 19358:tid 19358] [client 104.23.187.211:11480] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.dianadelapava.com"] [uri "/.env.local.backup"] [unique_id "abzsHwi9UiTPnDqL-5SuOAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 05:00:30
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.187.211 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 01:00:20.456896 2026] [security2:error] [pid 2348:tid 2348] [client 104.23.187.211:11051] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.wmodradio.com"] [uri "/.env.backup"] [unique_id "abzUZL4PGQVxCG6WTtbBnQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
