🇬🇧
OptimusGO
2026-06-28 16:04:57
(1 week ago)
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Time ...
show more
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Timestamp: 2026-06-28 17:04:57 UTC
Log evidence:
104.23.209.236 - - [28/Jun/2026:17:04:56 +0100] "GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1" 404 118 "-" "curl/8.7.1"
104.23.209.236 - - [28/Jun/2026:17:04:57 +0100] "GET /wp-json/gravitysmtp/v1/tests/mock-data?page=gravitysmtp-settings HTTP/1.1" 404 118 "-" "curl/8.7.1"
06/28/2026-17:04:57.020615 [**] [1:1000201:1] SCANNER: Bot-like User-Agent Detected [**] [Classification: Attempted Information Leak] [Priority: 2] {TCP} 104.23.209.236:10166 -> 185.127.18.66:80
show less
Port Scan
Brute-Force
🇺🇸
TPI-Abuse
2026-06-21 06:47:32
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.23.209.236 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.209.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 02:47:20.083455 2026] [security2:error] [pid 13893:tid 13893] [client 104.23.209.236:24214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.fydelityco.com.fydelity.net"] [uri "/.env.old"] [unique_id "ajeI-ATg-5x4t-EFTfVwSAAAABA"], referer: https://www.google.com/search?q=www.fydelityco.com.fydelity.net
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 20:02:13
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.23.209.236 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.209.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 16:02:06.283045 2026] [security2:error] [pid 10628:tid 10628] [client 104.23.209.236:22871] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cincinnati.deubellzebub.com"] [uri "/.git/config"] [unique_id "aicfvpzi2gt6MYq5og7juQAAADk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 19:36:46
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.23.209.236 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.209.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 15:36:42.460733 2026] [security2:error] [pid 5556:tid 5556] [client 104.23.209.236:22246] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.davisllp.com"] [uri "/.git/config"] [unique_id "aicZyspLmMl5mOBsnhW37AAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-25 22:02:02
(1 month ago)
Auto-ban: >3000 req/min op 2026-05-25
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-05-15 08:49:23
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 104.23.209.236 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.209.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:49:08.243166 2026] [security2:error] [pid 13411:tid 13431] [client 104.23.209.236:10475] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cynosureendeavor.cynosureinternetservices.com"] [uri "/.env.vercel"] [unique_id "agbeBEUEM4JlpjNBSoLrQgAAABE"], referer: https://www.google.com/search?q=www.cynosureendeavor.cynosureinternetservices.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 05:24:50
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 104.23.209.236 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.209.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 01:24:40.730210 2026] [security2:error] [pid 17943:tid 17943] [client 104.23.209.236:9569] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.blockdredge.com"] [uri "/.env.save"] [unique_id "agauGCYGEi8tPbxFCt5srAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-14 22:05:48
(1 month ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-13.
show less
Web App Attack
SSH
Hacking
🇺🇸
wimaxnz
2026-05-02 23:59:49
(2 months ago)
Automated report from 247 Guardian: repeated malicious activity detected. | reason=nginx_badpath
Brute-Force
SSH
Port Scan
🇺🇸
wimaxnz
2026-04-30 03:38:31
(2 months ago)
Automated report from 247 Guardian: repeated malicious activity detected. | reason=nginx_badpath
Brute-Force
SSH
Port Scan
🇺🇸
mnsf
2026-04-09 02:05:19
(2 months ago)
Scanning/Probing (12)
Brute-Force
Web App Attack
🇺🇸
wimaxnz
2026-04-08 01:21:46
(2 months ago)
Automated report from 247 Guardian: repeated malicious activity detected. | reason=nginx_badpath
Brute-Force
SSH
Port Scan
🇺🇸
mnsf
2026-04-08 01:05:18
(2 months ago)
Scanning/Probing (14)
Brute-Force
Web App Attack
🇺🇸
mnsf
2026-04-03 06:05:45
(3 months ago)
Scanning/Probing (14)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-22 00:55:44
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.209.236 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.209.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 20:55:39.327883 2026] [security2:error] [pid 2723:tid 2723] [client 104.23.209.236:12815] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.grannyswash.kunzteam.com"] [uri "/docker/.env.local"] [unique_id "ab8-C7cuvIoQSk3NLo80YwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack