2026-06-06 13:29:38
(14 hours ago)
Aggressive web scan
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 11:40:17
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.23.209.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.209.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 07:40:11.616528 2026] [security2:error] [pid 19401:tid 19401] [client 104.23.209.94:13545] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jeffjastro.com.jeffj.net"] [uri "/.env.dev"] [unique_id "agcGG8757RepWZM3px8-OAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 11:07:47
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 104.23.209.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.209.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 07:06:05.999482 2026] [security2:error] [pid 31935:tid 31935] [client 104.23.209.94:11040] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.boat-registration-croatia.com.boatregistrationdelaware.com|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.boat-registration-croatia.com.boatregistrationdelaware.com"] [uri "/terraform.tfstate.backup"] [unique_id "agb-HdjtHRm_EFjgGxEA2QAAAEI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 07:46:49
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.23.209.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.209.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 03:46:28.005168 2026] [security2:error] [pid 8601:tid 8601] [client 104.23.209.94:10880] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.download.yogitunes.com"] [uri "/.env.development"] [unique_id "agbPVH6P-xzoo0Fnjr6FxAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-14 22:05:18
(3 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-13.
show less
Web App Attack
SSH
Hacking
🇩🇪
acadeova
2026-04-16 13:05:56
(1 month ago)
🚨 Recon detected (nft drop)
SRC=104.23.209.94
Observed=TCP dpt=80 in=enp0s6 ttl=56
Time=recent(journ ...
show more
🚨 Recon detected (nft drop)
SRC=104.23.209.94
Observed=TCP dpt=80 in=enp0s6 ttl=56
Time=recent(journalctl: 10 minutes ago)
Assessment=Generic scanning / reconnaissance (PORT_SCAN)
show less
Port Scan
🇺🇸
mnsf
2026-04-07 08:05:27
(1 month ago)
Scanning/Probing (18)
Brute-Force
Web App Attack
🇺🇸
mnsf
2026-04-04 22:05:42
(2 months ago)
Scanning/Probing (13)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-22 12:37:57
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.209.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.209.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 22 08:37:53.433546 2026] [security2:error] [pid 10854:tid 10854] [client 104.23.209.94:12557] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.natickvillagerentals.com"] [uri "/.env.orig"] [unique_id "ab_ioSTohYYDPIPND_5h5wAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 22:47:04
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.209.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.209.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 18:46:57.235848 2026] [security2:error] [pid 8444:tid 8455] [client 104.23.209.94:13864] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.topo.switchbl8.nl"] [uri "/.env.bak"] [unique_id "ab8f4cGiq-rnFgs6JG7FCQAAAIc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 04:04:24
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.209.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.209.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 00:04:17.923411 2026] [security2:error] [pid 26752:tid 26752] [client 104.23.209.94:12261] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.ikutabukkyokai.com"] [uri "/server/.env"] [unique_id "ab4YwaajD6DGtSmnGaPRFQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mawan
2026-03-06 01:29:54
(3 months ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
🇦🇺
oncord
2026-02-20 09:33:44
(3 months ago)
Form spam
Web Spam
🇲🇾
syokadmin
2025-11-25 16:02:49
(6 months ago)
104.23.209.94 (US/United States/-), more than 2 Apache 403 hits in the last 3600 secs
Brute-Force
🇲🇾
syokadmin
2025-11-21 12:01:38
(6 months ago)
104.23.209.94 (US/United States/-), more than 2 Apache 403 hits in the last 3600 secs
Brute-Force