🇫🇷
geot
2026-10-18 20:01:41
(1 day ago)
GET /database.sql HTTP/1.1
Hacking
Web App Attack
🇮🇹
sentinel1
2026-10-18 08:45:11
(1 day ago)
Sentinel: [Credential scan] status=200 [GET] analytics.nexus-orbital.com/.git/HEAD -> 200
Web App Attack
🇷🇸
Smel
2026-10-18 05:52:11
(2 days ago)
HTTP/80/443/8080 Unauthorized Probe, Hack -
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 05:42:55
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 01:42:42.944323 2026] [security2:error] [pid 4819:tid 4819] [client 104.23.221.139:10426] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tekbit.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tekbit.com"] [uri "/admin/config.php.bak"] [unique_id "atRcUhsqq59BT3wLfezaVgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
DrLex0
2026-10-18 05:37:03
(2 days ago)
Probing for various exploits, distributed attack from CloudFlare reverse proxy crap 💩 which is conve ...
show more
Probing for various exploits, distributed attack from CloudFlare reverse proxy crap 💩 which is conveniently whitelisted by AbuseIPDB.
104.23.221.139 443 - [18/Oct/2026:05:37:03 +0000] "GET /rezerv.sql HTTP/1.1" 404 6669 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0"
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 05:22:36
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 01:22:28.831408 2026] [security2:error] [pid 23816:tid 23816] [client 104.23.221.139:10070] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||eatcakecup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "eatcakecup.com"] [uri "/rezerv.sql"] [unique_id "atRXlOqqeTO0bGA04ZWePAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 03:47:03
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:46:55.786898 2026] [security2:error] [pid 19937:tid 19937] [client 104.23.221.139:14018] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||jcrluthier.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jcrluthier.com"] [uri "/config.php.bak"] [unique_id "atRBL04OWyHHfkrI-4u8qwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Lino Project
2026-10-18 03:08:42
(2 days ago)
104.23.221.139 - - [18/Oct/2026:05:08:42 +0200] "GET /.git/HEAD HTTP/2.0" 404 275 "-" "Mozilla/5.0 ( ...
show more
104.23.221.139 - - [18/Oct/2026:05:08:42 +0200] "GET /.git/HEAD HTTP/2.0" 404 275 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 03:00:45
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:00:27.355953 2026] [security2:error] [pid 7380:tid 7380] [client 104.23.221.139:11247] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||title13.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "title13.com"] [uri "/title13.com.sql"] [unique_id "atQ2S6z7DRt8Kesisu2RGwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:36:13
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:36:06.384105 2026] [security2:error] [pid 10470:tid 10470] [client 104.23.221.139:13677] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.notariacoelemu.cl|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.notariacoelemu.cl"] [uri "/backup.sql"] [unique_id "atQwlr5sSUsBko6w_dAkrQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:20:41
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:20:33.544316 2026] [security2:error] [pid 20260:tid 20260] [client 104.23.221.139:11492] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||acmyles.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "acmyles.com"] [uri "/config.php.bak"] [unique_id "atQs8RHiLUHL4lSWjNaAdQAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 01:52:15
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 21:52:05.875540 2026] [security2:error] [pid 11554:tid 11554] [client 104.23.221.139:9640] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tmarketingproducts.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tmarketingproducts.com"] [uri "/rezerv.sql"] [unique_id "atQmRd4DxgHmZHsEPhtBmwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-18 01:05:50
(2 days ago)
[18/Oct/2026:04:05:50 +0300] -- 104.23.221.139 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[18/Oct/2026:04:05:50 +0300] -- 104.23.221.139 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /db.zip HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 00:44:50
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:44:44.728477 2026] [security2:error] [pid 9140:tid 9140] [client 104.23.221.139:12668] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||citygateinc.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "citygateinc.com"] [uri "/rezerv.sql"] [unique_id "atQWfDZg0xfxUek3JPJ23wAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 22:47:50
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:47:41.794487 2026] [security2:error] [pid 16727:tid 16787] [client 104.23.221.139:11160] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.condo.management|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.condo.management"] [uri "/database.sql"] [unique_id "atP7DWgHbOxxwd3pq8Hq4AAAAZg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
