🇬🇧
myintarweb
2026-10-18 04:05:48
(1 hour ago)
104.23.221.208 - - [18/Oct/2026:05:05:45 +0100] 80 "GET /madmick.co.uk.sql HTTP/1.1" 303 1665 "-" "M ...
show more
104.23.221.208 - - [18/Oct/2026:05:05:45 +0100] 80 "GET /madmick.co.uk.sql HTTP/1.1" 303 1665 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
...
show less
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 04:05:08
(1 hour ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 00:04:58.839881 2026] [security2:error] [pid 2561:tid 2561] [client 104.23.221.208:9746] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||drumez.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "drumez.com"] [uri "/backup.sql"] [unique_id "atRFamsIVkOn1n4scwAvgAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 03:45:42
(1 hour ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:45:35.401748 2026] [security2:error] [pid 22832:tid 22841] [client 104.23.221.208:12814] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||doorways.dk|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "doorways.dk"] [uri "/backup.sql"] [unique_id "atRA37UZkbvnX-NM3QO0ugAAAIc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 03:00:40
(2 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:00:28.638102 2026] [security2:error] [pid 10029:tid 10029] [client 104.23.221.208:9223] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||title13.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "title13.com"] [uri "/db.sql"] [unique_id "atQ2TFdY8xT1k3US3onfSwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:35:58
(2 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:35:44.110339 2026] [security2:error] [pid 25836:tid 25836] [client 104.23.221.208:11836] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ohanameetup.party|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ohanameetup.party"] [uri "/backup.sql"] [unique_id "atQwgGrwQTepv49l0Oq-2QAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mw
2026-10-18 01:55:01
(3 hours ago)
POST /wp-admin/admin-ajax.php HTTP/1.1
Web App Attack
2026-10-18 00:59:33
(4 hours ago)
Attempt to scan vulnerabilities
Hacking
🇺🇸
TPI-Abuse
2026-10-18 00:59:22
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:59:14.635256 2026] [security2:error] [pid 23528:tid 23528] [client 104.23.221.208:13916] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||garnersystems.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "garnersystems.com"] [uri "/db.sql"] [unique_id "atQZ4tehRxfCu04DCF4FyAAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 19:38:52
(9 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 15:38:44.642828 2026] [security2:error] [pid 1199:tid 1199] [client 104.23.221.208:11535] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kawkacevents.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kawkacevents.com"] [uri "/kawkacevents.com.sql"] [unique_id "atPOxOqJfUST_-_BDiamhwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-10-14 00:30:38
(4 days ago)
Automated honeypot detection. blocked ip against a Next.js application. Paths: /wp-admin/install.php ...
show more
Automated honeypot detection. blocked ip against a Next.js application. Paths: /wp-admin/install.php, /wp-admin/install.php?step=1. Blocked at the edge.
show less
Bad Web Bot
🇺🇸
craudiovizai
2026-10-13 12:30:39
(4 days ago)
Automated honeypot detection. blocked ip against a Next.js application. Paths: /wp-admin/install.php ...
show more
Automated honeypot detection. blocked ip against a Next.js application. Paths: /wp-admin/install.php?step=1. Blocked at the edge.
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-11 06:06:35
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 02:06:29.818471 2026] [security2:error] [pid 866:tid 866] [client 104.23.221.208:12968] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "scarletveil.org"] [uri "/.git/config"] [unique_id "assnZX-nX-U7SOQKUe6dkgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-09 22:09:22
(1 week ago)
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.23.221.208 - - [10/Oct/2026:00:09:03 +0200] "GET /.git/config HTTP/2.0" 301 364 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:127.0) Gecko/20100101 Firefox/127.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-09 18:55:13
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.221.208 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 09 14:55:06.247284 2026] [security2:error] [pid 24666:tid 24666] [client 104.23.221.208:12991] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "professionalpianomoversinc.com"] [uri "/.git/config"] [unique_id "ask4imCoDncnznRbrwBg_gAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-10-08 18:30:42
(1 week ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. ...
show more
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
show less
Web App Attack
Bad Web Bot
