🇩🇪
todix
2026-10-21 22:14:28
(5 hours ago)
"GET /.git/config HTTP/2.0" 403 191 "-" "curl/8.4.0"
Web App Attack
🇫🇷
dynamix
2026-10-20 19:38:57
(1 day ago)
Multiple WAF Violations
Web App Attack
🇩🇪
updown.io
2026-10-18 19:39:34
(3 days ago)
{"level":"info","ts":1792350375.5450437,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1792350375.5450437,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"104.23.239.111","remote_port":"12530","client_ip":"104.23.239.111","proto":"HTTP/1.1","method":"GET","host":"status.gonitzoggo.com","uri":"/server.key","headers":{"Cf-Connecting-Ip":["34.187.25.73"],"Referer":["https://status.gonitzoggo.com/server.key"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Forwarded-For":["34.187.25.73"],"Connection":["Keep-Alive"],"Accept-Encoding":["gzip, br"],"Cf-Ipcountry":["NL"],"User-Agent":["Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"],"Cdn-Loop":["cloudflare; loops=1"],"X-Nextjs-Data":["1"],"Accept":["*/*"],"X-Forwarded-Proto":["https"],"Cf
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 14:51:03
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.111 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:51:00.117366 2026] [security2:error] [pid 12711:tid 12711] [client 104.23.239.111:10271] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.abeltours.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.abeltours.com"] [uri "/db.sql"] [unique_id "atTc1FconSFVVMoI7dv5PgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 13:10:47
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.111 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 09:10:39.500801 2026] [security2:error] [pid 19385:tid 19385] [client 104.23.239.111:10082] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||j3ee.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "j3ee.com"] [uri "/db.sql"] [unique_id "atTFT-qgzfOLlr-GqAzK_gAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-10-18 12:30:50
(3 days ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. ...
show more
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
show less
Web App Attack
Bad Web Bot
🇺🇦
URAN Publishing Service
2026-10-18 10:42:02
(3 days ago)
[18/Oct/2026:13:42:01 +0300] -- 104.23.239.111 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[18/Oct/2026:13:42:01 +0300] -- 104.23.239.111 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /org.tar.gz HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇬🇧
ISPLtd
2026-10-18 09:28:21
(3 days ago)
104.23.239.111 - - [18/Oct/2026:06:28:20 -0300] "GET /wp-PII/install.php?step=1
104.23.239.111 - - [ ...
show more
104.23.239.111 - - [18/Oct/2026:06:28:20 -0300] "GET /wp-PII/install.php?step=1
104.23.239.111 - - [18/Oct/2026:06:28:20 -0300] "GET /wp-PII/install.php?step=1
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 03:18:55
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.111 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:18:47.436234 2026] [security2:error] [pid 10153:tid 10163] [client 104.23.239.111:13425] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||apada.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "apada.com"] [uri "/db.sql"] [unique_id "atQ6lwRgOXQwTgFWwxsh-QAAAEU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 22:16:26
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.111 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:16:18.780512 2026] [security2:error] [pid 8414:tid 8414] [client 104.23.239.111:11200] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||turnedthepagemusic.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "turnedthepagemusic.com"] [uri "/turnedthepagemusic.sql"] [unique_id "atPzsux7a3CRHuXlflEOYQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-01 11:16:22
(2 weeks ago)
Web App Attack
🇧🇪
madeit
2026-09-03 06:41:58
(1 month ago)
Web App Attack
🇧🇪
madeit
2026-08-06 14:56:18
(2 months ago)
Web App Attack
🇺🇸
MPL
2026-07-30 07:15:51
(2 months ago)
tcp/443 (5 or more attempts)
Port Scan
🇩🇪
acadeova
2026-07-29 18:30:25
(2 months ago)
🚨 Recon detected (nft drop)
SRC=104.23.239.111
Observed=TCP dpt=80 in=enp0s6 ttl=59
Time=recent(jour ...
show more
🚨 Recon detected (nft drop)
SRC=104.23.239.111
Observed=TCP dpt=80 in=enp0s6 ttl=59
Time=recent(journalctl: 10 minutes ago)
Assessment=Generic scanning / reconnaissance (PORT_SCAN)
show less
Port Scan
