🇨🇭
TheCoon
2026-10-21 06:37:45
(1 day ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
ALPHANET
2026-10-21 03:58:40
(1 day ago)
web exploits
Hacking
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 10:58:33
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 06:58:29.172775 2026] [security2:error] [pid 22223:tid 22223] [client 104.23.239.42:12898] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitality-web.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitality-web.com"] [uri "/vitality-web.com.sql"] [unique_id "atSmVT9pgpW0RLmtWS-ODwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 10:36:15
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 06:36:10.048474 2026] [security2:error] [pid 11642:tid 11657] [client 104.23.239.42:11709] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||pizzadlux.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pizzadlux.com"] [uri "/db.sql"] [unique_id "atShGpq8ppphJymAHktZIQAAAEU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 06:30:06
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:29:55.901859 2026] [security2:error] [pid 26184:tid 26184] [client 104.23.239.42:12810] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bookguardian.net|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bookguardian.net"] [uri "/config.php.bak"] [unique_id "atRnYwH-55WwfnDuKKm-UgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-18 04:39:25
(4 days ago)
[18/Oct/2026:07:39:25 +0300] -- 104.23.239.42 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET / ...
show more
[18/Oct/2026:07:39:25 +0300] -- 104.23.239.42 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /public_html.zip HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 04:14:32
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 00:14:22.827556 2026] [security2:error] [pid 13977:tid 13977] [client 104.23.239.42:10652] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||idonthaveawebpage.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "idonthaveawebpage.com"] [uri "/db.sql"] [unique_id "atRHnk1XJWV1wzH2OuD7ugAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 00:34:51
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:34:41.633145 2026] [security2:error] [pid 26573:tid 26573] [client 104.23.239.42:11051] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||sternscape.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sternscape.com"] [uri "/config.php.bak"] [unique_id "atQUIabmGLWb5hcnlj0E9wAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:52:11
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:51:55.790344 2026] [security2:error] [pid 9879:tid 9879] [client 104.23.239.42:14008] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitess.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitess.com"] [uri "/db.sql"] [unique_id "atQKG-ZQcNWc_vXfZBsXAgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 22:48:25
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:48:21.948964 2026] [security2:error] [pid 31041:tid 31041] [client 104.23.239.42:10284] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.magnoliahillproductions.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.magnoliahillproductions.com"] [uri "/db.sql"] [unique_id "atP7NdMMnP2rNgZpVKa9oAAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
bescared
2026-10-17 22:03:13
(5 days ago)
F2B - Malicious activity detected. URL Probing. -8ff06ede-
Hacking
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-17 00:13:54
(5 days ago)
Multiple WAF Violations
Web App Attack
🇩🇪
iNetWorker
2026-10-15 01:14:10
(1 week ago)
trolling for resource vulnerabilities
Web App Attack
🇧🇬
Stoyko Stoykov
2026-10-14 21:29:27
(1 week ago)
104.23.239.42 - - [15/Oct/2026:00:29:20 +0300] "GET /backend/web/phpinfo.php HTTP/1.1" 301 162 "http ...
show more
104.23.239.42 - - [15/Oct/2026:00:29:20 +0300] "GET /backend/web/phpinfo.php HTTP/1.1" 301 162 "http://bitwarden.it-systems.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0"
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 06:38:24
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.42 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 02:38:18.617747 2026] [security2:error] [pid 8602:tid 8602] [client 104.23.239.42:13527] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cmcnyc.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cmcnyc.com"] [uri "/db.sql"] [unique_id "as8jWpeAN_bMY_Pq2C46xwAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack