🇩🇪
langenkamp-media
2026-10-18 17:16:01
(6 minutes ago)
Fail2Ban: Banned from jail nginx-nohome on 3dausdu.de
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 15:00:55
(2 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.46 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.46 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 11:00:50.528584 2026] [security2:error] [pid 2573:tid 2579] [client 104.23.239.46:13132] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aafm.us|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aafm.us"] [uri "/aafm.sql"] [unique_id "atTfIl2JcHPpD5sFXSgqdgAAAMQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 13:30:42
(3 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.46 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.46 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 09:30:34.930135 2026] [security2:error] [pid 13687:tid 13687] [client 104.23.239.46:10396] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||reyadecostarica.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "reyadecostarica.com"] [uri "/database.sql"] [unique_id "atTJ-g9FAUv3U-55d54rxgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 11:48:31
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.46 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.46 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:48:26.028633 2026] [security2:error] [pid 20819:tid 20819] [client 104.23.239.46:10056] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||15cherryavenue.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "15cherryavenue.com"] [uri "/rezerv.sql"] [unique_id "atSyCixcI3N_3KbsAflsqQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
Erpelstolz
2026-10-18 09:20:55
(8 hours ago)
external host: 104.23.239.46 - - [18/Oct/2026:11:20:52 +0200] "GET /wp-admin/install.php?step=1 HTTP ...
show more
external host: 104.23.239.46 - - [18/Oct/2026:11:20:52 +0200] "GET /wp-admin/install.php?step=1 HTTP/1.1" 404 6217 "-" "http://erpelstolz.com/wp-admin/install.php?step=1" CF-Ray:a4c67838fc86b905-FRA CF-IP:-
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 07:37:35
(9 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.46 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.46 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 03:37:30.375241 2026] [security2:error] [pid 25970:tid 25970] [client 104.23.239.46:12453] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tanandteh.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tanandteh.com"] [uri "/db.sql"] [unique_id "atR3Og1E3w3Sc6ZU2dDdvAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-18 00:53:19
(16 hours ago)
[18/Oct/2026:03:53:18 +0300] -- 104.23.239.46 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET / ...
show more
[18/Oct/2026:03:53:18 +0300] -- 104.23.239.46 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /ampr.ust.edu.ua.zip HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:06:16
(21 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.46 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.46 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:06:05.794352 2026] [security2:error] [pid 28883:tid 28883] [client 104.23.239.46:11773] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||title39.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "title39.com"] [uri "/admin/config.php.bak"] [unique_id "atPVLRThikokHKMXtREATAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-10-17 18:30:40
(22 hours ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. ...
show more
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
show less
Web App Attack
Bad Web Bot
🇫🇷
dynamix
2026-10-15 18:48:28
(2 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 07:01:25
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.46 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.46 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 03:01:20.262835 2026] [security2:error] [pid 19893:tid 19918] [client 104.23.239.46:12495] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||hotairwelder.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "hotairwelder.com"] [uri "/admin/config.php.bak"] [unique_id "as8owM6AbAtmUo8vhljJnwAAAJU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-02 10:12:10
(2 weeks ago)
Web App Attack
🇧🇪
madeit
2026-09-15 17:26:00
(1 month ago)
Web App Attack
🇧🇪
madeit
2026-08-20 04:56:59
(1 month ago)
Web App Attack
🇧🇪
madeit
2026-08-05 12:56:16
(2 months ago)
Web App Attack
