🇺🇸
TPI-Abuse
2026-10-18 15:00:55
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 11:00:50.528584 2026] [security2:error] [pid 2573:tid 2585] [client 104.23.239.47:11675] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aafm.us|F|2"] [data ".us.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aafm.us"] [uri "/aafm.us.sql"] [unique_id "atTfIl2JcHPpD5sFXSgqdwAAAMo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 14:31:28
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:31:22.740910 2026] [security2:error] [pid 25776:tid 25776] [client 104.23.239.47:9417] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||argun.wine|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "argun.wine"] [uri "/backup.sql"] [unique_id "atTYOsKRsSPVROHav1TJOAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 13:30:42
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 09:30:34.940247 2026] [security2:error] [pid 17064:tid 17064] [client 104.23.239.47:11780] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||reyadecostarica.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "reyadecostarica.com"] [uri "/admin/config.php.bak"] [unique_id "atTJ-k77-jdHw9FG1_y5nAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-10-18 12:30:46
(1 day ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. ...
show more
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
show less
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-18 11:48:32
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:48:26.028630 2026] [security2:error] [pid 2478:tid 2478] [client 104.23.239.47:9806] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||15cherryavenue.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "15cherryavenue.com"] [uri "/db.sql"] [unique_id "atSyCvbU0pfavtP7_DuKigAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-18 10:31:59
(1 day ago)
[18/Oct/2026:13:31:59 +0300] -- 104.23.239.47 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET / ...
show more
[18/Oct/2026:13:31:59 +0300] -- 104.23.239.47 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /db.zip HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇩🇪
iNetWorker
2026-10-18 04:03:01
(1 day ago)
trolling for resource vulnerabilities
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 03:24:06
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:23:59.217551 2026] [security2:error] [pid 490:tid 490] [client 104.23.239.47:13580] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||register-yacht-panama.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "register-yacht-panama.com"] [uri "/database.sql"] [unique_id "atQ7z8ZD7PLAyXLwWZVE1QAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:06:14
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:06:05.796929 2026] [security2:error] [pid 28886:tid 28886] [client 104.23.239.47:11957] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||title39.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "title39.com"] [uri "/config.php.bak"] [unique_id "atPVLbYzeWiYe0TAyPfImgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇴
jad-abuse
2026-10-17 01:22:24
(2 days ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: wp_admin. ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: wp_admin. Observed by 1 sensor(s); 2 hits.
show less
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-10-15 18:48:29
(4 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 07:01:24
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.47 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 03:01:20.263063 2026] [security2:error] [pid 19962:tid 20031] [client 104.23.239.47:9342] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||hotairwelder.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "hotairwelder.com"] [uri "/rezerv.sql"] [unique_id "as8owFvi89bY3XD6QoZbpgAAAgo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-01 11:25:48
(2 weeks ago)
Web App Attack
🇧🇪
madeit
2026-09-03 06:41:23
(1 month ago)
Web App Attack
🇧🇪
madeit
2026-08-05 14:42:18
(2 months ago)
Web App Attack
