🇨🇭
zynex
2026-10-24 12:13:04
(2 hours ago)
URL Probing: /index.php
Web App Attack
🇩🇪
MarkGGN
2026-10-23 02:51:23
(1 day ago)
Web attack. 104.23.239.53 - - [23/Oct/2026:04:51:23 +0200] "GET /admin/ HTTP/2.0" 404 88 "-" "Mozill ...
show more
Web attack. 104.23.239.53 - - [23/Oct/2026:04:51:23 +0200] "GET /admin/ HTTP/2.0" 404 88 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15" 104.23.239.53 - - [23/Oct/2026:04:51:23 +0200] "GET /[HOST] HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15"
show less
Web App Attack
🇫🇷
dynamix
2026-10-22 17:11:45
(1 day ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 11:24:37
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:24:30.720828 2026] [security2:error] [pid 20310:tid 20310] [client 104.23.239.53:13954] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sarahingber.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sarahingber.com"] [uri "/rezerv.sql"] [unique_id "atSsbvzlLO5nD3UBXQ-9zgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 11:05:54
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:05:46.774210 2026] [security2:error] [pid 18997:tid 18997] [client 104.23.239.53:13771] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kendylcelina.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kendylcelina.com"] [uri "/config.php.bak"] [unique_id "atSoCgb4aQ2ABH3XXhCdFgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 06:32:08
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:32:04.291118 2026] [security2:error] [pid 14923:tid 14923] [client 104.23.239.53:11488] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mymclife.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mymclife.com"] [uri "/rezerv.sql"] [unique_id "atRn5LY-clINU18ory5-6AAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 03:26:35
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:26:28.412262 2026] [security2:error] [pid 1653:tid 1688] [client 104.23.239.53:13148] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.gotlib.net|F|2"] [data ".net.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.gotlib.net"] [uri "/gotlib.net.sql"] [unique_id "atQ8ZHLdqkm3gHxbZHkpyQAAAIQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-18 03:19:54
(6 days ago)
[18/Oct/2026:06:19:53 +0300] -- 104.23.239.53 Ban reason: Scanner [CMS_GENERIC] | Request: GET /wp-c ...
show more
[18/Oct/2026:06:19:53 +0300] -- 104.23.239.53 Ban reason: Scanner [CMS_GENERIC] | Request: GET /wp-content/plugins/bricksforge/readme.txt HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:17:07
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:17:00.614305 2026] [security2:error] [pid 7386:tid 7386] [client 104.23.239.53:11396] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.doubleandup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.doubleandup.com"] [uri "/rezerv.sql"] [unique_id "atQsHP7MGbRv12NeXv11lgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 01:47:39
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 21:47:31.586275 2026] [security2:error] [pid 20118:tid 20118] [client 104.23.239.53:9889] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||plazacristal.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "plazacristal.com"] [uri "/admin/config.php.bak"] [unique_id "atQlM5HeyeVsY5OLSnPiqgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:10:30
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:10:19.907442 2026] [security2:error] [pid 25937:tid 25937] [client 104.23.239.53:10789] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||title45.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "title45.com"] [uri "/db.sql"] [unique_id "atQAW3VggEfeuI0sS-D4ZQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
ALPHANET
2026-10-17 01:39:00
(1 week ago)
web exploits
Hacking
Exploited Host
Web App Attack
🇫🇷
vtchost.com
2026-10-16 20:40:38
(1 week ago)
forbidden http request, scanning for weaknesses
...
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 08:43:52
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 04:43:47.942733 2026] [security2:error] [pid 18736:tid 18736] [client 104.23.239.53:10419] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.khaoula.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.khaoula.com"] [uri "/khaoula.sql"] [unique_id "as9Aw1G-Zer2J_TcjT5LHQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 03:52:22
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.53 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:52:18.553380 2026] [security2:error] [pid 13424:tid 13424] [client 104.23.239.53:12623] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||copiersraleigh.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "copiersraleigh.com"] [uri "/config.php.bak"] [unique_id "as78cuekVlKH2ibk7OgBCAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
