🇨🇭
4server
2026-11-06 09:09:42
UTC ·
(2 days ago)
[FriNov0610:09:36.2185272026][security2:error][pid2183746:tid2183886][client104.23.239.58:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\"wp-config\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"710\"][id\" ...
show more
[FriNov0610:09:36.2185272026][security2:error][pid2183746:tid2183886][client104.23.239.58:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\"wp-config\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"710\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"rssolution.ch\"][uri\"/wp-config.php.bak\"][unique_id\"au2ZUNufusZhZ8cTCRuY6wAAAQc\"]
show less
Hacking
Web App Attack
🇫🇷
dynamix
2026-11-06 05:17:00
UTC ·
(2 days ago)
Multiple WAF Violations
Web App Attack
🇧🇪
madeit
2026-11-02 13:15:08
UTC ·
(6 days ago)
Web App Attack
🇫🇷
dynamix
2026-10-27 15:25:05
UTC ·
(1 week ago)
Multiple WAF Violations
Web App Attack
🇫🇷
dynamix
2026-10-24 08:45:46
UTC ·
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇺🇸
craudiovizai
2026-10-22 18:30:49
UTC ·
(2 weeks ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
Web App Attack
Bad Web Bot
🇩🇪
auridh
2026-10-21 13:01:57
UTC ·
(2 weeks ago)
WAF block: crowdsecurity/vpatch-git-config from 104.23.239.58 ([REDACTED])
Web App Attack
🇫🇷
dynamix
2026-10-20 17:28:01
UTC ·
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇫🇷
dynamix
2026-10-18 17:32:59
UTC ·
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 14:08:09
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:08:01.267745 2026] [security2:error] [pid 12817:tid 12841] [client 104.23.239.58:13397] M ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:08:01.267745 2026] [security2:error] [pid 12817:tid 12841] [client 104.23.239.58:13397] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ozworkshop.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ozworkshop.com"] [uri "/ozworkshop.com.sql"] [unique_id "atTSwZPz_lRJMjXXuUR8bgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 11:37:22
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:37:13.958496 2026] [security2:error] [pid 8607:tid 8745] [client 104.23.239.58:13874] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:37:13.958496 2026] [security2:error] [pid 8607:tid 8745] [client 104.23.239.58:13874] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.adprospb.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.adprospb.com"] [uri "/db.sql"] [unique_id "atSvaR1t7gFuC7SlQCmSaQAAAI8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
Valhalla
2026-10-18 08:11:48
UTC ·
(3 weeks ago)
/dump.sql
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 06:12:30
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:12:23.700753 2026] [security2:error] [pid 29582:tid 29582] [client 104.23.239.58:9922] Mo ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:12:23.700753 2026] [security2:error] [pid 29582:tid 29582] [client 104.23.239.58:9922] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||miz-art.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "miz-art.com"] [uri "/admin/config.php.bak"] [unique_id "atRjR9x9EALQP8DNO1Pt_AAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-17 21:24:37
UTC ·
(3 weeks ago)
[18/Oct/2026:00:24:34 +0300] -- 104.23.239.58 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /public_html.zip HTTP/1.1
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:59:08
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:59:03.440665 2026] [security2:error] [pid 10195:tid 10195] [client 104.23.239.58:14169] M ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:59:03.440665 2026] [security2:error] [pid 10195:tid 10195] [client 104.23.239.58:14169] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.mpservice.com.sv|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.mpservice.com.sv"] [uri "/admin/config.php.bak"] [unique_id "atPhl1gF7ZJ3dLKT2T59zQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
