🇨🇭
ALPHANET
2026-10-23 05:22:24
(16 hours ago)
web exploits
Hacking
Exploited Host
Web App Attack
🇨🇭
backslash
2026-10-23 04:21:00
(17 hours ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇫🇷
dynamix
2026-10-20 22:35:57
(2 days ago)
Multiple WAF Violations
Web App Attack
🇸🇬
securejdprop
2026-10-20 19:41:57
(3 days ago)
This IP was detected by CrowdSec triggering custom/vpatch-phpinstall.
Hacking
🇩🇪
brechtr
2026-10-19 07:54:48
(4 days ago)
[Press84-BanHammer] bad username — Sourced from: press84.com — Request: POST /wp-login.php
Brute-Force
🇸🇬
securejdprop
2026-10-18 13:54:19
(5 days ago)
This IP was detected by CrowdSec triggering custom/vpatch-phpinstall.
Hacking
🇺🇸
TPI-Abuse
2026-10-18 09:40:57
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.70 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 05:40:52.383232 2026] [security2:error] [pid 4591:tid 4633] [client 104.23.239.70:14232] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rbarw.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rbarw.com"] [uri "/dump.sql"] [unique_id "atSUJGtyqCPvIXSHz96uJgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 00:03:19
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.70 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:03:09.506789 2026] [security2:error] [pid 24806:tid 24806] [client 104.23.239.70:9324] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||globalpackets.net|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "globalpackets.net"] [uri "/config.php.bak"] [unique_id "atQMvRNvteAvOp0aOQRfQgAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:10:31
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.70 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:10:22.238860 2026] [security2:error] [pid 6875:tid 6875] [client 104.23.239.70:9708] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||title45.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "title45.com"] [uri "/admin/config.php.bak"] [unique_id "atQAXoX8Yo973UzprCoCpwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:36:29
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.70 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:36:24.044338 2026] [security2:error] [pid 6995:tid 6995] [client 104.23.239.70:12581] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||fabandco.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "fabandco.com"] [uri "/dump.sql"] [unique_id "atPcSB5DBsoMTsGD2zQM5wAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-17 20:04:28
(6 days ago)
[17/Oct/2026:23:04:27 +0300] -- 104.23.239.70 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET / ...
show more
[17/Oct/2026:23:04:27 +0300] -- 104.23.239.70 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /dump.sql HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-16 04:22:05
(1 week ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 05:23:42
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.70 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 01:23:34.867489 2026] [security2:error] [pid 3067:tid 3083] [client 104.23.239.70:10284] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||yourpersonalbusinessplan.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "yourpersonalbusinessplan.com"] [uri "/database.sql"] [unique_id "as8R1gR9AHRdbflGhI_MawAAAUs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-14 03:49:01
(1 week ago)
Automated scan for exposed backup archives, source code and database dumps
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 02:48:11
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.70 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 22:48:04.448622 2026] [security2:error] [pid 24894:tid 24894] [client 104.23.239.70:13999] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||twentytwocreative.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "twentytwocreative.net"] [uri "/rezerv.sql"] [unique_id "as7tZGFXzPM9pQ0QULm78QAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
