2026-10-18 06:11:59
(56 minutes ago)
Unauthorized access (443/tcp/https)
Port Scan
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 19:42:21
(11 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.87 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 15:42:13.742482 2026] [security2:error] [pid 13124:tid 13124] [client 104.23.239.87:10617] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rockymtnfire.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rockymtnfire.com"] [uri "/rezerv.sql"] [unique_id "atPPlQOu6CuhiLyvl2C9XAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-16 08:06:40
(1 day ago)
Trying to access config files
Web App Attack
2026-10-15 03:06:08
(3 days ago)
Trying to access config files
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 04:27:46
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.87 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 00:27:37.421276 2026] [security2:error] [pid 24521:tid 24521] [client 104.23.239.87:10581] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mikethehomehelper.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mikethehomehelper.com"] [uri "/db.sql"] [unique_id "as8EuWoFmVrdeU0nBafnywAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 03:39:09
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.87 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:39:02.324785 2026] [security2:error] [pid 21044:tid 21044] [client 104.23.239.87:11261] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.thereisaplaceonearth.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.thereisaplaceonearth.com"] [uri "/config.php.bak"] [unique_id "as75Vn8_wJ_ph6fJDLfa8AAAAEU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 01:50:30
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.87 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 21:50:26.598981 2026] [security2:error] [pid 25676:tid 25676] [client 104.23.239.87:10730] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||candlesandwoodcrafts.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "candlesandwoodcrafts.com"] [uri "/admin/config.php.bak"] [unique_id "as7f4sUORcB49-7w7fTTpQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 00:00:18
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.87 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 19:59:58.940729 2026] [security2:error] [pid 24729:tid 24729] [client 104.23.239.87:12700] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||technicallydental.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "technicallydental.com"] [uri "/admin/config.php.bak"] [unique_id "as7F_gcoQZxXW9er7R4VKAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 22:53:18
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.87 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.87 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 18:53:09.314576 2026] [security2:error] [pid 1051:tid 1051] [client 104.23.239.87:10063] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.luxebikinis.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.luxebikinis.com"] [uri "/admin/config.php.bak"] [unique_id "as62Vau8PysThIsO6aI52gAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-08 12:45:54
(1 week ago)
Multiple WAF Violations
Web App Attack
🇧🇪
madeit
2026-10-01 09:06:36
(2 weeks ago)
Web App Attack
🇩🇪
FeG Deutschland
2026-08-30 14:18:23
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 12
Exploited Host
Web App Attack
🇧🇾
lns.bz
2026-08-19 09:10:45
(1 month ago)
Too many 404 requests [BY]
Web App Attack
🇧🇪
madeit
2026-08-16 05:49:56
(2 months ago)
Web App Attack
🇷🇺
DZBOT
2026-08-06 03:41:33
(2 months ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
