🇸🇪
1337v411
2026-10-18 14:51:52
(1 hour ago)
[2026-10-18T14:51:51+00:00] uri="/wp-content/plugins/bricksforge/assets/" ua="Mozilla/5.0 (Windows N ...
show more
[2026-10-18T14:51:51+00:00] uri="/wp-content/plugins/bricksforge/assets/" ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 10:36:19
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 06:36:13.345479 2026] [security2:error] [pid 5808:tid 5808] [client 104.23.239.94:12663] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paulzaremba.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paulzaremba.com"] [uri "/db.sql"] [unique_id "atShHTylxmI1Y5hQrnCutwAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 10:03:59
(6 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 06:03:51.981167 2026] [security2:error] [pid 12995:tid 12995] [client 104.23.239.94:10260] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||elianabeam.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "elianabeam.com"] [uri "/db.sql"] [unique_id "atSZh47fivfOkXDa8rlQXQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 08:12:19
(8 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 04:12:14.067761 2026] [security2:error] [pid 23355:tid 23355] [client 104.23.239.94:13073] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mrepoch.art|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mrepoch.art"] [uri "/db.sql"] [unique_id "atR_XtTt6RdBQg7fZlaAAAAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-18 07:53:55
(8 hours ago)
Honey Pot Hit / Attack Vector found!
Port Scan
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 03:34:50
(12 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:34:43.180962 2026] [security2:error] [pid 11867:tid 11867] [client 104.23.239.94:11042] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||whlr.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "whlr.net"] [uri "/whlr.sql"] [unique_id "atQ-Uzw9qAFRrelIITigFwAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:17:08
(13 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:17:02.130734 2026] [security2:error] [pid 7752:tid 7752] [client 104.23.239.94:11383] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.doubleandup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.doubleandup.com"] [uri "/database.sql"] [unique_id "atQsHk-JExnvqP1umhg7jQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Smish
2026-10-18 01:11:47
(15 hours ago)
HONEYPOT HIT --> Fail2ban time=1792285906 log=2026-10-18T02:11:46+01:00 ip=104.23.239.94 host=dal-lg ...
show more
HONEYPOT HIT --> Fail2ban time=1792285906 log=2026-10-18T02:11:46+01:00 ip=104.23.239.94 host=dal-lg.bya.ac method=GET uri="/dal-lg.bya.ac.sql" status=404 ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0" ref="-" rid=8fbe38ecb8028a4a5bf89566aaeb3c14
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:52:11
(16 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:51:55.707966 2026] [security2:error] [pid 9879:tid 9879] [client 104.23.239.94:13250] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitess.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitess.com"] [uri "/config.php.bak"] [unique_id "atQKG-ZQcNWc_vXfZBsXAAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:26:42
(16 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:26:36.215530 2026] [security2:error] [pid 30352:tid 30352] [client 104.23.239.94:13404] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tedgrob.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tedgrob.com"] [uri "/tedgrob.sql"] [unique_id "atQELMmWMZjjevwUuduIRAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 19:44:04
(20 hours ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 15:43:58.694486 2026] [security2:error] [pid 9093:tid 9093] [client 104.23.239.94:10312] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||reettaanttila.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "reettaanttila.com"] [uri "/db.sql"] [unique_id "atPP_oO31lbR8vDY8V8G1gAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-10-17 18:30:48
(21 hours ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. ...
show more
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
show less
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-14 07:26:34
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 03:26:26.890235 2026] [security2:error] [pid 7537:tid 7554] [client 104.23.239.94:11700] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.lancasterdesignercraftsmen.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.lancasterdesignercraftsmen.org"] [uri "/db.sql"] [unique_id "as8uovDBB_7z1y09ZpMrcgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 02:38:24
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.23.239.94 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 22:38:14.940739 2026] [security2:error] [pid 15181:tid 15181] [client 104.23.239.94:9936] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||toastergraphics.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "toastergraphics.com"] [uri "/backup.sql"] [unique_id "as7rFjEpmujhz8rZu8sHuQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
copestack
2026-10-14 01:30:10
(4 days ago)
Honeypot hit on ov-4e5936 (fail2ban jail: nginx-compat)
Web App Attack
