🇩🇪
palla89
2026-07-23 08:05:27
(6 hours ago)
(wordpress) Failed wordpress login from 104.23.253.124 (US/United States/-)
Brute-Force
🇩🇪
ValtonTahiri
2026-07-16 01:33:30
(1 week ago)
UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly as ...
show more
UFW blocked a suspicious connection attempt to a closed or denied port. This activity is commonly associated with port scanning, service discovery, or automated internet probing. Technical: source_ip=104.23.253.124; proto=TCP; source_port=11208; target_port=8443; flags=SYN
show less
Port Scan
🇩🇪
palla89
2026-07-06 19:04:51
(2 weeks ago)
(wordpress) Failed wordpress login from 104.23.253.124 (US/United States/-)
Brute-Force
🇺🇸
mnsf
2026-03-25 19:05:27
(3 months ago)
Scanning/Probing (24)
Brute-Force
Web App Attack
🇺🇸
Starburst SysOp Team
2026-03-24 19:15:19
(3 months ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-stl2-14)
Hacking
Web App Attack
🇺🇸
mnsf
2026-03-21 02:07:46
(4 months ago)
Scanning/Probing (11)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 07:15:44
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 03:15:36.984700 2026] [security2:error] [pid 2165:tid 2165] [client 104.23.253.124:14218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.aemcmullin.com"] [uri "/.env.test"] [unique_id "abz0GPXjxNzpNq_mXUvzzgAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 06:54:30
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 02:54:25.547620 2026] [security2:error] [pid 8482:tid 8482] [client 104.23.253.124:11722] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.kewlkarz.com"] [uri "/.env.container"] [unique_id "abzvITI3g-jU7dN0xefkuAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 05:48:32
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 01:48:27.022495 2026] [security2:error] [pid 3777:tid 3777] [client 104.23.253.124:13740] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.the-schlosser.net"] [uri "/api/.env"] [unique_id "abzfq7WUkoEZrYxSL24LtQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 05:17:53
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 01:17:46.075026 2026] [security2:error] [pid 16273:tid 16273] [client 104.23.253.124:12926] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.cypraea.info"] [uri "/site/.env"] [unique_id "abzYenDtKbLMbVSIfawoKgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 04:18:37
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 00:18:33.360758 2026] [security2:error] [pid 13071:tid 13071] [client 104.23.253.124:12360] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.glolady.com"] [uri "/web/.env"] [unique_id "abzKmbIl3WvcUJYBtfsnnwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 03:23:39
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 23:23:33.321765 2026] [security2:error] [pid 19983:tid 19983] [client 104.23.253.124:12209] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.vaghyst.com"] [uri "/.env.staging"] [unique_id "aby9tenm6EWHtKBaYK8uPAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 02:59:37
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 22:59:32.791851 2026] [security2:error] [pid 17702:tid 17702] [client 104.23.253.124:13034] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "terfgunclub.com"] [uri "/.env.tmp"] [unique_id "aby4FDFZXKoofusWVYF5FwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 02:25:53
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 22:25:48.373287 2026] [security2:error] [pid 22870:tid 22870] [client 104.23.253.124:12562] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bilimkurgumanyagi.com"] [uri "/.env.local"] [unique_id "abywLAJxn-DiYI836k2CyAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 01:50:55
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.23.253.124 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 21:50:44.642188 2026] [security2:error] [pid 17784:tid 17784] [client 104.23.253.124:13255] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.crescentcitycafe.com"] [uri "/.env.production.bak"] [unique_id "abyn9G4RSeqWB90z_9Pq4wAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack