🇳🇱
e.fierstra
2026-08-01 18:11:39
UTC ·
(3 months ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-07-29 07:13:52
UTC ·
(3 months ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 104.28.162.43 (CA/Canada/-): 2 in the last 3600 secs (0-196)
Hacking
2026-07-01 03:15:15
UTC ·
(4 months ago)
104.28.162.43 - - [01/Jul/2026:05:15:14 +0200] "GET /.git/config HTTP/2.0" 301 169 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https:///searchbot"
Web App Attack
🇩🇪
XICTRON
2026-06-29 19:20:09
UTC ·
(4 months ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
🇺🇸
TPI-Abuse
2026-06-29 11:31:58
UTC ·
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 104.28.162.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 07:31:54.829795 2026] [security2:error] [pid 9170:tid 9170] [client 104.28.162.43:44989] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 104.28.162.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 29 07:31:54.829795 2026] [security2:error] [pid 9170:tid 9170] [client 104.28.162.43:44989] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cas.majesticsolutions.co|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cas.majesticsolutions.co"] [uri "/wp-content/debug.log"] [unique_id "akJXqrVbaNfX0wsQ5spEeQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇹
Pingger Shikkoken
2026-06-29 01:01:24
UTC ·
(4 months ago)
2026-06-29T01:01:24+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=104.28.162.43 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=26172 DF PROTO=TCP SPT=43354 DPT=443 WIN ...
show more
2026-06-29T01:01:24+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=104.28.162.43 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=26172 DF PROTO=TCP SPT=43354 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0 2026-06-29T01:01:25+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=104.28.162.43 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=26173 DF PROTO=TCP SPT=43354 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0 2026-06-29T01:01:25+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:84:03:28:62:58:1a:08:00 SRC=104.28.162.43 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x00 TTL=52 ID=41975 DF PROTO=TCP SPT=43360 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0 ...
show less
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-28 19:46:19
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.28.162.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 15:46:14.621843 2026] [security2:error] [pid 27935:tid 27935] [client 104.28.162.43:44545] M ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.162.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 15:46:14.621843 2026] [security2:error] [pid 27935:tid 27935] [client 104.28.162.43:44545] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.joshuarawlings.mark.rawlings.name"] [uri "/.env.prod"] [unique_id "akF6BpxzRe3fcVf0MF8xJgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-28 16:45:06
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.28.162.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 12:44:59.152204 2026] [security2:error] [pid 7360:tid 7360] [client 104.28.162.43:44089] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.162.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 28 12:44:59.152204 2026] [security2:error] [pid 7360:tid 7360] [client 104.28.162.43:44089] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "riccardiagency.com"] [uri "/.git/HEAD"] [unique_id "akFPi2uJEhS2vk6LNmMhxgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-06-28 14:14:05
UTC ·
(4 months ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 104.28.162.43 (CA/Canada/-): 1 in the last 3600 secs (0-195)
Hacking
🇳🇱
e.fierstra
2026-06-28 13:10:43
UTC ·
(4 months ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
2026-06-28 03:58:04
UTC ·
(4 months ago)
104.28.162.43 - - [28/Jun/2026:05:58:03 +0200] "GET /.git/config HTTP/1.1" 402 4449 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36" ...
Web App Attack
🇺🇸
TPI-Abuse
2026-06-27 04:55:05
UTC ·
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 104.28.162.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 00:54:56.895454 2026] [security2:error] [pid 17410:tid 17410] [client 104.28.162.43:43484] M ...
show more
(mod_security) mod_security (id:210730) triggered by 104.28.162.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 27 00:54:56.895454 2026] [security2:error] [pid 17410:tid 17410] [client 104.28.162.43:43484] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||groundwateradvertising.g-h2o.com|F|2"] [data ".env.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "groundwateradvertising.g-h2o.com"] [uri "/.env.bak"] [unique_id "aj9XoFmZ2gCFqeBjKZv4DwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 11:04:53
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.28.162.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 07:04:49.939337 2026] [security2:error] [pid 22699:tid 22743] [client 104.28.162.43:42663] M ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.162.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 26 07:04:49.939337 2026] [security2:error] [pid 22699:tid 22743] [client 104.28.162.43:42663] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "navinole.com"] [uri "/admin/.htpasswd"] [unique_id "aj5c0fd1sA3z_SymDp2d1gAAAEo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Octopuce
2026-06-26 08:09:53
UTC ·
(4 months ago)
Aggressive web search of vulnerable pages: /.circleci/config.yml /phpinfo.php /info.php /.env /config.yml /configuration.php /wp-config.php /ap ...
Web App Attack
2026-05-01 07:53:40
UTC ·
(6 months ago)
postfix
Email Spam
Web App Attack