2026-03-11 11:05:12
(3 months ago)
WAF repeated trigger detected by Fail2Ban
Web App Attack
🇩🇪
juutis
2026-03-11 11:01:25
(3 months ago)
Multiple WAF abuses - IP blocked
Hacking
Brute-Force
Web App Attack
🇲🇾
Rizzy
2026-03-11 09:49:10
(3 months ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇩🇪
LRob.fr
2026-03-11 09:45:07
(3 months ago)
Repeated 404 errors, blocked by Fail2ban in custom-404 jail
Bad Web Bot
🇩🇪
MusicLibrary
2026-03-11 08:07:12
(3 months ago)
Attempted access to sensitive configuration files (.env, .git, etc.)
Bad Web Bot
Web App Attack
🇫🇷
GoodOldTOS
2026-03-11 08:01:40
(3 months ago)
Highly suspect IP
Hacking
Web App Attack
🇺🇦
URAN Publishing Service
2026-03-11 07:59:11
(3 months ago)
170.64.209.76 - - [11/Mar/2026:09:59:10 +0200] "GET /.env HTTP/1.1" 404 296 "-" "Mozilla/5.0 (Window ...
show more
170.64.209.76 - - [11/Mar/2026:09:59:10 +0200] "GET /.env HTTP/1.1" 404 296 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-03-11 06:59:03
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 170.64.209.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.209.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 11 02:58:56.391772 2026] [security2:error] [pid 27969:tid 27969] [client 170.64.209.76:38950] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sargous.com"] [uri "/.env"] [unique_id "abESsG2-HyVuPOcGYm2wMwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
Origon
2026-03-11 06:49:41
(3 months ago)
CVE-2017-9841 - IP: 170.64.209.76 - time="2026-03-11T07:49:41+01:00" level=info msg="(555f66b4f6a74 ...
show more
CVE-2017-9841 - IP: 170.64.209.76 - time="2026-03-11T07:49:41+01:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/CVE-2017-9841 by ip 170.64.209.76 (AU/14061) : 4h ban on Ip 170.64.209.76" module=db
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-03-11 06:34:14
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 170.64.209.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.209.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 11 02:34:09.978748 2026] [security2:error] [pid 16241:tid 16241] [client 170.64.209.76:47210] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sarawatt.com"] [uri "/.env"] [unique_id "abEM4b0xcG3NQWcumsvchgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-11 05:42:52
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 170.64.209.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.209.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 11 01:42:43.021287 2026] [security2:error] [pid 32360:tid 32360] [client 170.64.209.76:26056] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sarahingber.ingberinteriors.com"] [uri "/.env"] [unique_id "abEA0w13rbWjKuoUSQU1uAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-03-10 23:01:34
(3 months ago)
Auto-ban: >3000 req/min op 2026-03-10
Web App Attack
SSH
Hacking
🇩🇪
Ba-Yu
2026-03-10 18:47:16
(3 months ago)
General hacking/exploits/scanning
Web Spam
Hacking
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-03-10 18:42:41
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 170.64.209.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.209.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 10 14:42:31.843232 2026] [security2:error] [pid 5366:tid 5366] [client 170.64.209.76:6392] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "littlewizard.com.wizind.com"] [uri "/.env"] [unique_id "abBmFwdeeiqH2KIm10V8ZgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-10 18:20:44
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 170.64.209.76 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.209.76 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 10 14:20:40.450145 2026] [security2:error] [pid 15724:tid 15724] [client 170.64.209.76:62150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "littlepeopledelivery.com"] [uri "/.env"] [unique_id "abBg-A_EEKLoV5On4t3HdQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack