🇫🇷
dynamix
2026-11-06 16:20:23
UTC ·
(8 hours ago)
Multiple WAF Violations
Web App Attack
🇺🇸
EmilGH
2026-10-26 08:18:56
UTC ·
(1 week ago)
172.70.111.193 - - [26/Oct/2026:08:18:36 +0000] "GET /llm/.env HTTP/1.1" 403 2090 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
172.70.111.193 - - [26/Oct/2026:08:18:36 +0000] "GET /sh ...
show more
172.70.111.193 - - [26/Oct/2026:08:18:36 +0000] "GET /llm/.env HTTP/1.1" 403 2090 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot"
172.70.111.193 - - [26/Oct/2026:08:18:36 +0000] "GET /shared/.env HTTP/1.1" 403 509 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )"
172.70.111.193 - - [26/Oct/2026:08:18:36 +0000] "GET /shared/.env HTTP/1.1" 403 509 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )"
172.70.111.193 - - [26/Oct/2026:08:18:37 +0000] "GET /utils/.env HTTP/1.1" 403 2090 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
172.70.111.193 - - [26/Oct/2026:08:18:37 +0000] "GET /utils/.env HTTP/1.1" 403 2090 "-" "Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)"
172.70.111.193 - - [26/Oct/2026:08:18:38 +0000] "GET /cms/.env HTTP/1.1" 403 509 "-" "Mozilla/5.
...
show less
Bad Web Bot
Web App Attack
🇺🇸
EmilGH
2026-10-22 14:48:08
UTC ·
(2 weeks ago)
172.70.111.193 - - [22/Oct/2026:14:48:01 +0000] "GET /lib/.env HTTP/1.1" 403 2090 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
172.70.111.193 - - [22/Oct/2026:14:48:01 +0000] "GET /shared/.env HTTP/1.1" 403 509 "-" "Mozilla/5.0 (Linux; ...
show more
172.70.111.193 - - [22/Oct/2026:14:48:01 +0000] "GET /lib/.env HTTP/1.1" 403 2090 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
172.70.111.193 - - [22/Oct/2026:14:48:01 +0000] "GET /shared/.env HTTP/1.1" 403 509 "-" "Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
172.70.111.193 - - [22/Oct/2026:14:48:02 +0000] "GET /cmd/.env HTTP/1.1" 403 509 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
172.70.111.193 - - [22/Oct/2026:14:48:02 +0000] "GET /store/.env HTTP/1.1" 403 509 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"
172.70.111.193 - - [22/Oct/2026:14:48:02 +0000] "GET /dashboard/.env HTTP/1.1" 403 539 "-" "Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/)"
172.70.111.193 - - [22/Oct/2026:14:48:02 +0000] "GET /auth/.env HTTP/1.1" 403 509 "-" "Mozilla/5.0 (
...
show less
Bad Web Bot
Web App Attack
Anonymous
2026-10-05 07:22:39
UTC ·
(1 month ago)
[Mon Oct 05 09:22:36.983389 2026] [authz_core:error] [pid 27243] [client 172.70.111.193:9850] AH01630: client denied by server configuration: /etc/httpd/htdocs
[Mon Oct 05 09:22:37.342061 2026] [authz_core:error] [pid 27243] [client 172.70.111.193:98 ...
show more
[Mon Oct 05 09:22:36.983389 2026] [authz_core:error] [pid 27243] [client 172.70.111.193:9850] AH01630: client denied by server configuration: /etc/httpd/htdocs
[Mon Oct 05 09:22:37.342061 2026] [authz_core:error] [pid 27243] [client 172.70.111.193:9850] AH01630: client denied by server configuration: /etc/httpd/htdocs
[Mon Oct 05 09:22:37.675545 2026] [authz_core:error] [pid 27243] [client 172.70.111.193:9850] AH01630: client denied by server configuration: /etc/httpd/htdocs
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 19:36:03
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 172.70.111.193 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 15:35:55.228798 2026] [security2:error] [pid 13556:tid 13556] [client 172.70.111.193:9934] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.111.193 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 15:35:55.228798 2026] [security2:error] [pid 13556:tid 13556] [client 172.70.111.193:9934] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.normteslaa.com"] [uri "/wp-config.php"] [unique_id "asKqm_FMXFiadFHkejaJAwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-09-18 19:52:17
UTC ·
(1 month ago)
Web App Attack
🇧🇪
madeit
2026-09-05 23:29:43
UTC ·
(2 months ago)
Web App Attack
🇧🇪
madeit
2026-08-26 14:26:02
UTC ·
(2 months ago)
Web App Attack
🇮🇩
securejdprop
2026-08-21 09:07:40
UTC ·
(2 months ago)
This IP was detected by CrowdSec triggering custom/vpatch-bad-cloudflare.
Hacking
🇺🇸
TPI-Abuse
2026-06-21 05:30:12
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.111.193 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 01:30:05.352938 2026] [security2:error] [pid 19051:tid 19051] [client 172.70.111.193:24872] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.111.193 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 21 01:30:05.352938 2026] [security2:error] [pid 19051:tid 19051] [client 172.70.111.193:24872] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.eliseheritage.com.worldchat.global"] [uri "/.env.dist"] [unique_id "ajd23ceWlSwEtNbbf9VM9gAAAAE"], referer: https://www.google.com/search?q=www.eliseheritage.com.worldchat.global
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
sandra361
2026-06-03 09:50:01
UTC ·
(5 months ago)
Port scan detected: 5 attempts across 1 ports (443). | Evidence: REAPER_TARPIT:IN=enp1s0f0 OUT= SRC=172.70.111.193 LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=24791 DF PROTO=TCP SPT=13840 DPT=443 WINDOW=65535 RES=0x00 SYN URGP=0
Port Scan
🇺🇸
TPI-Abuse
2026-05-25 17:26:22
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.111.193 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 13:26:16.852209 2026] [security2:error] [pid 8313:tid 8313] [client 172.70.111.193:12597] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.111.193 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 13:26:16.852209 2026] [security2:error] [pid 8313:tid 8313] [client 172.70.111.193:12597] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "grantjennings.com"] [uri "/.env.save"] [unique_id "ahSGOIuHmC5E-3EFUwKjugAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-05-06 12:39:28
UTC ·
(6 months ago)
172.70.111.193 - - [06/May/2026:15:39:27 +0300] "GET /wp-content/plugins/fckeditor/filemanager/browser/default/browser.html HTTP/1.1" 404 789 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
172.70.111.193 - - [06/May/2026:15:39: ...
show more
172.70.111.193 - - [06/May/2026:15:39:27 +0300] "GET /wp-content/plugins/fckeditor/filemanager/browser/default/browser.html HTTP/1.1" 404 789 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
172.70.111.193 - - [06/May/2026:15:39:27 +0300] "GET /japan-fixed.com/wp-content/plugins/ckeditor-for-wordpress/filemanager/browser/default/browser.html HTTP/1.1" 404 789 "-" "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; Trident/5.0)"
...
show less
Web App Attack
🇺🇦
URAN Publishing Service
2026-04-23 22:18:11
UTC ·
(6 months ago)
172.70.111.193 - - [24/Apr/2026:01:18:02 +0300] "GET /wp-includes/fonts/ HTTP/1.1" 404 768 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
...
show more
172.70.111.193 - - [24/Apr/2026:01:18:02 +0300] "GET /wp-includes/fonts/ HTTP/1.1" 404 768 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
172.70.111.193 - - [24/Apr/2026:01:18:11 +0300] "GET /wp-content/ai1wm-backups/ HTTP/1.1" 404 768 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
...
show less
Web App Attack
🇺🇦
URAN Publishing Service
2026-04-21 16:50:09
UTC ·
(6 months ago)
172.70.111.193 - - [21/Apr/2026:19:49:49 +0300] "GET /wp-content/cgialfa/ HTTP/1.1" 404 768 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" ...
show more
172.70.111.193 - - [21/Apr/2026:19:49:49 +0300] "GET /wp-content/cgialfa/ HTTP/1.1" 404 768 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
172.70.111.193 - - [21/Apr/2026:19:50:08 +0300] "GET /wp-admin/network/ HTTP/1.1" 404 768 "-" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
...
show less
Web App Attack