🇧🇪
madeit
2026-10-23 16:22:40
(4 days ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 14:32:27
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 10:32:18.322120 2026] [security2:error] [pid 31151:tid 31170] [client 172.70.114.227:9585] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||greencitymethods.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "greencitymethods.com"] [uri "/index.php.bak"] [unique_id "asUGcnFY6n9L3QOjezb1UAAAAMw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-05 22:53:20
(3 weeks ago)
Web App Attack
🇫🇷
dynamix
2026-09-28 21:12:45
(4 weeks ago)
Multiple WAF Violations
Web App Attack
2026-09-02 16:42:05
(1 month ago)
Web Probe / Attack
Web App Attack
🇮🇩
securejdprop
2026-08-21 07:46:28
(2 months ago)
This IP was detected by CrowdSec triggering custom/vpatch-bad-cloudflare.
Hacking
🇺🇸
TPI-Abuse
2026-04-01 02:32:37
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 22:32:31.466998 2026] [security2:error] [pid 12456:tid 12456] [client 172.70.114.227:9813] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.ditchthediaper.com"] [uri "/.env.dev.local"] [unique_id "acyDvxntUFUP9hxA7SlQ6AAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
S.O.B.A. Dev.
2026-03-26 00:00:10
(7 months ago)
Persistent port scanning or vulnerability scanning
Port Scan
🇺🇸
TPI-Abuse
2026-03-20 09:28:42
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 05:28:35.580221 2026] [security2:error] [pid 31638:tid 31638] [client 172.70.114.227:10303] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.beirutbazar.com"] [uri "/.env.save"] [unique_id "ab0TQ9cSqQetmm94YGPHAAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 07:33:20
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 03:33:14.574892 2026] [security2:error] [pid 2579782:tid 2579782] [client 172.70.114.227:13840] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.hendersonhomes.com"] [uri "/admin/.env"] [unique_id "abz4OqWjiS-oU5J6Du6l9gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 06:29:07
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 02:29:00.695209 2026] [security2:error] [pid 20334:tid 20344] [client 172.70.114.227:12800] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.belfastpropertyagency.com"] [uri "/.env.development"] [unique_id "abzpLFYGMaqUBIxfqlZYcAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 05:57:46
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 01:57:40.623337 2026] [security2:error] [pid 11885:tid 11885] [client 172.70.114.227:9230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.archaiusmusic.com"] [uri "/.env.php"] [unique_id "abzh1BgNaUGYQMNbGStSMwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 05:32:55
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 01:32:51.470709 2026] [security2:error] [pid 5137:tid 5137] [client 172.70.114.227:12264] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.bb103.us"] [uri "/root/.env"] [unique_id "abzcA1PGKM63bTt4dXWboQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 05:10:17
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 01:10:08.044226 2026] [security2:error] [pid 10059:tid 10078] [client 172.70.114.227:13698] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.ward-bergerhouse.org"] [uri "/.env.test"] [unique_id "abzWsBVJXC6QG5opubuLOQAAARE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 03:59:28
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.114.227 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 23:59:21.338684 2026] [security2:error] [pid 17557:tid 17557] [client 172.70.114.227:14092] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.backspaced.com"] [uri "/.env_secret"] [unique_id "abzGGYg74o_2rZb2cy4YHgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
