🇺🇸
almazick
2026-10-18 18:50:42
(6 days ago)
Fail2Ban jail window on srv1.windowrepair.us banned 172.70.115.113 after 1 attempts
Bad Web Bot
Web App Attack
🇺🇸
dot.mg
2026-09-25 15:35:13
(4 weeks ago)
Impersonating Good bots
Bad Web Bot
🇯🇵
S.O.B.A. Dev.
2026-04-16 23:26:09
(6 months ago)
Persistent port scanning or vulnerability scanning
Port Scan
🇺🇸
TPI-Abuse
2026-03-31 12:59:07
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 08:59:01.016270 2026] [security2:error] [pid 8148:tid 8148] [client 172.70.115.113:11724] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.scrunchiebutt.com"] [uri "/.env.php"] [unique_id "acvFFRRq6dy0iXLBZOhxUAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-29 17:32:50
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 13:32:32.659068 2026] [security2:error] [pid 13212:tid 13212] [client 172.70.115.113:11213] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "seacorre.com"] [uri "/backend/.env"] [unique_id "acliMM18_L0AgSzGcVQtXAAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 08:08:13
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 04:08:08.438609 2026] [security2:error] [pid 22927:tid 22927] [client 172.70.115.113:13346] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.trhs70.com"] [uri "/.env.php"] [unique_id "ab0AaKRPNtSkRctc0kx_mwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 06:28:03
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 02:27:57.357405 2026] [security2:error] [pid 31306:tid 31306] [client 172.70.115.113:12907] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.catzpaw.com"] [uri "/.env.json"] [unique_id "abzo7YhFJCl4q44C4NGBNQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 05:42:28
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 01:42:20.668158 2026] [security2:error] [pid 6213:tid 6213] [client 172.70.115.113:9826] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.punctuminteractive.com"] [uri "/.env.prod"] [unique_id "abzePF3IUFNfvAi0FQFWQQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 04:43:42
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 00:43:35.995177 2026] [security2:error] [pid 24146:tid 24146] [client 172.70.115.113:10886] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.vittariaart.com"] [uri "/core/.env"] [unique_id "abzQd1u1Is4qYGQWRiUUcwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 03:59:29
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 23:59:21.121916 2026] [security2:error] [pid 17556:tid 17556] [client 172.70.115.113:13228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.backspaced.com"] [uri "/var/www/html/.env"] [unique_id "abzGGaFsG5x39BXPwkRaWAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 02:14:26
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 22:14:23.717137 2026] [security2:error] [pid 25729:tid 25729] [client 172.70.115.113:13923] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.temi.handyrehab.com"] [uri "/.env.production.bak"] [unique_id "abytf292mGUONyN0ueU9NQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 00:52:35
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.113 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 20:52:31.473504 2026] [security2:error] [pid 31678:tid 31678] [client 172.70.115.113:12156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.angelonearth.net"] [uri "/.env.example"] [unique_id "abyaTyGoJez-PhfATydWPQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
oncord
2026-02-02 15:05:26
(8 months ago)
Form spam
Web Spam
🇺🇸
MirrorImageGaming
2025-12-03 05:05:07
(10 months ago)
HTTP probe(s) @ TCP 80 US
Port Scan
🇫🇷
Campus France
2025-11-30 18:05:34
(10 months ago)
[Sun Nov 30 19:05:32.279003 2025] [php:error] [pid 1850633] [client 172.70.115.113:10079] script '/v ...
show more
[Sun Nov 30 19:05:32.279003 2025] [php:error] [pid 1850633] [client 172.70.115.113:10079] script '/var/www/html/gifclass.php' not found or unable to stat
[Sun Nov 30 19:05:32.376029 2025] [php:error] [pid 1850633] [client 172.70.115.113:10079] script '/var/www/html/plugin.php' not found or unable to stat
[Sun Nov 30 19:05:32.571361 2025] [php:error] [pid 1850633] [client 172.70.115.113:10079] script '/var/www/html/update-core.php' not found or unable to stat
[Sun Nov 30 19:05:32.773676 2025] [php:error] [pid 1850633] [client 172.70.115.113:10079] script '/var/www/html/wp-mail.php' not found or unable to stat
[Sun Nov 30 19:05:33.762177 2025] [php:error] [pid 1850633] [client 172.70.115.113:10079] script '/var/www/html/aa.php' not found or unable to stat
...
show less
Brute-Force
Web App Attack
