π§πͺ
madeit
2026-10-10 18:39:03
(2 days ago)
Web App Attack
πΊπΈ
TPI-Abuse
2026-10-07 23:58:24
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.175 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 19:58:17.872237 2026] [security2:error] [pid 28918:tid 28918] [client 172.70.115.175:9888] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crescentcitycafe.org"] [uri "/.env.save"] [unique_id "asbcmVtbh8mCaDIYUQRQvQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
πΉπ·
ScchutzZ
2026-09-29 14:05:11
(1 week ago)
Fail2Ban banΔ±. Jail: plesk-modsecurity.
Brute-Force
Anonymous
2026-09-24 18:00:12
(2 weeks ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
π§πͺ
madeit
2026-09-24 15:16:19
(2 weeks ago)
Web App Attack
π΅π
Keso
2026-06-22 00:00:00
(3 months ago)
Check for blocking
Web Spam
πΊπΈ
TPI-Abuse
2026-03-31 07:56:56
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.175 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 03:56:48.287386 2026] [security2:error] [pid 24431:tid 24431] [client 172.70.115.175:13818] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whipchecks.com.au"] [uri "/web/.env"] [unique_id "act-QLHM8gI2j3MUu7h5wwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
πΊπΈ
TPI-Abuse
2026-03-30 16:40:56
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.175 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 12:40:49.672916 2026] [security2:error] [pid 30258:tid 30258] [client 172.70.115.175:10488] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.whaletailpuckerbutt.com"] [uri "/var/www/html/.env"] [unique_id "acqnkVId7W8lMjTvSL987gAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-03-30 12:20:08
(6 months ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
πΊπΈ
TPI-Abuse
2026-03-20 04:41:30
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.175 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 00:41:22.646348 2026] [security2:error] [pid 16413:tid 16413] [client 172.70.115.175:9238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.grexicon.com"] [uri "/docker/.env.local"] [unique_id "abzP8giHM1UxjUWI8XFPJgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
πΊπΈ
TPI-Abuse
2026-03-20 02:55:15
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.175 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 22:55:05.256926 2026] [security2:error] [pid 7438:tid 7438] [client 172.70.115.175:12651] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.genevainvestors.com"] [uri "/.env"] [unique_id "aby3CRYAl8N1Dh9kXh6o5AAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
πΊπ¦
URAN Publishing Service
2026-02-12 17:06:44
(8 months ago)
172.70.115.175 - - [12/Feb/2026:19:06:43 +0200] "GET /wp-includes/images/wlw/ HTTP/1.1" 404 280 "-" ...
show more
172.70.115.175 - - [12/Feb/2026:19:06:43 +0200] "GET /wp-includes/images/wlw/ HTTP/1.1" 404 280 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/39.0.2171.95 Safari/537.36"
172.70.115.175 - - [12/Feb/2026:19:06:43 +0200] "GET /wp-includes/js/codemirror/ HTTP/1.1" 404 280 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0.3945.130 Safari/537.36"
...
show less
Web App Attack
π¨π³
ThreatBook.io
2026-02-06 00:38:59
(8 months ago)
2026-02-05 09:41:08 /favicon.ico
Web App Attack
π¬π§
[email protected]
2025-10-28 11:29:21
(11 months ago)
learn.tcfdhub.org:443 172.70.115.175 - - [28/Oct/2025:11:29:21 +0000] "GET //wp1/wp-includes/wlwmani ...
show more
learn.tcfdhub.org:443 172.70.115.175 - - [28/Oct/2025:11:29:21 +0000] "GET //wp1/wp-includes/wlwmanifest.xml HTTP/1.1" 404 4375 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
learn.tcfdhub.org:443 172.70.115.175 - - [28/Oct/2025:11:29:21 +0000] "GET //test/wp-includes/wlwmanifest.xml HTTP/1.1" 404 583 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
learn.tcfdhub.org:443 172.70.115.175 - - [28/Oct/2025:11:29:21 +0000] "GET //wp2/wp-includes/wlwmanifest.xml HTTP/1.1" 404 583 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/88.0.4240.193 Safari/537.36"
...
show less
Web App Attack
Anonymous
2025-10-24 09:24:13
(11 months ago)
[Fri Oct 24 11:24:10.471364 2025] [authz_core:error] [pid 26961] [client 172.70.115.175:13800] AH016 ...
show more
[Fri Oct 24 11:24:10.471364 2025] [authz_core:error] [pid 26961] [client 172.70.115.175:13800] AH01630: client denied by server configuration: /etc/httpd/htdocs
[Fri Oct 24 11:24:11.703749 2025] [authz_core:error] [pid 26961] [client 172.70.115.175:13800] AH01630: client denied by server configuration: /etc/httpd/htdocs
[Fri Oct 24 11:24:12.953733 2025] [authz_core:error] [pid 26961] [client 172.70.115.175:13800] AH01630: client denied by server configuration: /etc/httpd/htdocs
...
show less
Web App Attack