2026-10-14 13:26:54
(17 hours ago)
IP matched detection query many 3xx errors.
Brute-Force
🇺🇸
TPI-Abuse
2026-10-07 23:58:25
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 19:58:17.870505 2026] [security2:error] [pid 8412:tid 8412] [client 172.70.115.176:10982] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crescentcitycafe.org"] [uri "/.env.production"] [unique_id "asbcmb4cwJoeCiEOk3yqNAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 16:32:50
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 12:32:46.899964 2026] [security2:error] [pid 23075:tid 23091] [client 172.70.115.176:13547] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cibernetic.com"] [uri "/.env.production"] [unique_id "asUiroimGcKJHnRB5Q-5_QAAAQI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-05 17:06:58
(1 week ago)
Web App Attack
🇮🇩
securejdprop
2026-08-21 05:49:35
(1 month ago)
This IP was detected by CrowdSec triggering custom/vpatch-bad-cloudflare.
Hacking
🇧🇷
chronos
2026-07-27 07:10:49
(2 months ago)
2026-07-27 02:38:55 UTC-3||Unauthorized connection attempt detected for port scanning
Port Scan
🇵🇭
Keso
2026-06-22 00:00:00
(3 months ago)
Check for blocking
Web Spam
🇦🇺
oncord
2026-04-18 17:44:18
(5 months ago)
Form spam
Web Spam
🇦🇺
oncord
2026-04-15 13:15:35
(5 months ago)
Form spam
Web Spam
🇨🇦
yukon.ca
2026-04-07 02:34:30
(6 months ago)
Web Server Enforcement Violation: Web Server Exposed Git Repository Information Disclosure
Port:80
Hacking
Exploited Host
🇺🇸
TPI-Abuse
2026-03-30 16:40:55
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 12:40:49.785334 2026] [security2:error] [pid 24145:tid 24145] [client 172.70.115.176:12545] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.whaletailpuckerbutt.com"] [uri "/root/.env"] [unique_id "acqnkRG3G-NCTNAzWxR4-gAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-03-30 12:20:09
(6 months ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-29 19:54:44
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 15:54:39.342219 2026] [security2:error] [pid 16351:tid 16351] [client 172.70.115.176:13298] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.fruitinthedesert.com"] [uri "/docker/.env.local"] [unique_id "acmDf_UfbRFriRnTnUjh7wAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 08:42:04
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 04:41:58.951751 2026] [security2:error] [pid 31042:tid 31042] [client 172.70.115.176:11799] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.dev.cormanleigh.com"] [uri "/.env"] [unique_id "ab0IVp9YZDEjq79kcJ0DZwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 07:33:23
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.176 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.176 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 03:33:17.043495 2026] [security2:error] [pid 11623:tid 11623] [client 172.70.115.176:11611] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.biff0.com"] [uri "/.env.save"] [unique_id "abz4PebGeq8oSBueE7zQjAAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
