🇧🇪
madeit
2026-10-22 21:07:07
(2 days ago)
Web App Attack
🇧🇪
madeit
2026-10-06 21:59:55
(2 weeks ago)
Web App Attack
🇵🇰
sbk97 (https://sayor.net)
2026-10-04 07:42:20
(3 weeks ago)
SAYOR honeypot: observed attack //cms/wp-includes/wlwmanifest.xml
Brute-Force
🇵🇱
MatStef132
2026-08-29 22:32:38
(1 month ago)
MatShield L7: blocked on api.klovy.chat (ua-quarantined)
Bad Web Bot
🇫🇮
nNordic
2026-06-09 10:22:01
(4 months ago)
Connection attempt blocked by IDS/IPS from 172.70.115.7/32
Hacking
🇺🇸
TPI-Abuse
2026-04-01 07:12:36
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 03:12:31.145837 2026] [security2:error] [pid 23395:tid 23395] [client 172.70.115.7:11671] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.whodatnation.com"] [uri "/.env1"] [unique_id "aczFX4T1Fycbj7UwGL9XGgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-29 19:40:42
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 15:40:18.784854 2026] [security2:error] [pid 3014:tid 3014] [client 172.70.115.7:9378] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jeffersonlynn.com"] [uri "/backend/.env"] [unique_id "acmAIolZTrX8gTLR7qv20QAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 06:21:08
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 02:21:00.679428 2026] [security2:error] [pid 23902:tid 23902] [client 172.70.115.7:9712] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.bitcoinbtcshop.com"] [uri "/.env.json"] [unique_id "abznTDU7CbIaZme7f_edYgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 05:32:37
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 01:32:30.895905 2026] [security2:error] [pid 17193:tid 17193] [client 172.70.115.7:14292] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.bb103.us"] [uri "/docker/.env.local"] [unique_id "abzb7oJ-RiqwgAGAvnYVEQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 03:03:39
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 23:03:29.568844 2026] [security2:error] [pid 31567:tid 31567] [client 172.70.115.7:11856] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.cdphotography.us"] [uri "/.env.production.local"] [unique_id "aby5AaCV61R9VatOswHj_AAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 02:14:36
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 22:14:30.853246 2026] [security2:error] [pid 9531:tid 9531] [client 172.70.115.7:9506] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.cromaki.com"] [uri "/.env.production"] [unique_id "abythio4vEVUH8epTc6SUwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 01:11:49
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 21:11:40.867748 2026] [security2:error] [pid 29817:tid 29817] [client 172.70.115.7:9513] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.lapsychiatrist.com"] [uri "/site/.env"] [unique_id "abyezJG3fZraXnC4ffK4ggAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 00:01:48
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.115.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 20:01:42.202416 2026] [security2:error] [pid 25987:tid 25987] [client 172.70.115.7:12815] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wildflowerartfarm.com"] [uri "/.git/index"] [unique_id "abyOZpsKfsXylSErAvg14QAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
SOC Blue Team
2025-12-01 12:41:17
(10 months ago)
Tatic: TA0006 | Technique: T1110 | Source: TAP | Country Destination: BR
Brute-Force
🇧🇷
SOC Blue Team
2025-11-29 17:30:35
(10 months ago)
Tatic: TA0006 | Technique: T1110 | Source: TAP | Country Destination: BR
Brute-Force
