🇩🇪
4server
2026-05-09 11:39:51
(2 months ago)
[SatMay0913:39:48.3420482026][security2:error][pid3512502:tid3512570][client172.70.135.81:0]ModSecur ...
show more
[SatMay0913:39:48.3420482026][security2:error][pid3512502:tid3512570][client172.70.135.81:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\|wget\|python\|nikto\|sqlmap\|acunetix\|fimap\|dirbuster\|cmsmap\)\"atREQUEST_HEADERS:user-agent.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"217\"][id\"990210\"][msg\"Suspicioususer-agentblocked\"][hostname\"gruppobalu.com\"][uri\"/.git/config\"][unique_id\"af8dBMCKIkgt2v9BydpohwAAAIc\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 18:35:12
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 14:35:08.657245 2026] [security2:error] [pid 32602:tid 32602] [client 172.70.135.81:10012] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.bbernal.com"] [uri "/.env.dev"] [unique_id "acrCXDEJGu3tDCFLT7H4FgAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 17:29:38
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 13:29:31.347608 2026] [security2:error] [pid 19525:tid 19525] [client 172.70.135.81:9500] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sahinozalit.com"] [uri "/api/.env"] [unique_id "acqy-8J7Norc0zEWk5a2pAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 16:48:32
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 12:48:28.199603 2026] [security2:error] [pid 25091:tid 25091] [client 172.70.135.81:10692] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.wetlizarddiveteam.com"] [uri "/.env.backup"] [unique_id "acqpXKSTgCvzN9IfvNCSiAAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 11:44:13
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 07:44:06.238528 2026] [security2:error] [pid 12055:tid 12055] [client 172.70.135.81:10719] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.meghanmack.com"] [uri "/.env.php"] [unique_id "acpiBk7PAkVBF55cMOJIkQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 10:37:03
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 06:36:48.640090 2026] [security2:error] [pid 1528:tid 1528] [client 172.70.135.81:12356] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.outofthebluephotography.com"] [uri "/admin/.env"] [unique_id "acpSQF0Z7sFRFH__w1WYhwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 06:43:13
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 02:43:04.382307 2026] [security2:error] [pid 15723:tid 15723] [client 172.70.135.81:12263] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.curriergallery.com"] [uri "/config/.env"] [unique_id "acobeEOmvyq1WwOoen0pIQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-03-30 03:06:51
(3 months ago)
Scanning/Probing (15)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-30 02:03:27
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 22:03:20.874088 2026] [security2:error] [pid 1426:tid 1426] [client 172.70.135.81:13342] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.bandpd.com"] [uri "/.env.local.backup"] [unique_id "acnZ6CAap3FYoiTvV4i_MgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-29 22:53:29
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 18:53:24.578083 2026] [security2:error] [pid 21997:tid 21997] [client 172.70.135.81:10598] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.eran.construction"] [uri "/web/.env"] [unique_id "acmtZJTw6hb9t_qB-FPqBQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-29 21:34:41
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 17:34:31.730145 2026] [security2:error] [pid 6320:tid 6337] [client 172.70.135.81:11688] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.mylordsday.com"] [uri "/public/.env"] [unique_id "acma59lbJZZkgCFXL-A-EwAAAU8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-29 21:16:29
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 17:16:25.436141 2026] [security2:error] [pid 23386:tid 23386] [client 172.70.135.81:9910] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.boatpeople.org"] [uri "/.env_settings"] [unique_id "acmWqZM03PjgJkrE_wpuFwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-07-26 04:05:24
(1 year ago)
wp admin page access attempt
...
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-06-03 21:17:23
(1 year ago)
(mod_security) mod_security (id:240335) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 03 17:17:19.852761 2025] [security2:error] [pid 1681559:tid 1681559] [client 172.70.135.81:15140] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 5.161.42.79 (+1 hits since last alert)|cloudex.click|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "cloudex.click"] [uri "/xmlrpc.php"] [unique_id "aD9mX5T2hnK0845QoG-VqwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-27 18:38:58
(1 year ago)
(mod_security) mod_security (id:240000) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240000) triggered by 172.70.135.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 27 14:38:53.937215 2025] [security2:error] [pid 812653:tid 812653] [client 172.70.135.81:33558] [client 172.70.135.81] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/24_Apps_Joomla.conf"] [line "87"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||easy-byte.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "easy-byte.net"] [uri "/images/stories/admin-post.php"] [unique_id "aDYGvWi_jDPLCxJHk2EragAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack