🇧🇪
madeit
2026-08-27 08:40:45
(3 weeks ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-08-18 23:58:04
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 18 19:57:56.296588 2026] [security2:error] [pid 9679:tid 9679] [client 172.70.175.52:10099] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.gescosigns.com"] [uri "/.git/config"] [unique_id "aoTxhA9R-bjBb6kTry3E5gAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-08-15 22:43:30
(1 month ago)
Web App Attack
2026-04-08 04:19:12
(5 months ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-04-07 11:25:07
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 07 07:24:59.825081 2026] [security2:error] [pid 1032418:tid 1032418] [client 172.70.175.52:11132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.title36.com"] [uri "/core/.env"] [unique_id "adTpi9ak-lGfIt1kca9tZAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-07 00:01:41
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 20:01:27.648003 2026] [security2:error] [pid 702640:tid 702640] [client 172.70.175.52:11960] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.bitcoinpornhub.com"] [uri "/admin/.env"] [unique_id "adRJV2gWRKy1oglY4EpfugAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
pinguin
2026-04-06 06:15:39
(5 months ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: LOG
Protocol: HTTP/2 (GET method)
...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: LOG
Protocol: HTTP/2 (GET method)
Endpoint: /@fs/etc/passwd
UA: Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-04-05 09:02:35
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 05:02:19.688511 2026] [security2:error] [pid 4358:tid 4358] [client 172.70.175.52:10942] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.lucid-hq.com"] [uri "/.env.bak"] [unique_id "adIlG7pCJGbum-EPhh7OsQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 20:32:20
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 16:32:12.976682 2026] [security2:error] [pid 9056:tid 9107] [client 172.70.175.52:11938] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.jupitermaturin.com"] [uri "/.env.old"] [unique_id "adF1TB4PzY1uQnhw9O13wAAAAUo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 17:56:53
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 13:56:46.145478 2026] [security2:error] [pid 6719:tid 6719] [client 172.70.175.52:10839] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.saramics.net"] [uri "/.env_secret"] [unique_id "adFQ3gcOKSBzq1yr44bLRgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 06:26:50
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 04 02:26:40.650247 2026] [security2:error] [pid 6272:tid 6272] [client 172.70.175.52:10125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.buffaloweddingreception.com"] [uri "/core/.env"] [unique_id "adCvIBPu8itFGbI25AE9TgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 02:26:18
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 22:26:10.234307 2026] [security2:error] [pid 6954:tid 6954] [client 172.70.175.52:9714] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fluff.thewaywework.com"] [uri "/.env.production"] [unique_id "adB2wph9CgLjJeR-NFDwsAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 17:35:36
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 13:35:33.525364 2026] [security2:error] [pid 3311:tid 3311] [client 172.70.175.52:9994] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "web-sitebuilder.com.convoyforkids.com"] [uri "/.env.local.backup"] [unique_id "ac_6ZXWn_QO1A6iFp46nJQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 17:06:22
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 13:06:13.614569 2026] [security2:error] [pid 18211:tid 18211] [client 172.70.175.52:10696] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.arcadiapropertiesllc.com"] [uri "/core/.env"] [unique_id "ac_zhR_hRUDFQpNpmwtTuQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-03 12:36:14
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.175.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 08:36:07.434765 2026] [security2:error] [pid 1818:tid 1818] [client 172.70.175.52:13571] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.uraniumjewelry.com"] [uri "/.env.production.bak"] [unique_id "ac-0N3bdwNj8eMOu8FXJXQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
