🇺🇸
TPI-Abuse
2026-10-18 14:06:30
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.70.242.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.242.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:06:26.933814 2026] [security2:error] [pid 29416:tid 29416] [client 172.70.242.36:11386] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||drstiso.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "drstiso.com"] [uri "/database.sql"] [unique_id "atTSYtSmU-PZbYr1BFWqIgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
iNetWorker
2026-10-18 12:26:48
(1 day ago)
trolling for resource vulnerabilities
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 11:41:43
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.70.242.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.242.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:41:36.224704 2026] [security2:error] [pid 31165:tid 31165] [client 172.70.242.36:12111] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||hillcrest.us|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "hillcrest.us"] [uri "/hillcrest.sql"] [unique_id "atSwcNmFEXbEIsqOqigq3gAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
todix
2026-10-18 06:52:49
(1 day ago)
"GET /admin/config.php.bak HTTP/1.1" 403 6537 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) A ...
show more
"GET /admin/config.php.bak HTTP/1.1" 403 6537 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
show less
Web App Attack
🇮🇩
securejdprop
2026-10-18 00:47:04
(1 day ago)
This IP was detected by CrowdSec triggering custom/vpatch-bad-cloudflare.
Hacking
🇫🇷
dynamix
2026-10-17 23:31:31
(1 day ago)
Multiple WAF Violations
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-17 19:57:01
(1 day ago)
[17/Oct/2026:22:56:56 +0300] -- 172.70.242.36 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET / ...
show more
[17/Oct/2026:22:56:56 +0300] -- 172.70.242.36 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /rezerv.zip HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-15 01:05:59
(4 days ago)
[15/Oct/2026:04:05:56 +0300] -- 172.70.242.36 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET / ...
show more
[15/Oct/2026:04:05:56 +0300] -- 172.70.242.36 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /ka.zip HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 01:44:45
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.242.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.242.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 21:44:38.311590 2026] [security2:error] [pid 4047:tid 4073] [client 172.70.242.36:12157] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||coloradosellers.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "coloradosellers.com"] [uri "/database.sql"] [unique_id "as7ehjexnRP4mdSnwGtmMQAAAVg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 01:07:38
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.242.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.242.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 21:07:29.529201 2026] [security2:error] [pid 9256:tid 9256] [client 172.70.242.36:13750] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kircali.net|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kircali.net"] [uri "/admin/config.php.bak"] [unique_id "as7V0WYL51a6DaUm7fSaWAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 00:50:13
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.242.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.242.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 20:50:05.012372 2026] [security2:error] [pid 30201:tid 30201] [client 172.70.242.36:10044] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||redwingboot.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "redwingboot.com"] [uri "/config.php.bak"] [unique_id "as7RvaGtNiQhkfKxFSMrjAAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 22:01:07
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.242.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.242.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 18:01:01.809635 2026] [security2:error] [pid 1694:tid 1694] [client 172.70.242.36:12422] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||taltonfamily.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "taltonfamily.com"] [uri "/admin/config.php.bak"] [unique_id "as6qHe7nfeb0NM3jT-pOsQAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-02 09:11:48
(2 weeks ago)
Web Probe / Attack
Web App Attack
🇧🇪
madeit
2026-10-01 13:06:08
(2 weeks ago)
Web App Attack
🇫🇷
dynamix
2026-09-30 15:43:00
(2 weeks ago)
Multiple WAF Violations
Web App Attack
