🇺🇸
francelink.fr
2026-10-18 12:34:24
(1 day ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-10-18T12:32:38.000Z.
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 10:37:42
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 06:37:33.871635 2026] [security2:error] [pid 27721:tid 27721] [client 172.70.243.109:11309] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||willowbrookins.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "willowbrookins.com"] [uri "/rezerv.sql"] [unique_id "atShbbh-8lzFb7haiHySQwAAADU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
lnklnx
2026-10-18 10:00:17
(1 day ago)
www.lincolnclan.com:80 172.70.243.109 - - [18/Oct/2026:05:00:14 -0500] "GET /admin/config.php.bak HT ...
show more
www.lincolnclan.com:80 172.70.243.109 - - [18/Oct/2026:05:00:14 -0500] "GET /admin/config.php.bak HTTP/1.1" 301 623 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 03:36:43
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:36:36.447072 2026] [security2:error] [pid 5249:tid 5249] [client 172.70.243.109:10203] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sonoranwaterworks.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sonoranwaterworks.com"] [uri "/dump.sql"] [unique_id "atQ-xGHBxHBDp0i6EfZytAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 04:49:15
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 00:49:09.359003 2026] [security2:error] [pid 4533:tid 4533] [client 172.70.243.109:9447] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||thegoldreserve.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "thegoldreserve.com"] [uri "/thegoldreserve.sql"] [unique_id "as8JxWZMhSwMTxjqD9g03QAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 01:19:33
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 21:19:27.878483 2026] [security2:error] [pid 18346:tid 18346] [client 172.70.243.109:12057] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||dianamead.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dianamead.com"] [uri "/backup.sql"] [unique_id "as7Yn3qdw5LRU9H0k2BFTgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 00:35:23
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 20:35:13.416381 2026] [security2:error] [pid 11235:tid 11235] [client 172.70.243.109:13771] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ameliaschaaf.lawyer|F|2"] [data ".lawyer.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ameliaschaaf.lawyer"] [uri "/ameliaschaaf.lawyer.sql"] [unique_id "as7OQRzJYIYS3KxcNs_CFQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 23:39:26
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 19:39:22.488071 2026] [security2:error] [pid 23811:tid 23828] [client 172.70.243.109:9383] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||buy-optimum.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "buy-optimum.com"] [uri "/config.php.bak"] [unique_id "as7BKoT40-YKCJhA6wU4MQAAAMs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-05 05:06:01
(2 weeks ago)
Web App Attack
🇫🇷
dynamix
2026-10-02 08:47:02
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-09-25 14:24:11
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 25 10:24:06.004567 2026] [security2:error] [pid 14219:tid 14219] [client 172.70.243.109:14185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "haerringer.com"] [uri "/.git/config"] [unique_id "araEBlzvD4qmfZT93dFIGwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-08-10 10:56:17
(2 months ago)
Web App Attack
🇩🇪
Prodscape
2026-08-04 17:36:36
(2 months ago)
*Port Scan* detected from 172.70.243.109 (DE/Germany/-). 10 hits in the last 35 seconds; Ports: *; D ...
show more
*Port Scan* detected from 172.70.243.109 (DE/Germany/-). 10 hits in the last 35 seconds; Ports: *; Direction: in; Trigger: PS_LIMIT
show less
Port Scan
🇺🇸
TPI-Abuse
2026-05-06 23:06:55
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 19:06:44.883848 2026] [security2:error] [pid 25569:tid 25569] [client 172.70.243.109:10544] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.larsholm.com"] [uri "/.env"] [unique_id "afvJhEOrAAOOHrzHUJ5lkQAAAAk"], referer: https://www.google.com/search?q=mail.larsholm.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-05 11:07:05
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.243.109 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 05 07:06:59.129218 2026] [security2:error] [pid 9845:tid 9845] [client 172.70.243.109:9275] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mosherpit.com"] [uri "/.env.development.local"] [unique_id "afnPU3Q4qPypFgkTZWPh2AAAABw"], referer: https://www.google.com/search?q=mosherpit.com
show less
Brute-Force
Bad Web Bot
Web App Attack
