🇧🇬
Stoyko Stoykov
2026-11-06 20:49:12
UTC ·
(2 days ago)
172.70.243.70 - - [06/Nov/2026:22:49:12 +0200] "GET /.well-known/security.txt HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Safari/605.1.15"
...
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 19:44:33
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.243.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 14:44:26.272524 2026] [security2:error] [pid 16173:tid 16173] [client 172.70.243.70:11113] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.243.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 14:44:26.272524 2026] [security2:error] [pid 16173:tid 16173] [client 172.70.243.70:11113] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gaudensinnovo.com"] [uri "/.htaccess"] [unique_id "au4uGp6iFyMwqOznZSxAEQAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-11-03 02:29:28
UTC ·
(6 days ago)
Web App Attack
2026-11-01 20:28:57
UTC ·
(1 week ago)
MikroTik Enterprise Honeypot
Port Scan
🇺🇸
TPI-Abuse
2026-11-01 09:32:11
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.70.243.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 04:32:06.547997 2026] [security2:error] [pid 15267:tid 15267] [client 172.70.243.70:10118] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.243.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 04:32:06.547997 2026] [security2:error] [pid 15267:tid 15267] [client 172.70.243.70:10118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lovestuff.net"] [uri "/wp-config.php.bak"] [unique_id "aucHFvHY5wNCOsBiOgDf8AAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-30 11:39:40
UTC ·
(1 week ago)
Multiple WAF Violations
Web App Attack
🇩🇪
FeG Deutschland
2026-10-24 02:05:27
UTC ·
(2 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 12
Exploited Host
Web App Attack
🇫🇷
dynamix
2026-10-20 11:53:12
UTC ·
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 14:58:38
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.243.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:58:29.956869 2026] [security2:error] [pid 29846:tid 29846] [client 172.70.243.70:9729] Mo ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.243.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:58:29.956869 2026] [security2:error] [pid 29846:tid 29846] [client 172.70.243.70:9729] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||boatmoldremover.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "boatmoldremover.com"] [uri "/dump.sql"] [unique_id "atTelYLi4m3Lq1QhJCh1UQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:24:29
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.243.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:24:24.883262 2026] [security2:error] [pid 24707:tid 24707] [client 172.70.243.70:10957] M ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.243.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:24:24.883262 2026] [security2:error] [pid 24707:tid 24707] [client 172.70.243.70:10957] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||casadelsolmexico.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "casadelsolmexico.net"] [uri "/rezerv.sql"] [unique_id "atQt2D5XzohA4uBj-312zQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:59:51
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.243.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:59:44.348185 2026] [security2:error] [pid 14857:tid 14857] [client 172.70.243.70:12313] M ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.243.70 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:59:44.348185 2026] [security2:error] [pid 14857:tid 14857] [client 172.70.243.70:12313] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.blackriverarc.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.blackriverarc.org"] [uri "/rezerv.sql"] [unique_id "atQL8MkmMDCujziWegXckQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇬
Stoyko Stoykov
2026-10-17 19:44:40
UTC ·
(3 weeks ago)
172.70.243.70 - - [17/Oct/2026:22:44:40 +0300] "GET /.env HTTP/1.1" 301 162 "-" "-"
...
Hacking
Web App Attack
🇩🇪
updown.io
2026-10-16 14:12:13
UTC ·
(3 weeks ago)
{"level":"info","ts":1792159655.8718743,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.243.70","remote_port":"15131","client_ip":"172.70.243.70","proto":"HTTP/1.1","method":"GET","host":"status.clay.earth","uri ...
show more
{"level":"info","ts":1792159655.8718743,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.243.70","remote_port":"15131","client_ip":"172.70.243.70","proto":"HTTP/1.1","method":"GET","host":"status.clay.earth","uri":"//u/docs%3f%0apizza:pizza=pizza","headers":{"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream;q=0.9,*/*;q=0.8"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"],"Connection":["Keep-Alive"],"Cf-Ipcountry":["DE"],"Cf-Visitor":["{\"scheme\":\"http\"}"],"Cf-Connecting-Ip":["46.101.240.176"],"Accept-Language":["en-US,en;q=0.5"],"Cf-Ray":["a4b7a1790dd69f23-FRA"],"X-Forwarded-Proto":["http"],"X-Forwarded-For":["46.101.240.176"],"Cdn-Loop":["cloudflare; loops=1"],"Accept-Encoding":["gzip"]}},"bytes_read":0,"user_id":"","duration":0.000066156,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Locati
...
show less
DDoS Attack
Web App Attack
🇺🇸
craudiovizai
2026-10-16 12:30:36
UTC ·
(3 weeks ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
Web App Attack
Bad Web Bot
🇫🇷
dynamix
2026-10-14 17:00:12
UTC ·
(3 weeks ago)
Multiple WAF Violations
Web App Attack
