🇺🇸
TPI-Abuse
2026-11-10 09:31:13
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:31:07.118769 2026] [security2:error] [pid 13626:tid 13626] [client 172.70.247.194:11199] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:31:07.118769 2026] [security2:error] [pid 13626:tid 13626] [client 172.70.247.194:11199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.sarahpeebles.net"] [uri "/wp-config.php.bak"] [unique_id "avLkW334c0nbO8G-Jldl0wAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 03:46:52
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 22:46:45.833437 2026] [security2:error] [pid 22672:tid 22672] [client 172.70.247.194:10842] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 22:46:45.833437 2026] [security2:error] [pid 22672:tid 22672] [client 172.70.247.194:10842] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "onlinesuretybonds.com"] [uri "/wp-config.php"] [unique_id "avKTpXr_UDAL-b1BvOKlfAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
bohl-aiG5aef
2026-11-09 21:29:34
UTC ·
(2 days ago)
Suricata Alert [SID:2019526] ET WEB_SERVER WEB-PHP phpinfo access
Web App Attack
🇩🇪
updown.io
2026-11-07 02:24:43
UTC ·
(5 days ago)
{"level":"info","ts":1794018283.2201872,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.247.194","remote_port":"9399","client_ip":"172.70.247.194","proto":"HTTP/1.1","method":"GET","host":"status.getreward.io"," ...
show more
{"level":"info","ts":1794018283.2201872,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.247.194","remote_port":"9399","client_ip":"172.70.247.194","proto":"HTTP/1.1","method":"GET","host":"status.getreward.io","uri":"/byp8.php","headers":{"Connection":["Keep-Alive"],"Cf-Ray":["a568e21dcad1241d-FRA"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"X-Forwarded-Proto":["https"],"Cdn-Loop":["cloudflare; loops=1"],"Accept-Encoding":["gzip, br"],"Cf-Connecting-Ip":["52.179.208.167"],"X-Forwarded-For":["52.179.208.167"],"Cf-Ipcountry":["US"]}},"bytes_read":0,"user_id":"","duration":0.000060045,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://status.getreward.io/byp8.php"],"Content-Type":[]}}
...
show less
DDoS Attack
Web App Attack
🇫🇷
dynamix
2026-11-05 19:25:20
UTC ·
(6 days ago)
Multiple WAF Violations
Web App Attack
🇧🇪
madeit
2026-11-04 13:19:10
UTC ·
(1 week ago)
Web App Attack
🇫🇷
dynamix
2026-11-02 11:02:32
UTC ·
(1 week ago)
Multiple WAF Violations
Web App Attack
🇺🇸
EmilGH
2026-10-22 14:30:56
UTC ·
(2 weeks ago)
172.70.247.194 - - [22/Oct/2026:14:30:54 +0000] "GET /billing HTTP/1.1" 403 2146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
172.70.247.194 - - [22/Oct/2026:14:30:54 +000 ...
show more
172.70.247.194 - - [22/Oct/2026:14:30:54 +0000] "GET /billing HTTP/1.1" 403 2146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
172.70.247.194 - - [22/Oct/2026:14:30:54 +0000] "GET /register HTTP/1.1" 403 2146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
172.70.247.194 - - [22/Oct/2026:14:30:54 +0000] "GET /users/login HTTP/1.1" 403 2146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
172.70.247.194 - - [22/Oct/2026:14:30:54 +0000] "GET /dmj16rc2rh8eybwt6xnp HTTP/1.1" 403 2146 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"
172.70.247.194 - - [22/Oct/2026:14:30:54 +0000] "GET /secure HTTP/1.1" 403 2146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) C
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 17:51:34
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 13:51:30.241738 2026] [security2:error] [pid 27065:tid 27065] [client 172.70.247.194:11683] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 13:51:30.241738 2026] [security2:error] [pid 27065:tid 27065] [client 172.70.247.194:11683] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dreamlikeitmatters.whatifandwhynot.xyz"] [uri "/.git/config"] [unique_id "atj7oqvxIk6yFjyuYbzelQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 14:34:30
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:34:25.437292 2026] [security2:error] [pid 15312:tid 15312] [client 172.70.247.194:10075] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:34:25.437292 2026] [security2:error] [pid 15312:tid 15312] [client 172.70.247.194:10075] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||4azadi.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "4azadi.org"] [uri "/rezerv.sql"] [unique_id "atTY8YlKGIcRcJIz_ZlgyAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 11:41:09
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:41:00.911378 2026] [security2:error] [pid 30972:tid 30972] [client 172.70.247.194:11778] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:41:00.911378 2026] [security2:error] [pid 30972:tid 30972] [client 172.70.247.194:11778] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mikeloehr.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mikeloehr.com"] [uri "/mikeloehr.com.sql"] [unique_id "atSwTFbS0Hk0D5Bw8tw11wAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 05:18:57
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 01:18:50.062098 2026] [security2:error] [pid 18879:tid 18879] [client 172.70.247.194:11580] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 01:18:50.062098 2026] [security2:error] [pid 18879:tid 18879] [client 172.70.247.194:11580] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||brittaniaenterprises.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "brittaniaenterprises.com"] [uri "/db.sql"] [unique_id "atRWuhjyr76yIyc2YRh-VwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:33:29
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:33:21.297278 2026] [security2:error] [pid 27709:tid 27709] [client 172.70.247.194:10100] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:33:21.297278 2026] [security2:error] [pid 27709:tid 27709] [client 172.70.247.194:10100] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||suedblick.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "suedblick.com"] [uri "/admin/config.php.bak"] [unique_id "atQFwRYcQRmGZMcpwcBsZwAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:18:08
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:17:58.913488 2026] [security2:error] [pid 17187:tid 17187] [client 172.70.247.194:12059] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:17:58.913488 2026] [security2:error] [pid 17187:tid 17187] [client 172.70.247.194:12059] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||eatinnola.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "eatinnola.com"] [uri "/eatinnola.sql"] [unique_id "atQCJmRqpeJN2I16J9Ld6AAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:53:15
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:53:11.850600 2026] [security2:error] [pid 3446:tid 3446] [client 172.70.247.194:13465] M ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.194 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:53:11.850600 2026] [security2:error] [pid 3446:tid 3446] [client 172.70.247.194:13465] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.naturalhomebuilders.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.naturalhomebuilders.com"] [uri "/config.php.bak"] [unique_id "atPgN1wY-7nJDc0HX2hwhgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
