🇫🇷
dynamix
2026-10-20 21:10:18
(18 hours ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 11:46:14
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.230 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.230 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:46:09.940429 2026] [security2:error] [pid 20146:tid 20146] [client 172.70.247.230:12606] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||dhappraisalservices.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dhappraisalservices.com"] [uri "/dhappraisalservices.sql"] [unique_id "atSxgfrbwQo0q0hyY1LTrAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 09:53:13
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.230 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.230 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 05:53:08.218290 2026] [security2:error] [pid 28485:tid 28485] [client 172.70.247.230:9761] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||whitetaildetailing.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "whitetaildetailing.com"] [uri "/whitetaildetailing.com.sql"] [unique_id "atSXBHWVLga4OvuORzrQHAAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 06:35:07
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.230 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.230 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:35:01.434697 2026] [security2:error] [pid 6910:tid 6910] [client 172.70.247.230:10123] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.riedmannfamily.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.riedmannfamily.com"] [uri "/riedmannfamily.sql"] [unique_id "atRolQY9HMJIM7sKjmO3igAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-10-18 05:13:43
(3 days ago)
[Sun Oct 18 16:13:42.223941 2026] [security2:error] [pid 891816] [client 172.70.247.230:12006] [clie ...
show more
[Sun Oct 18 16:13:42.223941 2026] [security2:error] [pid 891816] [client 172.70.247.230:12006] [client 172.70.247.230] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "valueaddedpromotions.com.au"] [uri "/database.sql"] [unique_id "atRVhvUX6XeF3WTQqurEzAAAADY"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 04:56:31
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.230 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.230 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 00:56:25.151897 2026] [security2:error] [pid 30704:tid 30704] [client 172.70.247.230:10777] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bigpanda.expert|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bigpanda.expert"] [uri "/rezerv.sql"] [unique_id "atRReRP-eiihqyFS3HxG8AAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-18 03:52:02
(3 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:48:39
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.230 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.230 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:48:35.609428 2026] [security2:error] [pid 16632:tid 16697] [client 172.70.247.230:11268] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||lesleyhcampbell.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lesleyhcampbell.com"] [uri "/dump.sql"] [unique_id "atQzgxs7Whj4i0-8fRPEhwAAAEk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 00:23:58
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.230 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.230 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:23:51.376112 2026] [security2:error] [pid 24214:tid 24214] [client 172.70.247.230:13610] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sanvayu.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sanvayu.com"] [uri "/config.php.bak"] [unique_id "atQRl9zWSliAGuklEIo_sQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-17 21:45:16
(3 days ago)
[18/Oct/2026:00:45:13 +0300] -- 172.70.247.230 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[18/Oct/2026:00:45:13 +0300] -- 172.70.247.230 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /kpi.zip HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇹🇷
crnpekgoz
2026-10-15 17:00:00
(5 days ago)
Malicious HTTP GET request for '/.env.old' (HTTP 404) from 172.70.247.230. Threat: Web Güvenlik Açığ ...
show more
Malicious HTTP GET request for '/.env.old' (HTTP 404) from 172.70.247.230. Threat: Web Güvenlik Açığı Taraması (.env/bot). Blocked by WardenGuard Web Shield.
show less
Web App Attack
🇹🇷
crnpekgoz
2026-10-15 14:59:50
(6 days ago)
Malicious HTTP GET request for '/config.json' (HTTP 404) from 172.70.247.230. Threat: Web Güvenlik A ...
show more
Malicious HTTP GET request for '/config.json' (HTTP 404) from 172.70.247.230. Threat: Web Güvenlik Açığı Taraması (.env/bot). Blocked by WardenGuard Web Shield.
show less
Web App Attack
🇺🇸
craudiovizai
2026-10-15 12:30:39
(6 days ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. ...
show more
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
show less
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-14 04:54:06
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.230 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.230 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 00:54:01.587926 2026] [security2:error] [pid 7189:tid 7189] [client 172.70.247.230:13449] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||prcomputersolutions.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "prcomputersolutions.com"] [uri "/database.sql"] [unique_id "as8K6Wb5VaodSkk0H1E_MgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-14 03:26:54
(1 week ago)
[14/Oct/2026:03:59:54 +0300] -- 172.70.247.230 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[14/Oct/2026:03:59:54 +0300] -- 172.70.247.230 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /kpi.zip HTTP/1.1
show less
Bad Web Bot
Web App Attack
