🇺🇸
TPI-Abuse
2026-11-11 05:08:04
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 00:07:56.973366 2026] [security2:error] [pid 30478:tid 30494] [client 172.70.247.239:12108] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 00:07:56.973366 2026] [security2:error] [pid 30478:tid 30494] [client 172.70.247.239:12108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hylakaplan.com"] [uri "/wp-config.php.save"] [unique_id "avP4LItxRZtlqRElTrWuQAAAAQ0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
MarkGGN
2026-11-11 01:48:18
UTC ·
(8 hours ago)
Web attack. 172.70.247.239 - - [11/Nov/2026:02:48:14 +0100] "GET /[HOST] HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0" 172.70.247.239 - - [11/Nov/20 ...
show more
Web attack. 172.70.247.239 - - [11/Nov/2026:02:48:14 +0100] "GET /[HOST] HTTP/2.0" 404 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0" 172.70.247.239 - - [11/Nov/2026:02:48:17 +0100] "GET /[HOST] HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 13:36:40
UTC ·
(20 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 08:36:36.175391 2026] [security2:error] [pid 20035:tid 20035] [client 172.70.247.239:11533] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 08:36:36.175391 2026] [security2:error] [pid 20035:tid 20035] [client 172.70.247.239:11533] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.videoverse.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.videoverse.com"] [uri "/index.php.bak"] [unique_id "avMd5JVImJ7gGB9SJT6EYAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 04:06:19
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 23:06:10.371790 2026] [security2:error] [pid 4854:tid 4854] [client 172.70.247.239:9480] Mo ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 23:06:10.371790 2026] [security2:error] [pid 4854:tid 4854] [client 172.70.247.239:9480] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sdwsk8.com"] [uri "/wp-config.php.old"] [unique_id "avKYMiG4PN7DBIofldtBzQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-05 19:14:03
UTC ·
(5 days ago)
IP matched detection query many 3xx errors.
Brute-Force
🇺🇸
TPI-Abuse
2026-11-02 21:03:07
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 16:03:03.740302 2026] [security2:error] [pid 11214:tid 11214] [client 172.70.247.239:12096] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 16:03:03.740302 2026] [security2:error] [pid 11214:tid 11214] [client 172.70.247.239:12096] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rendermatrix.com"] [uri "/.env.production"] [unique_id "auj6h8JKYMSCtBuV0uHKZQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
todix
2026-10-24 19:16:22
UTC ·
(2 weeks ago)
"GET /.git/config HTTP/1.1" 403 6537 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:127.0) Gecko/20100101 Firefox/127.0"
Web App Attack
🇩🇪
4server
2026-10-23 01:52:54
UTC ·
(2 weeks ago)
[FriOct2303:52:51.2009812026][security2:error][pid1955936:tid1956075][client172.70.247.239:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\ ...
show more
[FriOct2303:52:51.2009812026][security2:error][pid1955936:tid1956075][client172.70.247.239:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"special-home.ch\"][uri\"/xmlrpc.php\"][unique_id\"atq98yDXj86LhPKxYT5ArwAAANQ\"]
show less
Port Scan
Brute-Force
Web App Attack
🇩🇪
updown.io
2026-10-18 18:44:23
UTC ·
(3 weeks ago)
{"level":"info","ts":1792348900.327302,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.247.239","remote_port":"18177","client_ip":"172.70.247.239","proto":"HTTP/1.1","method":"GET","host":"status.clay.earth","ur ...
show more
{"level":"info","ts":1792348900.327302,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.247.239","remote_port":"18177","client_ip":"172.70.247.239","proto":"HTTP/1.1","method":"GET","host":"status.clay.earth","uri":"/metrics/stats;%0apizza:pizza=pizza.json","headers":{"Cdn-Loop":["cloudflare; loops=1"],"Cf-Connecting-Ip":["152.42.214.218"],"X-Forwarded-Proto":["http"],"User-Agent":["Mozilla/5.0 (iPhone; CPU iPhone OS 17_2_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Mobile/15E148 Safari/604.1"],"Accept-Encoding":["gzip"],"Cf-Ipcountry":["SG"],"Cf-Visitor":["{\"scheme\":\"http\"}"],"Accept-Language":["en-US,en;q=0.5"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,application/octet-stream;q=0.9,*/*;q=0.8"],"Connection":["Keep-Alive"],"X-Forwarded-For":["152.42.214.218"],"Cf-Ray":["a4c9adb27b74fce4-FRA"]}},"bytes_read":0,"user_id":"","duration":0.000069522,"size":0,"status":308,"resp_headers":{"Server":["Ca
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 11:13:30
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:13:24.821148 2026] [security2:error] [pid 779:tid 779] [client 172.70.247.239:10902] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 07:13:24.821148 2026] [security2:error] [pid 779:tid 779] [client 172.70.247.239:10902] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.cbcfargo.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.cbcfargo.com"] [uri "/cbcfargo.com.sql"] [unique_id "atSp1ONqv2skv5OEbsAizgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-18 08:16:59
UTC ·
(3 weeks ago)
[18/Oct/2026:11:16:58 +0300] -- 172.70.247.239 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /znpfizmat.zip HTTP/1.1
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 06:33:56
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:33:47.069435 2026] [security2:error] [pid 8653:tid 8653] [client 172.70.247.239:10073] M ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:33:47.069435 2026] [security2:error] [pid 8653:tid 8653] [client 172.70.247.239:10073] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.flutepraise.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.flutepraise.com"] [uri "/rezerv.sql"] [unique_id "atRoSxMzmE2vPZb6uLIExQAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 00:28:03
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:27:55.638366 2026] [security2:error] [pid 9351:tid 9351] [client 172.70.247.239:9996] Mo ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:27:55.638366 2026] [security2:error] [pid 9351:tid 9351] [client 172.70.247.239:9996] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||snickerifabrik.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "snickerifabrik.com"] [uri "/rezerv.sql"] [unique_id "atQSi-mvS9CIHLF7MfK16QAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
i-turnradio.nl
2026-10-17 22:18:54
UTC ·
(3 weeks ago)
2026-10-18 @ 00:18:50 (CET) ~ Blocked for trying to access: /wp-content/plugins/bricksforge/readme.txt
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 22:09:55
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:09:48.431558 2026] [security2:error] [pid 13783:tid 13783] [client 172.70.247.239:13630] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:09:48.431558 2026] [security2:error] [pid 13783:tid 13783] [client 172.70.247.239:13630] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.pscc.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.pscc.com"] [uri "/admin/config.php.bak"] [unique_id "atPyLF6yT7J_TYVP17nl0wAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
