🇺🇸
TPI-Abuse
2026-10-18 05:18:53
(2 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 01:18:48.483930 2026] [security2:error] [pid 17469:tid 17469] [client 172.70.247.246:9653] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||brittaniaenterprises.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "brittaniaenterprises.com"] [uri "/backup.sql"] [unique_id "atRWuGOPzB3tTZTFnGpLtwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-10-18 03:26:34
(4 hours ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:55:16
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:55:08.782733 2026] [security2:error] [pid 1746:tid 1762] [client 172.70.247.246:10799] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||honeyled.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "honeyled.com"] [uri "/admin/config.php.bak"] [unique_id "atQ1DIeBDb6akmnsCJeYgwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 01:56:41
(6 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 21:56:36.260398 2026] [security2:error] [pid 29606:tid 29606] [client 172.70.247.246:12422] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||unionega.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "unionega.com"] [uri "/rezerv.sql"] [unique_id "atQnVFDsYcRh8vEBmz-YYwAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 01:03:37
(6 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 21:03:30.202648 2026] [security2:error] [pid 19258:tid 19258] [client 172.70.247.246:11778] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||blog.post-therapyreconditioning.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blog.post-therapyreconditioning.com"] [uri "/rezerv.sql"] [unique_id "atQa4qMBPhCOvyGophwyuwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-10-17 23:48:32
(8 hours ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:18:09
(8 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:18:03.518277 2026] [security2:error] [pid 6669:tid 6669] [client 172.70.247.246:9510] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.comobarbershop.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.comobarbershop.com"] [uri "/admin/config.php.bak"] [unique_id "atQCK439SZWD4B0uyDGFuAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 21:07:26
(10 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 17:07:20.495396 2026] [security2:error] [pid 29864:tid 29864] [client 172.70.247.246:10772] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sunnygolfvillas.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sunnygolfvillas.com"] [uri "/sunnygolfvillas.sql"] [unique_id "atPjiCauWcMBugGnxtHcsAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
spot
2026-10-17 20:48:36
(11 hours ago)
172.70.247.246 - - [17/Oct/2026:21:48:35 +0100] "GET /wp-content/plugins/woocommerce/readme.txt HTTP ...
show more
172.70.247.246 - - [17/Oct/2026:21:48:35 +0100] "GET /wp-content/plugins/woocommerce/readme.txt HTTP/1.1" 404 543 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0"
...
show less
Web App Attack
Hacking
🇺🇸
anon333
2026-10-17 20:06:10
(11 hours ago)
Invalid probes to web server T1606
Hacking
Exploited Host
🇺🇸
TPI-Abuse
2026-10-14 21:49:43
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 17:49:39.648761 2026] [security2:error] [pid 23516:tid 23516] [client 172.70.247.246:9639] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||redondotile.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "redondotile.com"] [uri "/db.sql"] [unique_id "as_480eNij4BoQXdoPuHTwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 06:52:41
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 02:52:36.901237 2026] [security2:error] [pid 24333:tid 24333] [client 172.70.247.246:10958] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||st-maarten-fishing.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "st-maarten-fishing.com"] [uri "/admin/config.php.bak"] [unique_id "as8mtCLiLXLzB5zA85Ek6QAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 03:40:45
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:40:41.681589 2026] [security2:error] [pid 30948:tid 30948] [client 172.70.247.246:11715] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||drgtek.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "drgtek.com"] [uri "/database.sql"] [unique_id "as75uTo0mI0911IXMPgbwgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-14 00:42:11
(4 days ago)
[14/Oct/2026:03:42:10 +0300] -- 172.70.247.246 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET ...
show more
[14/Oct/2026:03:42:10 +0300] -- 172.70.247.246 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /com.tar.gz HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-12 09:20:30
(5 days ago)
Multiple WAF Violations
Web App Attack
