🇨🇭
zynex
2026-10-24 21:19:24
(19 hours ago)
URL Probing: /index.php
Web App Attack
🇨🇭
TheCoon
2026-10-24 16:18:24
(1 day ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-23 06:23:50
(2 days ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇫🇷
dynamix
2026-10-21 10:39:22
(4 days ago)
Multiple WAF Violations
Web App Attack
🇨🇭
TheCoon
2026-10-21 06:45:45
(4 days ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
2026-10-18 19:31:06
(6 days ago)
IP matched detection query many 3xx errors.
Brute-Force
🇺🇸
TPI-Abuse
2026-10-18 08:11:48
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.38 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 04:11:43.609991 2026] [security2:error] [pid 18277:tid 18277] [client 172.70.247.38:13248] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||pembrokefinance.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pembrokefinance.com"] [uri "/database.sql"] [unique_id "atR_PzvriitsGHz2e_XdxgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 06:47:04
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.38 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:47:00.609865 2026] [security2:error] [pid 31587:tid 31587] [client 172.70.247.38:13477] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||hjaltihjalmarsson.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "hjaltihjalmarsson.com"] [uri "/dump.sql"] [unique_id "atRrZF6oUTH1TYQ0cy3PNgAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 05:23:39
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.38 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 01:23:32.169442 2026] [security2:error] [pid 14437:tid 14437] [client 172.70.247.38:10657] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ultrakid.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ultrakid.com"] [uri "/ultrakid.com.sql"] [unique_id "atRX1MHmdKPiW8gRqa8RPAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 04:17:58
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.38 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 00:17:54.776667 2026] [security2:error] [pid 15118:tid 15118] [client 172.70.247.38:10725] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||simcorr.com|F|2"] [data ".com.sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "simcorr.com"] [uri "/simcorr.com.sql"] [unique_id "atRIcrhgju95kwNBA_0E4wAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-18 02:02:08
(1 week ago)
[18/Oct/2026:05:02:08 +0300] -- 172.70.247.38 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET / ...
show more
[18/Oct/2026:05:02:08 +0300] -- 172.70.247.38 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /dump.sql HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 01:00:06
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.38 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:59:55.595295 2026] [security2:error] [pid 10835:tid 10835] [client 172.70.247.38:11463] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||dunbeggan.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dunbeggan.com"] [uri "/backup.sql"] [unique_id "atQaC1SuUAbHYETiYMlKTAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-17 01:01:37
(1 week ago)
Multiple WAF Violations
Web App Attack
🇫🇷
dynamix
2026-10-14 12:32:58
(1 week ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 03:27:42
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.38 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.38 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:27:34.867884 2026] [security2:error] [pid 30702:tid 30719] [client 172.70.247.38:10207] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||dubaihedgefund.com.aafm.us|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dubaihedgefund.com.aafm.us"] [uri "/aafm.sql"] [unique_id "as72ph1Tr_e8rS4mRl1P3wAAAE4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
