🇺🇸
TPI-Abuse
2026-10-18 14:24:47
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:24:42.871981 2026] [security2:error] [pid 5363:tid 5363] [client 172.70.247.52:9383] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||webjemm.net|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "webjemm.net"] [uri "/admin/config.php.bak"] [unique_id "atTWqgidcEVPHCTx7xyw6wAAAFE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FD-IX
2026-10-18 07:12:05
(13 hours ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 03:35:56
(16 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 23:35:52.206577 2026] [security2:error] [pid 31281:tid 31281] [client 172.70.247.52:12755] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||heavenonearthonline.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "heavenonearthonline.net"] [uri "/database.sql"] [unique_id "atQ-mLSwsm1iTLcYpMI49gAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 02:34:40
(17 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 22:34:30.458046 2026] [security2:error] [pid 28187:tid 28187] [client 172.70.247.52:9953] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||register-yacht-hong-kong.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "register-yacht-hong-kong.com"] [uri "/db.sql"] [unique_id "atQwNhTLFtaWJ0CUgEDZywAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 18:48:11
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 14:48:05.439681 2026] [security2:error] [pid 10465:tid 10465] [client 172.70.247.52:9544] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ofertasdetrabajosyempleos.com.creartest.com"] [uri "/.git/config"] [unique_id "as_OZRIWmcRtqW5w-FdOlAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 10:23:26
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 06:23:20.520208 2026] [security2:error] [pid 20402:tid 20402] [client 172.70.247.52:9805] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||hillconsultants.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "hillconsultants.com"] [uri "/hillconsultants.sql"] [unique_id "as9YGP3qh-Qi8You3lXbBAAAAEI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-10 20:12:02
(1 week ago)
Blocked by siteaihub.com: auto: matched prefix:/wp-admin/install.php
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-10 19:42:36
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 15:42:28.734043 2026] [security2:error] [pid 28449:tid 28449] [client 172.70.247.52:13379] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "representacionesthompson.com"] [uri "/.git/config"] [unique_id "asqVJDAhRV2PC7uLPdkCfAAAAFA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-10-10 16:44:20
(1 week ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ba ...
show more
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
show less
Hacking
Web App Attack
🇺🇸
TIScore
2026-10-10 11:25:54
(1 week ago)
Automated web attack / probing. Signals: Admin-panel scan; Foreign script extension; Unexpected path ...
show more
Automated web attack / probing. Signals: Admin-panel scan; Foreign script extension; Unexpected path. Last path: /wp-admin/install.php
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-05 14:35:11
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.52 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.52 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 10:35:04.168577 2026] [security2:error] [pid 11191:tid 11191] [client 172.70.247.52:11896] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.timeless-supercars.com"] [uri "/.git/config"] [unique_id "asO1mEx3sP6vRb3tOsMPNgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-10-05 02:05:27
(1 week ago)
Web App Attack
🇩🇪
Lino Project
2026-09-26 14:33:06
(3 weeks ago)
172.70.247.52 - - [26/Sep/2026:16:33:05 +0200] "GET /config.json HTTP/2.0" 403 46 "-" "Mozilla/5.0 ( ...
show more
172.70.247.52 - - [26/Sep/2026:16:33:05 +0200] "GET /config.json HTTP/2.0" 403 46 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3 Safari/605.1.15"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-09-12 12:29:34
(1 month ago)
{"level":"info","ts":1789216078.376697,"logger":"http.log.access.log1","msg":"handled request","requ ...
show more
{"level":"info","ts":1789216078.376697,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.247.52","remote_port":"19568","client_ip":"172.70.247.52","proto":"HTTP/2.0","method":"GET","host":"status.clay.earth","uri":"/flowplayer","headers":{"X-Forwarded-Proto":["https"],"User-Agent":["Mozilla/5.0 (Windows Phone 10.0; Android 6.0.1; Microsoft; RM-1152) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Mobile Safari/537.36 Edge/15.15254"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"Cdn-Loop":["cloudflare; loops=1"],"Cf-Ipcountry":["US"],"X-Forwarded-For":["35.233.216.164"],"Accept-Encoding":["gzip, br"],"Cf-Ray":["a39ee8c93d3be809-FRA"],"Accept":["*/*"],"Cf-Connecting-Ip":["35.233.216.164"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.clay.earth","ech":false}},"bytes_read":0,"user_id":"","duration":0.011843282,"size":11142,"status":429,"resp_headers":{"Date":["Sat, 12 Sep 2026 12:27:58 GMT"],"Conten
...
show less
DDoS Attack
Web App Attack
🇧🇪
madeit
2026-09-03 06:41:45
(1 month ago)
Web App Attack
