🇩🇪
updown.io
2026-11-15 16:26:25
UTC ·
(4 hours ago)
{"level":"info","ts":1794759976.9172354,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.247.7","remote_port":"16260","client_ip":"172.70.247.7","proto":"HTTP/1.1","method":"POST","host":"status.clay.earth","uri" ...
show more
{"level":"info","ts":1794759976.9172354,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.247.7","remote_port":"16260","client_ip":"172.70.247.7","proto":"HTTP/1.1","method":"POST","host":"status.clay.earth","uri":"/api/auth/login?p=Login&t=1","headers":{"Accept-Encoding":["gzip"],"Sec-User-Agent":["intelsieve"],"Content-Length":["23"],"X-Forwarded-Proto":["http"],"Connection":["Keep-Alive"],"X-Request-Purpose":["Research"],"Cf-Ray":["a5af9ddee8440766-FRA"],"Cdn-Loop":["cloudflare; loops=1"],"X-Bug-Bounty":["mikkocarreon"],"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1.1 Safari/605.1.15"],"Content-Type":["application/x-www-form-urlencoded"],"Cf-Visitor":["{\"scheme\":\"http\"}"],"X-Forwarded-For":["46.250.241.12"],"Cf-Connecting-Ip":["46.250.241.12"],"Accept":["application/json, text/plain, */*"],"Cf-Ipcountry":["AU"]}},"bytes_read":0,"user_id":"","duration":0.000191005,"size":0,"
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 04:51:59
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 23:51:53.271825 2026] [security2:error] [pid 19064:tid 19064] [client 172.70.247.7:11638] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 23:51:53.271825 2026] [security2:error] [pid 19064:tid 19064] [client 172.70.247.7:11638] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "watlab.com"] [uri "/wp-config.php.save"] [unique_id "avP0aSYJilIzHCfHDFmaJgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-11-11 00:58:17
UTC ·
(4 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 13:43:56
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 08:43:50.210674 2026] [security2:error] [pid 28724:tid 28724] [client 172.70.247.7:14171] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 08:43:50.210674 2026] [security2:error] [pid 28724:tid 28724] [client 172.70.247.7:14171] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jhollingshead.com"] [uri "/.htaccess"] [unique_id "avMflpT59tQ2LPXWYH3D5QAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 09:11:14
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:11:06.521920 2026] [security2:error] [pid 31534:tid 31534] [client 172.70.247.7:13137] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 04:11:06.521920 2026] [security2:error] [pid 31534:tid 31534] [client 172.70.247.7:13137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thingstodonude.com"] [uri "/.htaccess"] [unique_id "avLfqrrCaJJ42FddPzWAzAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 08:26:15
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:26:08.132080 2026] [security2:error] [pid 11786:tid 11786] [client 172.70.247.7:14031] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:26:08.132080 2026] [security2:error] [pid 11786:tid 11786] [client 172.70.247.7:14031] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hayrun.com"] [uri "/wp-config.php"] [unique_id "avLVIFQHb5p9sktLrQi1QgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-11-02 13:09:04
UTC ·
(1 week ago)
Web App Attack
🇨🇭
backslash
2026-10-23 16:06:00
UTC ·
(3 weeks ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-19 20:44:36
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 16:44:31.886555 2026] [security2:error] [pid 8208:tid 8208] [client 172.70.247.7:13229] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 16:44:31.886555 2026] [security2:error] [pid 8208:tid 8208] [client 172.70.247.7:13229] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "papelawfirm.anthonyanimalclinic.net"] [uri "/.git/config"] [unique_id "ataBL7NPoJXo8Y-Bi8JFoQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
Mga Admin
2026-10-18 14:35:02
UTC ·
(4 weeks ago)
172.70.247.7 - - [18/Oct/2026:21:34:59 +0700] "GET /www.zip HTTP/1.1" 403 199 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
...
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 13:19:35
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 09:19:31.564594 2026] [security2:error] [pid 17269:tid 17269] [client 172.70.247.7:13205] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 09:19:31.564594 2026] [security2:error] [pid 17269:tid 17269] [client 172.70.247.7:13205] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||cynosurephotography.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cynosurephotography.com"] [uri "/db.sql"] [unique_id "atTHY6njSuwZ2oi4xRFxDwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 20:23:08
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:23:03.221037 2026] [security2:error] [pid 28928:tid 28940] [client 172.70.247.7:13352] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 16:23:03.221037 2026] [security2:error] [pid 28928:tid 28940] [client 172.70.247.7:13352] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||jrc3.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jrc3.com"] [uri "/rezerv.sql"] [unique_id "atPZJyhX6Y5an3kRhoCbrwAAAUk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ipoac.nl
2026-10-17 19:53:24
UTC ·
(4 weeks ago)
-:443 172.70.247.7 - - [17/Oct/2026:21:53:23 +0200] - "POST /wp-admin/admin-ajax.php HTTP/2.0" 404 2404 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
Bad Web Bot
🇧🇪
madeit
2026-10-15 09:41:22
UTC ·
(1 month ago)
Web App Attack
🇩🇪
altenglaner
2026-10-14 01:00:51
UTC ·
(1 month ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
