🇺🇸
craudiovizai
2026-10-22 06:30:44
(2 days ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. ...
show more
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
show less
Web App Attack
Bad Web Bot
🇦🇺
sel
2026-10-21 14:30:41
(3 days ago)
Web scanner/attack: 1 requests.
172.70.247.84 - - [21/Oct/2026:14:30:11 +0000] "GET /wp-admin/instal ...
show more
Web scanner/attack: 1 requests.
172.70.247.84 - - [21/Oct/2026:14:30:11 +0000] "GET /wp-admin/install.php?step=1 HTTP/2.0" 404 328 "-" "http://joetheaverageone.com/wp-admin/install.php?step=1"
show less
Web App Attack
Bad Web Bot
🇧🇪
madeit
2026-10-20 22:43:15
(4 days ago)
Web App Attack
🇫🇷
dynamix
2026-10-20 16:24:23
(4 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 09:58:12
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.84 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 05:58:05.963728 2026] [security2:error] [pid 29214:tid 29214] [client 172.70.247.84:12092] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||stormstrips.info|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "stormstrips.info"] [uri "/backup.sql"] [unique_id "atSYLVemx9RSI8z6WF2UFAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:39:21
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.84 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:39:13.756266 2026] [security2:error] [pid 12041:tid 12041] [client 172.70.247.84:12090] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||keeran.org|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "keeran.org"] [uri "/admin/config.php.bak"] [unique_id "atQHIVx8blcxbSr6IPiAyAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
brantknudson.org
2026-10-17 22:46:30
(1 week ago)
Request path 'GET /db.zip HTTP/1.1'
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-14 03:54:19
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 172.70.247.84 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.247.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 23:54:09.985934 2026] [security2:error] [pid 30928:tid 30928] [client 172.70.247.84:12869] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.dictionaryoffish.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.dictionaryoffish.com"] [uri "/admin/config.php.bak"] [unique_id "as784YIDG5XXCshqbdbuvgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-12 09:03:55
(1 week ago)
Multiple WAF Violations
Web App Attack
🇧🇪
madeit
2026-10-05 00:40:33
(2 weeks ago)
Web App Attack
🇧🇪
madeit
2026-09-04 11:17:10
(1 month ago)
Web App Attack
🇧🇪
madeit
2026-08-06 06:08:07
(2 months ago)
Web App Attack
🇩🇪
www.mammazone.it
2026-04-10 07:20:46
(6 months ago)
[Fri Apr 10 09:20:45.767715 2026] [proxy_fcgi:error] [pid 2117775] [client 172.70.247.84:12174] AH01 ...
show more
[Fri Apr 10 09:20:45.767715 2026] [proxy_fcgi:error] [pid 2117775] [client 172.70.247.84:12174] AH01071: Got error 'Primary script unknown'
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 02:25:12
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.247.84 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.247.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 22:25:06.106502 2026] [security2:error] [pid 13079:tid 13079] [client 172.70.247.84:12696] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.esad.com"] [uri "/.git/index"] [unique_id "adB2gi-Y6H1j6srD9INX3wAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
conseilgouz
2026-04-02 01:19:31
(6 months ago)
lae-17 : Block hidden directories=>/.env(/)
Hacking
