🇺🇸
TPI-Abuse
2026-11-13 10:47:53
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 05:47:50.186406 2026] [security2:error] [pid 1988:tid 1988] [client 172.70.248.119:11994] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 05:47:50.186406 2026] [security2:error] [pid 1988:tid 1988] [client 172.70.248.119:11994] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "divingmachines.com"] [uri "/wp-config.php"] [unique_id "avbq1kYrmndK4WLWH-LyowAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 08:45:59
UTC ·
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 03:45:53.647217 2026] [security2:error] [pid 10578:tid 10578] [client 172.70.248.119:12776] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 03:45:53.647217 2026] [security2:error] [pid 10578:tid 10578] [client 172.70.248.119:12776] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||wildpete.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "wildpete.com"] [uri "/index.php.bak"] [unique_id "avbOQaSHHI1duM4_Pts7ngAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-11-12 00:16:29
UTC ·
(3 days ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇨🇭
Origon
2026-11-11 14:55:14
UTC ·
(4 days ago)
plesk-modsecurity - IP: 172.70.248.119 - [11/Nov/2026:15:55:14.159305 +0100] avSB0qQ9Ap3D5AdwK9j3eQAAAAg 172.70.248.119 44800 127.0.0.1 7081 [11/Nov/2026:15:55:14.162699 +0100] avSB0nMIogHqTbkN00RD_gAAAFA 172.70.248.119 44806 127.0.0.1 7081 [11/Nov/ ...
show more
plesk-modsecurity - IP: 172.70.248.119 - [11/Nov/2026:15:55:14.159305 +0100] avSB0qQ9Ap3D5AdwK9j3eQAAAAg 172.70.248.119 44800 127.0.0.1 7081 [11/Nov/2026:15:55:14.162699 +0100] avSB0nMIogHqTbkN00RD_gAAAFA 172.70.248.119 44806 127.0.0.1 7081 [11/Nov/2026:15:55:14.173641 +0100] avSB0qQ9Ap3D5AdwK9j3egAAAAM 172.70.248.119 44822 127.0.0.1 7081 [11/Nov/2026:15:55:14.175408 +0100] avSB0lArfsJorOHkoQtPXAAAAJE 172.70.248.119 44830 127.0.0.1 7081
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 00:20:10
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 19:20:00.681473 2026] [security2:error] [pid 3337:tid 3337] [client 172.70.248.119:11309] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 19:20:00.681473 2026] [security2:error] [pid 3337:tid 3337] [client 172.70.248.119:11309] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.alianzafreight.com"] [uri "/wp-config.php"] [unique_id "avO0sJVGxH_gZnQmCGMf6gAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 08:25:33
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:25:28.643526 2026] [security2:error] [pid 26534:tid 26534] [client 172.70.248.119:13284] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 03:25:28.643526 2026] [security2:error] [pid 26534:tid 26534] [client 172.70.248.119:13284] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "usaenquirer.com"] [uri "/wp-config.php.save"] [unique_id "avLU-MmyvF5jluAE-dqpHgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 03:51:22
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 22:51:17.643744 2026] [security2:error] [pid 2935:tid 2935] [client 172.70.248.119:13434] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 22:51:17.643744 2026] [security2:error] [pid 2935:tid 2935] [client 172.70.248.119:13434] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kathleenhazlett.com"] [uri "/wp-config.php.bak"] [unique_id "avKUtRXRtQf5SqM4lW6kHgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 03:07:34
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 22:07:29.902806 2026] [security2:error] [pid 8915:tid 8915] [client 172.70.248.119:11562] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 22:07:29.902806 2026] [security2:error] [pid 8915:tid 8915] [client 172.70.248.119:11562] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "solvebrandcenter.com"] [uri "/wp-config.php.old"] [unique_id "avKKcYj_pZr5UGar3NHqIwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 00:15:12
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:15:09.757972 2026] [security2:error] [pid 15511:tid 15511] [client 172.70.248.119:13698] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:15:09.757972 2026] [security2:error] [pid 15511:tid 15511] [client 172.70.248.119:13698] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.unionega.com"] [uri "/wp-config.php.save"] [unique_id "avJiDU5voUdq0HKgzH3UiAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 14:57:33
UTC ·
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 09:57:29.791090 2026] [security2:error] [pid 23355:tid 23355] [client 172.70.248.119:9541] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 09:57:29.791090 2026] [security2:error] [pid 23355:tid 23355] [client 172.70.248.119:9541] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.serranoscoffee.com"] [uri "/wp-config.php.save"] [unique_id "avHfWb2snE7oh7pf5HxN8QAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-11-05 11:47:49
UTC ·
(1 week ago)
Web App Attack
🇮🇹
CoreTech srl
2026-11-05 10:34:14
UTC ·
(1 week ago)
cloudlinux2 fail2ban: 2026-11-05 11:29:28,355 fail2ban.filter [1800]: INFO [plesk-wordpress] Found 103.158.53.211 - 2026-11-05 11:29:27cloudlinux2 fail2ban: 2026-11-05 11:29:40,845 fail2ban.filter [1800]: INFO [plesk-wordpress] ...
show more
cloudlinux2 fail2ban: 2026-11-05 11:29:28,355 fail2ban.filter [1800]: INFO [plesk-wordpress] Found 103.158.53.211 - 2026-11-05 11:29:27cloudlinux2 fail2ban: 2026-11-05 11:29:40,845 fail2ban.filter [1800]: INFO [plesk-wordpress] Found 193.104.145.28 - 2026-11-05 11:29:39cloudlinux2 fail2ban: 2026-11-05 11:31:21,661 fail2ban.filter [1800]: INFO [plesk-wordpress] Found 157.100.112.5 - 2026-11-05 11:31:20cloudlinux2 fail2ban: 2026-11-05 11:31:59,860 fail2ban.filter [1800]: INFO [plesk-wordpress] Found 70.24.225.235 - 2026-11-05 11:31:59cloudlinux2 fail2ban: 2026-11-05 11:33:44,677 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 172.70.248.119 - 2026-11-05 11:33:44cloudlinux2 fail2ban: 2026-11-05 11:33:44,632 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 35.235.113.173 - 2026-11-05 11:33:44cloudlinux2 fail2ban: 2026-11-05 11:33:44,688 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 172.70.248.118 - 2026-11-05 11:33:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 08:47:45
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 03:47:38.376302 2026] [security2:error] [pid 7451:tid 7451] [client 172.70.248.119:14041] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 03:47:38.376302 2026] [security2:error] [pid 7451:tid 7451] [client 172.70.248.119:14041] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.termstech.com"] [uri "/.env.old"] [unique_id "auhOKoudbhPwyfCiSx6RBAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-11-02 08:42:49
UTC ·
(1 week ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 18:50:27
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 13:50:21.842712 2026] [security2:error] [pid 7302:tid 7306] [client 172.70.248.119:9924] Mo ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 13:50:21.842712 2026] [security2:error] [pid 7302:tid 7306] [client 172.70.248.119:9924] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "east-lease.com"] [uri "/.env.save"] [unique_id "aueJ7Uo6noHabbcJBdG1QgAAAQI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
