🇺🇸
TPI-Abuse
2026-11-13 01:10:09
UTC ·
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 172.70.248.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 20:10:00.613326 2026] [security2:error] [pid 22304:tid 22347] [client 172.70.248.164:11846] ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.248.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 20:10:00.613326 2026] [security2:error] [pid 22304:tid 22347] [client 172.70.248.164:11846] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||tsengkwongchi.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "tsengkwongchi.com"] [uri "/index.php.bak"] [unique_id "avZjaEyV7VVth1qA3sOedQAAAYs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-12 01:00:42
UTC ·
(1 day ago)
Web scanner: GET /wp-config.php
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-12 00:44:30
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 19:44:25.947986 2026] [security2:error] [pid 27113:tid 27113] [client 172.70.248.164:10285] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 19:44:25.947986 2026] [security2:error] [pid 27113:tid 27113] [client 172.70.248.164:10285] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.greybrucepork.ca"] [uri "/wp-config.php.old"] [unique_id "avUL6UoLzA5ol_RaKXD3PAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 22:09:03
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:08:57.928977 2026] [security2:error] [pid 12563:tid 12563] [client 172.70.248.164:11471] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:08:57.928977 2026] [security2:error] [pid 12563:tid 12563] [client 172.70.248.164:11471] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "disio.com"] [uri "/wp-config.php.old"] [unique_id "avTneQFhqmI2PNvPv_AI2QAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
todix
2026-11-11 01:15:14
UTC ·
(2 days ago)
"GET /phpinfo.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:123.0) Gecko/20100101 Firefox/123.0"
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 10:06:58
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:06:55.116958 2026] [security2:error] [pid 29953:tid 29953] [client 172.70.248.164:13998] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 05:06:55.116958 2026] [security2:error] [pid 29953:tid 29953] [client 172.70.248.164:13998] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "amazingwelding.com"] [uri "/wp-config.php"] [unique_id "avLsv25V92dPks6X2MuJnwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
bohl-aiG5aef
2026-11-09 19:07:45
UTC ·
(3 days ago)
Suricata Alert [SID:2019526] ET WEB_SERVER WEB-PHP phpinfo access
Web App Attack
🇩🇪
updown.io
2026-11-06 14:11:23
UTC ·
(6 days ago)
{"level":"info","ts":1793974282.3137822,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.248.164","remote_port":"11093","client_ip":"172.70.248.164","proto":"HTTP/1.1","method":"GET","host":"status.projecthuddle. ...
show more
{"level":"info","ts":1793974282.3137822,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.248.164","remote_port":"11093","client_ip":"172.70.248.164","proto":"HTTP/1.1","method":"GET","host":"status.projecthuddle.io","uri":"/tymi.php","headers":{"Cf-Visitor":["{\"scheme\":\"http\"}"],"Connection":["Keep-Alive"],"Cf-Connecting-Ip":["158.23.24.128"],"X-Forwarded-Proto":["http"],"X-Forwarded-For":["158.23.24.128"],"Accept-Encoding":["gzip"],"Cf-Ipcountry":["MX"],"Cf-Ray":["a564afdfd85cc86f-FRA"],"Cdn-Loop":["cloudflare; loops=1"]}},"bytes_read":0,"user_id":"","duration":0.000079592,"size":0,"status":308,"resp_headers":{"Connection":["close"],"Location":["https://status.projecthuddle.io/tymi.php"],"Content-Type":[],"Server":["Caddy"]}}
...
show less
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 01:12:10
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 20:12:05.766001 2026] [security2:error] [pid 3824917:tid 3824929] [client 172.70.248.164:11 ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 20:12:05.766001 2026] [security2:error] [pid 3824917:tid 3824929] [client 172.70.248.164:11397] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aclarityforensics.com"] [uri "/.git/config"] [unique_id "au0pZVaiQxW-dBe0rmulgwAAAEU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 00:44:31
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 19:44:22.687880 2026] [security2:error] [pid 6200:tid 6200] [client 172.70.248.164:9573] Mo ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 19:44:22.687880 2026] [security2:error] [pid 6200:tid 6200] [client 172.70.248.164:9573] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipostsocialmedia.com"] [uri "/.env.production"] [unique_id "aup_5thLPyS1khT80AGciQAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-27 18:30:48
UTC ·
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 20:29:10
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 16:29:03.281523 2026] [security2:error] [pid 8519:tid 8519] [client 172.70.248.164:11077] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.164 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 16:29:03.281523 2026] [security2:error] [pid 8519:tid 8519] [client 172.70.248.164:11077] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "litruckbody.com.plugsinc.com"] [uri "/.git/config"] [unique_id "at0VDw06WIow1XM-lMWyDwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
todix
2026-10-24 16:10:55
UTC ·
(2 weeks ago)
"GET /phpinfo.php HTTP/1.1" 404 257 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
Web App Attack
🇺🇸
dot.mg
2026-10-23 19:18:19
UTC ·
(2 weeks ago)
Scan of vulnerable files
Web App Attack
🇫🇷
Eldeberen
2026-10-23 06:53:06
UTC ·
(2 weeks ago)
Vulnerability scan attempt through HTTP protocol
Web App Attack
