🇺🇸
TPI-Abuse
2026-10-18 00:11:09
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 20:11:02.449359 2026] [security2:error] [pid 3905:tid 3905] [client 172.70.248.186:12722] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||monmouthbottleshop.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "monmouthbottleshop.com"] [uri "/admin/config.php.bak"] [unique_id "atQOliJv4xFqdktQNp_T5QAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 23:26:12
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 19:26:04.128435 2026] [security2:error] [pid 3861:tid 3861] [client 172.70.248.186:11812] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||riedmannfamily.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "riedmannfamily.com"] [uri "/admin/config.php.bak"] [unique_id "atQEDKm-XQ_moCsimwUl6QAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 22:17:56
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:17:48.146238 2026] [security2:error] [pid 17157:tid 17157] [client 172.70.248.186:11894] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||digifonics.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "digifonics.com"] [uri "/db.sql"] [unique_id "atP0DL1pekGTFe2O0bLCygAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
craudiovizai
2026-10-17 18:30:49
(1 day ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. ...
show more
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-admin/install.php. Blocked at the edge.
show less
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-14 20:15:41
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 16:15:35.807964 2026] [security2:error] [pid 24221:tid 24221] [client 172.70.248.186:10726] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||fitzmail.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "fitzmail.com"] [uri "/fitzmail.sql"] [unique_id "as_i5_O4azyCXQfULS1CQQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 16:40:09
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 12:40:02.662398 2026] [security2:error] [pid 19766:tid 19766] [client 172.70.248.186:11984] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||mithryl.com|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mithryl.com"] [uri "/admin/config.php.bak"] [unique_id "as-wYi0YKI8dAy7MZgZIIAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 13:42:13
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 09:42:09.221437 2026] [security2:error] [pid 4866:tid 4866] [client 172.70.248.186:11825] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drbolen.derekvantreese.com"] [uri "/.git/config"] [unique_id "as-GsWNdbozZ9IRTZxYE0gAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-10-14 07:42:12
(5 days ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-10-14 06:05:56
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 02:05:50.354450 2026] [security2:error] [pid 15931:tid 15931] [client 172.70.248.186:12267] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cypraea.info|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cypraea.info"] [uri "/dump.sql"] [unique_id "as8bvnOUxnpEqvtHSQcIdQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
abdubhai
2026-10-13 03:53:54
(6 days ago)
172.70.248.186 - - [13/Oct/2026:
...
Brute-Force
🇺🇸
TPI-Abuse
2026-10-10 21:04:17
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 17:04:11.566571 2026] [security2:error] [pid 6551:tid 6551] [client 172.70.248.186:11253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "templehistorical.org"] [uri "/.env"] [unique_id "asqoS7W-VgIjniYu-jZYzwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-10-09 12:51:48
(1 week ago)
{"level":"info","ts":1791550289.7975097,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1791550289.7975097,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.248.186","remote_port":"11673","client_ip":"172.70.248.186","proto":"HTTP/1.1","method":"GET","host":"uptime.prashant.me","uri":"/date1.php","headers":{"Cookie":["REDACTED"],"Cf-Ray":["a47d845edda8066f-FRA"],"Cf-Ipcountry":["IN"],"Cf-Visitor":["{\"scheme\":\"https\"}"],"Cf-Connecting-Ip":["20.204.16.113"],"X-Forwarded-Proto":["https"],"X-Forwarded-For":["20.204.16.113"],"Cdn-Loop":["cloudflare; loops=1"],"Connection":["Keep-Alive"],"Accept-Encoding":["gzip, br"]}},"bytes_read":0,"user_id":"","duration":0.000071297,"size":0,"status":308,"resp_headers":{"Connection":["close"],"Location":["https://uptime.prashant.me/date1.php"],"Content-Type":[],"Server":["Caddy"]}}
{"level":"info","ts":1791550290.3679125,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"172.70.248.186","remote_port":"11675","client_ip":"172.70.248.186","proto":"HTTP/
...
show less
DDoS Attack
Web App Attack
🇫🇷
dynamix
2026-10-09 00:10:40
(1 week ago)
Multiple WAF Violations
Web App Attack
2026-10-06 19:39:37
(1 week ago)
IP matched detection query many 3xx errors.
Brute-Force
🇺🇸
TPI-Abuse
2026-10-05 17:44:35
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.248.186 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 13:44:30.361868 2026] [security2:error] [pid 582164:tid 582190] [client 172.70.248.186:11735] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "plumberw10.plumberw9.com"] [uri "/.git/config"] [unique_id "asPh_g4mOwXhgHpQ9j6TFwAAAFg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
