🇺🇸
TPI-Abuse
2026-05-15 11:07:56
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 07:05:22.688148 2026] [security2:error] [pid 27939:tid 27939] [client 172.70.43.79:14015] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.belize-boat-registration.com.boatregistrationdelaware.com"] [uri "/.env.backup"] [unique_id "agb98i8c_DLvSyC2MrkmbgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 09:23:35
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 05:23:29.144560 2026] [security2:error] [pid 7159:tid 7159] [client 172.70.43.79:14275] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "valueandmeaning.com"] [uri "/sftp-config.json"] [unique_id "agbmEXO2JbHJaePDNCUO3QAAAC0"], referer: https://www.google.com/search?q=valueandmeaning.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-05-10 22:00:53
(1 month ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-09.
show less
Web App Attack
SSH
Hacking
🇺🇸
TPI-Abuse
2026-04-02 00:33:33
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 20:33:26.120146 2026] [security2:error] [pid 17504:tid 17504] [client 172.70.43.79:12776] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.heron-ent.com"] [uri "/.env.local"] [unique_id "ac25VvHnER7cLjtPzSztUwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-01 23:58:18
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 19:58:12.429257 2026] [security2:error] [pid 27434:tid 27434] [client 172.70.43.79:13791] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "prcomputersolutions.com"] [uri "/.env.dev"] [unique_id "ac2xFFGsOg9EH4IgnM0ctAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-01 08:49:57
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 01 04:49:49.053533 2026] [security2:error] [pid 23032:tid 23032] [client 172.70.43.79:12616] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.vffv.com"] [uri "/.env.prod"] [unique_id "aczcLQwYUh7DdPm8cx1oBgAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 14:45:20
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 10:45:13.152972 2026] [security2:error] [pid 29268:tid 29268] [client 172.70.43.79:9614] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.jacksonsparts.com"] [uri "/.env.old"] [unique_id "acvd-etDPeZgMBNyvpbNOAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 11:29:46
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 07:29:40.205664 2026] [security2:error] [pid 855:tid 855] [client 172.70.43.79:11198] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "joukoji.com"] [uri "/.env_secret"] [unique_id "acuwJH4-gTJy00j5w6Xs7QAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 11:03:53
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 07:03:42.750976 2026] [security2:error] [pid 31402:tid 31402] [client 172.70.43.79:11421] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.johnatuttle.us"] [uri "/.env.tmp"] [unique_id "acuqDoIqOaNGHybpnAABgAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 10:24:58
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 06:24:52.477747 2026] [security2:error] [pid 15336:tid 15336] [client 172.70.43.79:12948] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nflelectronics.com.tlambert.us"] [uri "/.env.example"] [unique_id "acug9OE00e5i84CJqoHJcAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 09:46:08
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 05:45:59.662957 2026] [security2:error] [pid 12670:tid 12670] [client 172.70.43.79:13040] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.geriking.com"] [uri "/.env.bak"] [unique_id "acuX17XkVwd3Eu74TGJZYgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 08:28:06
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 04:27:57.387399 2026] [security2:error] [pid 25177:tid 25177] [client 172.70.43.79:9908] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.partybuseslansing.com"] [uri "/.env.local"] [unique_id "acuFjc84XmDzdRKCxiid0AAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 06:02:00
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 02:01:46.511963 2026] [security2:error] [pid 25243:tid 25298] [client 172.70.43.79:12638] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.12am.us"] [uri "/.env.local.backup"] [unique_id "actjSu0_c5YS71GqrkKR2gAAAY4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 05:24:21
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 01:23:43.587021 2026] [security2:error] [pid 14570:tid 14570] [client 172.70.43.79:12902] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.ticmonster.com"] [uri "/.env.php"] [unique_id "actaX9G5yKcp6nOPFV7DTAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-31 04:54:41
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.43.79 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 31 00:54:33.477221 2026] [security2:error] [pid 6833:tid 6857] [client 172.70.43.79:10393] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.fastestcopyright.com"] [uri "/.env.staging"] [unique_id "actTiTrM6GUORrOFkh_qcQAAAJM"]
show less
Brute-Force
Bad Web Bot
Web App Attack