🇫🇷
dynamix
2026-10-14 01:48:53
(2 hours ago)
Multiple WAF Violations
Web App Attack
2026-10-07 03:20:10
(1 week ago)
172.70.80.58 - - [07/Oct/2026:05:20:08 +0200] "GET /.ssh/id_rsa HTTP/1.1" 403 124 "-" "Mozilla/5.0 A ...
show more
172.70.80.58 - - [07/Oct/2026:05:20:08 +0200] "GET /.ssh/id_rsa HTTP/1.1" 403 124 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexitybot)"
172.70.80.58 - - [07/Oct/2026:05:20:09 +0200] "GET /@fs/app/.env.local?import&raw?? HTTP/1.1" 403 124 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexitybot)"
172.70.80.58 - - [07/Oct/2026:05:20:09 +0200] "GET /.env.development?raw HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36; compatible; OAI-SearchBot/1.4; +https://openai.com/searchbot"
172.70.80.58 - - [07/Oct/2026:05:20:09 +0200] "GET /.env.production?raw HTTP/1.1" 403 124 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
172.70.80.58 - - [07/Oct/2026:05:20:09 +0200] "GET /images../.env HTTP/1
...
show less
Bad Web Bot
Web App Attack
🇫🇷
dynamix
2026-09-24 19:56:57
(2 weeks ago)
Multiple WAF Violations
Web App Attack
🇧🇪
madeit
2026-09-24 10:46:58
(2 weeks ago)
Web App Attack
🇧🇪
madeit
2026-09-15 23:43:21
(4 weeks ago)
Web App Attack
🇧🇪
madeit
2026-08-09 20:09:29
(2 months ago)
Web App Attack
🇩🇪
acadeova
2026-07-17 04:09:38
(2 months ago)
🚨 Recon detected (nft drop)
SRC=172.70.80.58
Observed=TCP dpt=80 in=enp0s6 ttl=56
Time=recent(journa ...
show more
🚨 Recon detected (nft drop)
SRC=172.70.80.58
Observed=TCP dpt=80 in=enp0s6 ttl=56
Time=recent(journalctl: 10 minutes ago)
Assessment=Generic scanning / reconnaissance (PORT_SCAN)
show less
Port Scan
2026-07-14 01:02:21
(3 months ago)
Web App Attack
2026-06-16 20:01:19
(3 months ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-06-11 12:49:51
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 172.70.80.58 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.80.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 08:49:44.088506 2026] [security2:error] [pid 14788:tid 14803] [client 172.70.80.58:12631] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.datuinc.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.datuinc.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "aiqu6Hb0PZa5jRGKj5C-JAAAAE0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-02 14:18:49
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 172.70.80.58 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.80.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 10:18:46.266795 2026] [security2:error] [pid 31444:tid 31444] [client 172.70.80.58:12461] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.bhempower.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.bhempower.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "ah7mRqCrKBWtOYp1g7wX-gAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-09 00:05:59
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.80.58 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.80.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 20:05:51.895833 2026] [security2:error] [pid 2706929:tid 2706929] [client 172.70.80.58:13085] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.paavoharkonen.com"] [uri "/.git/logs/HEAD"] [unique_id "adbtX2qgMc8Unpi2n9crGwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-08 22:01:56
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.80.58 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.80.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 18:01:51.816920 2026] [security2:error] [pid 2783140:tid 2783140] [client 172.70.80.58:11550] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.c2cdisasterresponse.org"] [uri "/.env1"] [unique_id "adbQT0R5wmmSrZZLN2bohQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-07 05:51:35
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.80.58 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.80.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 07 01:51:27.424509 2026] [security2:error] [pid 861640:tid 861640] [client 172.70.80.58:13172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.theledman.com"] [uri "/private/.env"] [unique_id "adSbX_IVbKz25EIlIeNJsAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-06 02:24:14
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.80.58 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.80.58 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 22:24:04.522015 2026] [security2:error] [pid 9995:tid 9995] [client 172.70.80.58:12596] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.solidthought.com"] [uri "/.env.save"] [unique_id "adMZROz0nAuhyk1CNVD7FQAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
