🇫🇷
dynamix
2026-10-14 01:48:53
(2 hours ago)
Multiple WAF Violations
Web App Attack
2026-10-07 03:20:10
(1 week ago)
172.70.80.59 - - [07/Oct/2026:05:20:08 +0200] "GET /.htpasswd HTTP/1.1" 403 124 "-" "Mozilla/5.0 (Ma ...
show more
172.70.80.59 - - [07/Oct/2026:05:20:08 +0200] "GET /.htpasswd HTTP/1.1" 403 124 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1)"
172.70.80.59 - - [07/Oct/2026:05:20:08 +0200] "GET /.ssh/config HTTP/1.1" 403 124 "-" "Mozilla/5.0 (compatible; YouBot/1.0; +https://you.com/bot)"
172.70.80.59 - - [07/Oct/2026:05:20:08 +0200] "GET /.bashrc HTTP/1.1" 403 124 "-" "Mozilla/5.0 (compatible; Google-Extended; +http://www.google.com/bot.html)"
172.70.80.59 - - [07/Oct/2026:05:20:08 +0200] "GET /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ?raw?? HTTP/1.1" 403 124 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
172.70.80.59 - - [07/Oct/2026:05:20:09 +0200] "GET /@fs/var/task/.env?raw?? HTTP/1.1" 403 124 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexitybot)"
172.70.80.59 - - [07/Oct/2026:05:20:09 +0200] "GET /@fs/.
...
show less
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-09-24 05:43:23
(2 weeks ago)
Web App Attack
🇺🇸
Antairus
2026-09-17 01:59:19
(3 weeks ago)
Port scan detected. Scanned ports: 8443. Detected by firewall.
Port Scan
🇧🇪
madeit
2026-08-13 19:32:03
(2 months ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-07-02 19:43:10
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 02 15:43:06.542220 2026] [security2:error] [pid 21219:tid 21219] [client 172.70.80.59:10149] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.bisbyphotography.com|F|2"] [data "[email protected] "] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.bisbyphotography.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "aka_Sic309VDCVaqLxTqOQAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 19:46:04
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 15:46:00.787254 2026] [security2:error] [pid 23680:tid 23680] [client 172.70.80.59:11635] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.drstiso.com|F|2"] [data "[email protected] "] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.drstiso.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "ajL5eIFh87ujyl5Qp-UVPgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-16 21:04:01
(3 months ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-04-09 00:07:34
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 20:07:29.693548 2026] [security2:error] [pid 2706929:tid 2706929] [client 172.70.80.59:12208] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.paavoharkonen.com"] [uri "/core/.env"] [unique_id "adbtwWqgMc8Unpi2n9crIgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-07 16:23:25
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 07 12:23:19.035639 2026] [security2:error] [pid 2148689:tid 2148711] [client 172.70.80.59:13694] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.gelatoconsapevole.it"] [uri "/.env.local"] [unique_id "adUvd9fqyFCcUewOBQkULwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-07 05:50:58
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 07 01:50:49.646749 2026] [security2:error] [pid 860503:tid 860503] [client 172.70.80.59:13859] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.theledman.com"] [uri "/admin/.env"] [unique_id "adSbOfP4No1xDNs5hNdExgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-07 02:41:43
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 22:41:37.786141 2026] [security2:error] [pid 642779:tid 642779] [client 172.70.80.59:10153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.memrfixitok.com"] [uri "/.env.json"] [unique_id "adRu4dHeIgzMRMpD7LE_fgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-06 02:25:25
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 22:25:22.073065 2026] [security2:error] [pid 8638:tid 8638] [client 172.70.80.59:14200] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.solidthought.com"] [uri "/.env.json"] [unique_id "adMZkpd7bW-ZnpdDFz-3UQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-05 11:09:48
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 07:09:41.024158 2026] [security2:error] [pid 2197:tid 2262] [client 172.70.80.59:9998] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.sh2.lol"] [uri "/.env.test"] [unique_id "adJC9Z9L4bzwRdy-nNRMhQAAAJc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-05 07:03:40
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.80.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 05 03:03:28.980276 2026] [security2:error] [pid 13225:tid 13225] [client 172.70.80.59:14317] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.grupogasa.com"] [uri "/.env.development"] [unique_id "adIJQHgfIvM4jI3CoH83kAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
