🇧🇬
Stoyko Stoykov
2026-10-26 11:42:06
(2 days ago)
172.70.93.118 - - [26/Oct/2026:13:42:05 +0200] "GET /wp-admin/admin-ajax.php HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.212 Safari/537.36"
...
Hacking
Web App Attack
🇫🇷
dynamix
2026-10-23 23:30:52
(4 days ago)
Multiple WAF Violations
Web App Attack
🇧🇪
madeit
2026-10-20 02:47:13
(1 week ago)
Web App Attack
🇧🇪
madeit
2026-10-08 05:37:37
(2 weeks ago)
Web App Attack
🇯🇵
S.O.B.A. Dev.
2026-09-20 13:10:42
(1 month ago)
Persistent port scanning or vulnerability scanning
Port Scan
🇧🇪
madeit
2026-09-18 09:00:27
(1 month ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-08-17 07:31:18
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.93.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 03:31:10.677364 2026] [security2:error] [pid 25186:tid 25186] [client 172.70.93.118:14137] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.93.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 03:31:10.677364 2026] [security2:error] [pid 25186:tid 25186] [client 172.70.93.118:14137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mobileonlinecasinos.co"] [uri "/.git/config"] [unique_id "aoK4vkMsnQHRNeCTpAeLGAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-17 06:55:44
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.93.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 02:55:37.480202 2026] [security2:error] [pid 5737:tid 5737] [client 172.70.93.118:14258] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.93.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 17 02:55:37.480202 2026] [security2:error] [pid 5737:tid 5737] [client 172.70.93.118:14258] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.jacobunderwoodmusic.com"] [uri "/.git/HEAD"] [unique_id "aoKwaUzJSCyvYaBAWDK52AAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
madeit
2026-08-12 10:03:23
(2 months ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-08-11 04:21:56
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.93.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 00:21:50.110324 2026] [security2:error] [pid 2223641:tid 2223641] [client 172.70.93.118:1345 ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.93.118 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 00:21:50.110324 2026] [security2:error] [pid 2223641:tid 2223641] [client 172.70.93.118:13451] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "utp.cyber507.net"] [uri "/.git/config"] [unique_id "anqjXoqg6e-slZUgiFrlxAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mawan
2026-08-08 22:23:11
(2 months ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
🇺🇸
ratcarcher-labs
2026-08-05 18:02:33
(2 months ago)
[Ratcarcher Labs/MutantShield honeypot CTI] actor=human vector=bot_scanner risk=75 attacks=5 depth=4 node=node-ap-south canary=no human_score=65 agentic=15 cc=SG asn=Cloudflare, Inc. | Data provided by Ratcarcher Labs · https://ratcarcher-labs.com · ...
show more
[Ratcarcher Labs/MutantShield honeypot CTI] actor=human vector=bot_scanner risk=75 attacks=5 depth=4 node=node-ap-south canary=no human_score=65 agentic=15 cc=SG asn=Cloudflare, Inc. | Data provided by Ratcarcher Labs · https://ratcarcher-labs.com · docs https://api.ratcarcher-labs.com/api/v1/public/docs
show less
Port Scan
Bad Web Bot
🇬🇧
OptimusGO
2026-06-22 02:45:11
(4 months ago)
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Timestamp: 2026-06-22 03:45:11 UTC
Log evidence:
172.70.93.118 - - [22/Jun/2026:03:45:09 +0100] "GET /?rest_route=/wp/v2/users/ HTTP/1.1" 200 409 "-" "Mo ...
show more
Malicious activity detected: web_attack
Server: commstackbc (185.127.18.66)
Attack: web_attack
Timestamp: 2026-06-22 03:45:11 UTC
Log evidence:
172.70.93.118 - - [22/Jun/2026:03:45:09 +0100] "GET /?rest_route=/wp/v2/users/ HTTP/1.1" 200 409 "-" "Mozilla/5.0 (l9scan/2.0.534323e2835313e27363e2237313; +https://leakix.net)"
06/22/2026-03:45:09.355814 [**] [1:2049255:1] ET SCAN LeakIX Inbound User-Agent [**] [Classification: Misc activity] [Priority: 3] {TCP} 172.70.93.118:11368 -> 185.127.18.66:80
show less
Port Scan
Brute-Force
🇸🇬
anotherwatcher
2026-06-09 21:36:49
(4 months ago)
bad bot
Bad Web Bot
🇺🇸
octageeks.com
2026-05-29 04:06:42
(4 months ago)
Wordpress malicious attack:[octascan]
Web App Attack
