🇫🇷
LRob
2026-11-08 20:20:13
UTC ·
(1 day ago)
Abusive crawler | ua: User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0; 360Spider | path: / | 2026-11-08 20:20 UTC
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-08 20:04:42
UTC ·
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 15:04:37.962625 2026] [security2:error] [pid 5999:tid 5999] [client 180.153.236.19:35510] M ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 15:04:37.962625 2026] [security2:error] [pid 5999:tid 5999] [client 180.153.236.19:35510] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||edscontracting.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "edscontracting.com"] [uri "/"] [unique_id "avDV1Tw-u1nBvH5TFRazagAAAAA"], referer: http://edscontracting.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 19:49:42
UTC ·
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:49:37.078799 2026] [security2:error] [pid 3940:tid 3940] [client 180.153.236.19:33596] M ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:49:37.078799 2026] [security2:error] [pid 3940:tid 3940] [client 180.153.236.19:33596] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||waleed.co|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "waleed.co"] [uri "/"] [unique_id "avDSUVO5RkEJm_-Duv2_nwAAAAQ"], referer: https://waleed.co/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 10:19:19
UTC ·
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 05:19:12.780350 2026] [security2:error] [pid 14728:tid 14728] [client 180.153.236.19:25310] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 05:19:12.780350 2026] [security2:error] [pid 14728:tid 14728] [client 180.153.236.19:25310] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||embossedchristmascards.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "embossedchristmascards.com"] [uri "/"] [unique_id "avBMoE4JLY6uQTSwwdfyuwAAABA"], referer: http://embossedchristmascards.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 06:16:45
UTC ·
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 01:16:40.971034 2026] [security2:error] [pid 17165:tid 17165] [client 180.153.236.19:25312] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 01:16:40.971034 2026] [security2:error] [pid 17165:tid 17165] [client 180.153.236.19:25312] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||hygeiamedical.icu|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "hygeiamedical.icu"] [uri "/"] [unique_id "avATyJKS2xb-wtJ6cAGKGgAAAAI"], referer: http://hygeiamedical.icu/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-11-05 10:04:09
UTC ·
(4 days ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 07:08:50
UTC ·
(4 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 02:08:46.997551 2026] [security2:error] [pid 23663:tid 23663] [client 180.153.236.19:10372] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 02:08:46.997551 2026] [security2:error] [pid 23663:tid 23663] [client 180.153.236.19:10372] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.bradjohnsonqh.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.bradjohnsonqh.com"] [uri "/"] [unique_id "auwrfui52z7Okt09S_XnWAAAABQ"], referer: http://www.bradjohnsonqh.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 06:35:30
UTC ·
(4 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:35:24.614629 2026] [security2:error] [pid 10734:tid 10734] [client 180.153.236.19:48704] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:35:24.614629 2026] [security2:error] [pid 10734:tid 10734] [client 180.153.236.19:48704] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.superiorhandyman.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.superiorhandyman.net"] [uri "/"] [unique_id "auwjrN0JVS1fwMtUqNNYFAAAAAA"], referer: http://www.superiorhandyman.net/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
CoreTech srl
2026-11-05 06:33:58
UTC ·
(4 days ago)
cloudlinux2 fail2ban: 2026-11-05 07:29:38,267 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 34.52.143.11 - 2026-11-05 07:29:38cloudlinux2 fail2ban: 2026-11-05 07:29:38,057 fail2ban.filter [1800]: INFO [plesk-modsecurity ...
show more
cloudlinux2 fail2ban: 2026-11-05 07:29:38,267 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 34.52.143.11 - 2026-11-05 07:29:38cloudlinux2 fail2ban: 2026-11-05 07:29:38,057 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 34.52.143.11 - 2026-11-05 07:29:38cloudlinux2 fail2ban: 2026-11-05 07:29:38,278 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 34.52.143.11 - 2026-11-05 07:29:38cloudlinux2 fail2ban: 2026-11-05 07:29:38,293 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 34.52.143.11 - 2026-11-05 07:29:38cloudlinux2 fail2ban: 2026-11-05 07:29:38,311 fail2ban.actions [1800]: NOTICE [plesk-modsecurity] Ban 34.52.143.11cloudlinux2 fail2ban: 2026-11-05 07:29:38,316 fail2ban.filter [1800]: INFO [recidive] Found 34.52.143.11 - 2026-11-05 07:29:38cloudlinux2 fail2ban: 2026-11-05 07:29:59,129 fail2ban.filter [1800]: INFO [plesk-modsecurity] Found 38.43.228.162 - 2026-11-05 07:29:59cloudlinux2 fail2ban: 2026-11-05 0
show less
Web App Attack
🇩🇪
4server
2026-11-05 06:22:05
UTC ·
(4 days ago)
[ThuNov0507:22:03.9263332026][security2:error][pid3680064:tid3680194][client180.153.236.19:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(http://bsalsa\\\\\\\\.com\|\^site24x7\)\"against\"REQUEST_HEADERS:user-agent\"required.[file\"/etc ...
show more
[ThuNov0507:22:03.9263332026][security2:error][pid3680064:tid3680194][client180.153.236.19:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(http://bsalsa\\\\\\\\.com\|\^site24x7\)\"against\"REQUEST_HEADERS:user-agent\"required.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"282\"][id\"330094\"][rev\"5\"][msg\"Atomicorp.comWAFRules:CompromisedUser-AgentAgentAttackblocked\"][severity\"CRITICAL\"][hostname\"orabonastudio.it\"][uri\"/\"][unique_id\"auwgi1uZEp1dxhv0nqm-UwAAAQo\"]\,referer:https://orabonastudio.it/
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 06:05:12
UTC ·
(4 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:05:07.922514 2026] [security2:error] [pid 6674:tid 6674] [client 180.153.236.19:18370] M ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:05:07.922514 2026] [security2:error] [pid 6674:tid 6674] [client 180.153.236.19:18370] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.darrow.biz|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.darrow.biz"] [uri "/"] [unique_id "auwck2a1rruxWEDXsrjDhwAAAG4"], referer: http://www.darrow.biz/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 05:37:26
UTC ·
(4 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 00:37:22.459684 2026] [security2:error] [pid 250731:tid 250850] [client 180.153.236.19:7286 ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.19 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 00:37:22.459684 2026] [security2:error] [pid 250731:tid 250850] [client 180.153.236.19:7286] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||rosicrucian.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "rosicrucian.net"] [uri "/"] [unique_id "auwWEtAGSdPYre4YKOkXLAAAANg"], referer: https://rosicrucian.net/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-11-03 22:04:09
UTC ·
(5 days ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-11-02 22:04:08
UTC ·
(6 days ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-11-01 22:04:08
UTC ·
(1 week ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
