🇳🇱
WeCloudit-Anti-Abuse
2026-11-14 02:22:39
UTC ·
(1 hour ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-12 07:32:48
UTC ·
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 02:32:43.728984 2026] [security2:error] [pid 16482:tid 16589] [client 180.153.236.201:4968 ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 02:32:43.728984 2026] [security2:error] [pid 16482:tid 16589] [client 180.153.236.201:49681] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||fnaandpartners.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "fnaandpartners.com"] [uri "/index.php"] [unique_id "avVrm2EdzFtZfe2JQo4aRQAAAJQ"], referer: http://fnaandpartners.com/index.php
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
GooddayGroup
2026-11-12 00:33:54
UTC ·
(2 days ago)
Web application exploit / backdoor attempt detected.
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-11-08 20:19:03
UTC ·
(5 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 15:18:59.176448 2026] [security2:error] [pid 12697:tid 12697] [client 180.153.236.201:7749 ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 15:18:59.176448 2026] [security2:error] [pid 12697:tid 12697] [client 180.153.236.201:7749] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||jessiedavison.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "jessiedavison.com"] [uri "/"] [unique_id "avDZM4Wh5KK2FoluVx5KuQAAAAA"], referer: http://jessiedavison.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 19:40:27
UTC ·
(5 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:40:22.581697 2026] [security2:error] [pid 12895:tid 12895] [client 180.153.236.201:1242 ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:40:22.581697 2026] [security2:error] [pid 12895:tid 12895] [client 180.153.236.201:12429] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||highfield.us|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "highfield.us"] [uri "/"] [unique_id "avDQJroXPBwoRA3GPLWi6wAAADM"], referer: https://highfield.us/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-11-05 10:04:09
UTC ·
(1 week ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 06:41:21
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:41:14.588097 2026] [security2:error] [pid 30964:tid 30964] [client 180.153.236.201:2791 ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:41:14.588097 2026] [security2:error] [pid 30964:tid 30964] [client 180.153.236.201:27915] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||thn.bz|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "thn.bz"] [uri "/"] [unique_id "auwlCrbKkStQPRGMMmsW-QAAAAU"], referer: http://thn.bz/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 05:55:31
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 00:55:23.472499 2026] [security2:error] [pid 12975:tid 12975] [client 180.153.236.201:3586 ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 00:55:23.472499 2026] [security2:error] [pid 12975:tid 12975] [client 180.153.236.201:35863] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.jeranny.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.jeranny.com"] [uri "/"] [unique_id "auwaS_UY_vcSdix6i1SX7QAAABY"], referer: https://www.jeranny.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-11-03 22:04:09
UTC ·
(1 week ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-11-02 22:04:08
UTC ·
(1 week ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-11-01 22:04:08
UTC ·
(1 week ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 20:33:05
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 15:33:01.222142 2026] [security2:error] [pid 18943:tid 18943] [client 180.153.236.201:4650 ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 15:33:01.222142 2026] [security2:error] [pid 18943:tid 18943] [client 180.153.236.201:46505] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||ezsmiledental.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "ezsmiledental.com"] [uri "/"] [unique_id "aueh_eWNKcCHynAnofURnAAAABE"], referer: http://ezsmiledental.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 20:06:32
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 15:06:29.475870 2026] [security2:error] [pid 20185:tid 20185] [client 180.153.236.201:6855 ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 15:06:29.475870 2026] [security2:error] [pid 20185:tid 20185] [client 180.153.236.201:6855] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.crep-psych.org|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.crep-psych.org"] [uri "/"] [unique_id "auebxUD-OmDS8NxedDKPJgAAAAQ"], referer: https://www.crep-psych.org/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 19:35:38
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 14:35:29.763497 2026] [security2:error] [pid 15199:tid 15199] [client 180.153.236.201:4957 ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 14:35:29.763497 2026] [security2:error] [pid 15199:tid 15199] [client 180.153.236.201:49575] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||jamisongreen.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "jamisongreen.com"] [uri "/"] [unique_id "aueUgSgndQJTNCn8JNQ72wAAAAs"], referer: https://jamisongreen.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 08:07:00
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 03:06:52.566699 2026] [security2:error] [pid 21819:tid 21846] [client 180.153.236.201:4609 ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.201 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 03:06:52.566699 2026] [security2:error] [pid 21819:tid 21846] [client 180.153.236.201:46093] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.oxfordlawschool.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.oxfordlawschool.com"] [uri "/"] [unique_id "aubzHDLzaREtitYg3fBPbAAAAFg"], referer: https://www.oxfordlawschool.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
