🇳🇱
GabrielJST
2026-11-08 20:32:44
UTC ·
(2 days ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 180.153.236.37 (CN/China/-)
Bad Web Bot
🇫🇷
LRob
2026-11-08 20:19:32
UTC ·
(2 days ago)
Not following 301 redirects — wasted requests | method: GET | path: / | ua: User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/140.0.0.0; 360Spider | 2026-11-08 20:19 UTC
Bad Web Bot
🇩🇪
LRob
2026-11-08 19:24:07
UTC ·
(2 days ago)
Abusive crawler | ua: User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/1 | path: / | 2026-11-08 19:24 UTC
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-08 19:16:19
UTC ·
(2 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:16:14.861718 2026] [security2:error] [pid 20121:tid 20121] [client 180.153.236.37:50501] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:16:14.861718 2026] [security2:error] [pid 20121:tid 20121] [client 180.153.236.37:50501] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||publicmailservice.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "publicmailservice.com"] [uri "/"] [unique_id "avDKfvq4lMBW1HxCaSY-rAAAAAc"], referer: http://publicmailservice.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 18:34:24
UTC ·
(2 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:34:20.268234 2026] [security2:error] [pid 16319:tid 16319] [client 180.153.236.37:7343] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:34:20.268234 2026] [security2:error] [pid 16319:tid 16319] [client 180.153.236.37:7343] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||somuchtoread.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "somuchtoread.com"] [uri "/"] [unique_id "avDArBQWS8qHUifXbi5IaQAAAAw"], referer: https://somuchtoread.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 07:14:19
UTC ·
(2 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 02:14:14.456978 2026] [security2:error] [pid 8777:tid 8777] [client 180.153.236.37:27821] M ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 02:14:14.456978 2026] [security2:error] [pid 8777:tid 8777] [client 180.153.236.37:27821] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.intrinsicreef.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.intrinsicreef.com"] [uri "/"] [unique_id "avAhRrGRm0IEwPPJYvffSAAAAAE"], referer: http://www.intrinsicreef.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
Bay13
2026-11-08 05:25:04
UTC ·
(2 days ago)
CrowdSec:crowdsecurity/http-bad-user-agent
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-07 05:40:59
UTC ·
(3 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 00:40:54.571106 2026] [security2:error] [pid 4264:tid 4264] [client 180.153.236.37:45527] M ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 00:40:54.571106 2026] [security2:error] [pid 4264:tid 4264] [client 180.153.236.37:45527] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.lukeautogas.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.lukeautogas.com"] [uri "/403.shtml"] [unique_id "au655sPlc04rQ941q9eezQAAAA0"], referer: https://www.lukeautogas.com/403.shtml
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-11-05 10:04:09
UTC ·
(5 days ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 06:35:33
UTC ·
(5 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:35:25.759596 2026] [security2:error] [pid 250731:tid 250850] [client 180.153.236.37:6075 ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:35:25.759596 2026] [security2:error] [pid 250731:tid 250850] [client 180.153.236.37:6075] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.georgementz.org|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.georgementz.org"] [uri "/"] [unique_id "auwjrdAGSdPYre4YKOk5IwAAANg"], referer: https://www.georgementz.org/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-11-03 22:04:09
UTC ·
(1 week ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-11-02 22:04:08
UTC ·
(1 week ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-11-01 22:04:08
UTC ·
(1 week ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 19:41:32
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 14:41:24.397055 2026] [security2:error] [pid 27017:tid 27017] [client 180.153.236.37:17475] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 14:41:24.397055 2026] [security2:error] [pid 27017:tid 27017] [client 180.153.236.37:17475] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||insidepublications.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "insidepublications.com"] [uri "/"] [unique_id "aueV5EXx0XRjeeP7D9hIsAAAAAs"], referer: https://insidepublications.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 18:11:07
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 13:10:59.929794 2026] [security2:error] [pid 3635:tid 3635] [client 180.153.236.37:62979] M ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.37 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 13:10:59.929794 2026] [security2:error] [pid 3635:tid 3635] [client 180.153.236.37:62979] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||airplanechristmascards.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "airplanechristmascards.com"] [uri "/"] [unique_id "aueAsy6EkPQOcr3jkwjhTAAAABs"], referer: https://airplanechristmascards.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
