🇮🇹
CoreTech srl
2026-11-08 19:53:56
UTC ·
(1 day ago)
cloudlinux2 fail2ban: 2026-11-08 20:49:09,351 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 180.153.236.39 - 2026-11-08 20:49:09cloudlinux2 fail2ban: 2026-11-08 20:49:15,700 fail2ban.filter [1672]: INFO [plesk-wordpress ...
show more
cloudlinux2 fail2ban: 2026-11-08 20:49:09,351 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 180.153.236.39 - 2026-11-08 20:49:09cloudlinux2 fail2ban: 2026-11-08 20:49:15,700 fail2ban.filter [1672]: INFO [plesk-wordpress] Found 103.129.134.197 - 2026-11-08 20:49:14cloudlinux2 fail2ban: 2026-11-08 20:49:41,900 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 180.153.236.55 - 2026-11-08 20:49:41cloudlinux2 fail2ban: 2026-11-08 20:50:00,092 fail2ban.actions [1672]: NOTICE [plesk-modsecurity] Unban 136.90.36.14cloudlinux2 fail2ban: 2026-11-08 20:50:05,064 fail2ban.filter [1672]: INFO [plesk-modsecurity] Found 183.253.77.151 - 2026-11-08 20:50:05cloudlinux2 fail2ban: 2026-11-08 20:50:06,263 fail2ban.filter [1672]: INFO [plesk-wordpress] Found 185.12.142.247 - 2026-11-08 20:50:05cloudlinux2 fail2ban: 2026-11-08 20:50:14,665 fail2ban.filter [1672]: INFO [plesk-wordpress] Found 83.225.106.73 - 2026-11-08 20:50:14cloudlinux2 fail2b
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 19:53:46
UTC ·
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:53:37.898205 2026] [security2:error] [pid 25601:tid 25601] [client 180.153.236.39:53843] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:53:37.898205 2026] [security2:error] [pid 25601:tid 25601] [client 180.153.236.39:53843] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||instepdogobedience.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "instepdogobedience.com"] [uri "/"] [unique_id "avDTQZ__H6MGToXYZw8cUAAAAA8"], referer: http://instepdogobedience.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-08 19:37:36
UTC ·
(1 day ago)
[Mon Nov 09 06:37:35.952128 2026] [security2:error] [pid 7950] [client 180.153.236.39:8489] [client 180.153.236.39] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUE ...
show more
[Mon Nov 09 06:37:35.952128 2026] [security2:error] [pid 7950] [client 180.153.236.39:8489] [client 180.153.236.39] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "paulshipley.com.au"] [uri "/"] [unique_id "avDPf_ponsnHYtIEh_9MrQAAAA8"], referer: https://paulshipley.com.au/
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 18:54:30
UTC ·
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:54:23.226359 2026] [security2:error] [pid 7935:tid 7935] [client 180.153.236.39:45493] M ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:54:23.226359 2026] [security2:error] [pid 7935:tid 7935] [client 180.153.236.39:45493] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||folkdancers.org|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "folkdancers.org"] [uri "/"] [unique_id "avDFX8NnJ581z1KFf8siogAAAAg"], referer: https://folkdancers.org/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-08 18:53:46
UTC ·
(1 day ago)
Abusive crawler | ua: User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/1 | path: / | 2026-11-08 18:53 UTC
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-08 06:13:15
UTC ·
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 01:13:07.570628 2026] [security2:error] [pid 10938:tid 10938] [client 180.153.236.39:10093] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 01:13:07.570628 2026] [security2:error] [pid 10938:tid 10938] [client 180.153.236.39:10093] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.jambmaster.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.jambmaster.com"] [uri "/"] [unique_id "avAS80u5fkd8PIwP3GLkIAAAAAk"], referer: http://www.jambmaster.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2026-11-08 05:42:07
UTC ·
(1 day ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 180.153.236.39 (CN/China/-)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-07 07:12:15
UTC ·
(2 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 02:12:07.948247 2026] [security2:error] [pid 27690:tid 27690] [client 180.153.236.39:48671] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 02:12:07.948247 2026] [security2:error] [pid 27690:tid 27690] [client 180.153.236.39:48671] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||sulfurandsage.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "sulfurandsage.com"] [uri "/"] [unique_id "au7PR0v1WIxLujV70kE37AAAAA8"], referer: http://sulfurandsage.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 05:34:07
UTC ·
(2 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 00:34:02.756189 2026] [security2:error] [pid 30506:tid 30506] [client 180.153.236.39:58231] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 00:34:02.756189 2026] [security2:error] [pid 30506:tid 30506] [client 180.153.236.39:58231] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||terrageosynthetics.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "terrageosynthetics.com"] [uri "/"] [unique_id "au64SrrOjsrUqwsKjGW0lQAAABI"], referer: https://terrageosynthetics.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-11-05 10:04:09
UTC ·
(4 days ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇩🇪
LRob
2026-11-05 06:52:29
UTC ·
(4 days ago)
Abusive crawler | ua: User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/1 | path: / | 2026-11-05 06:52 UTC
Bad Web Bot
🇩🇪
LRob
2026-11-05 06:33:30
UTC ·
(4 days ago)
Abusive crawler | ua: User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/1 | path: / | 2026-11-05 06:33 UTC
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-05 06:29:54
UTC ·
(4 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:29:48.608973 2026] [security2:error] [pid 20480:tid 20480] [client 180.153.236.39:27001] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:29:48.608973 2026] [security2:error] [pid 20480:tid 20480] [client 180.153.236.39:27001] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.495metro.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.495metro.com"] [uri "/"] [unique_id "auwiXAFRBQ-yBt4FzJvFDQAAAAk"], referer: http://www.495metro.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 05:27:53
UTC ·
(4 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 00:27:50.523720 2026] [security2:error] [pid 15196:tid 15196] [client 180.153.236.39:62819] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 00:27:50.523720 2026] [security2:error] [pid 15196:tid 15196] [client 180.153.236.39:62819] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||cityindustries.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "cityindustries.com"] [uri "/index.html"] [unique_id "auwT1pzV53jMRiuuJUdk9gAAAAw"], referer: https://cityindustries.com/index.html
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 04:03:11
UTC ·
(4 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 23:03:07.302012 2026] [security2:error] [pid 17764:tid 17764] [client 180.153.236.39:27115] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 23:03:07.302012 2026] [security2:error] [pid 17764:tid 17764] [client 180.153.236.39:27115] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||qu1ck.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "qu1ck.com"] [uri "/"] [unique_id "auv_-8ZENToUxrklwxpM4wAAAAs"], referer: http://qu1ck.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
