🇳🇱
WeCloudit-Anti-Abuse
2026-11-12 14:21:36
UTC ·
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-12 06:45:01
UTC ·
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 01:44:55.797357 2026] [security2:error] [pid 2368:tid 2368] [client 180.153.236.81:64517] M ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 01:44:55.797357 2026] [security2:error] [pid 2368:tid 2368] [client 180.153.236.81:64517] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.itony.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.itony.com"] [uri "/"] [unique_id "avVgZ4K1f7EKh58BIMrCmgAAAAI"], referer: http://www.itony.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
GooddayGroup
2026-11-12 00:31:55
UTC ·
(2 days ago)
Web application exploit / backdoor attempt detected.
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2026-11-08 19:45:30
UTC ·
(5 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:45:22.987528 2026] [security2:error] [pid 28705:tid 28705] [client 180.153.236.81:50023] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:45:22.987528 2026] [security2:error] [pid 28705:tid 28705] [client 180.153.236.81:50023] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||johnheinrich.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "johnheinrich.com"] [uri "/"] [unique_id "avDRUoQ1CLf8ev-YkvnLHQAAAAo"], referer: https://johnheinrich.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 19:04:38
UTC ·
(5 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:04:33.022448 2026] [security2:error] [pid 17610:tid 17610] [client 180.153.236.81:37611] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:04:33.022448 2026] [security2:error] [pid 17610:tid 17610] [client 180.153.236.81:37611] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||ridgecrestrealtors.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "ridgecrestrealtors.com"] [uri "/"] [unique_id "avDHwW9aWWbIX7_XmJoDAQAAABI"], referer: http://ridgecrestrealtors.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 18:37:41
UTC ·
(5 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:37:37.093209 2026] [security2:error] [pid 31251:tid 31251] [client 180.153.236.81:5935] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 13:37:37.093209 2026] [security2:error] [pid 31251:tid 31251] [client 180.153.236.81:5935] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.laura-stone.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.laura-stone.com"] [uri "/"] [unique_id "avDBcYWpXjyE7dAMLlrxOAAAADE"], referer: https://www.laura-stone.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 06:12:04
UTC ·
(6 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 01:11:57.388349 2026] [security2:error] [pid 23456:tid 23456] [client 180.153.236.81:8747] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 01:11:57.388349 2026] [security2:error] [pid 23456:tid 23456] [client 180.153.236.81:8747] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.seizinthebook.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.seizinthebook.com"] [uri "/"] [unique_id "au7BLZlzJiSjqqx11FaOQAAAAAc"], referer: https://www.seizinthebook.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 05:18:16
UTC ·
(6 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 00:18:12.516943 2026] [security2:error] [pid 7775:tid 7775] [client 180.153.236.81:5495] Mo ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 00:18:12.516943 2026] [security2:error] [pid 7775:tid 7775] [client 180.153.236.81:5495] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||kingfishergroupllc.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "kingfishergroupllc.com"] [uri "/"] [unique_id "au60lDNuEd0Nnf7JexsbrQAAABI"], referer: https://kingfishergroupllc.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-11-05 10:04:09
UTC ·
(1 week ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 07:29:56
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 02:29:48.067852 2026] [security2:error] [pid 5632:tid 5632] [client 180.153.236.81:28307] M ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 02:29:48.067852 2026] [security2:error] [pid 5632:tid 5632] [client 180.153.236.81:28307] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.hydrusdetergents.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.hydrusdetergents.com"] [uri "/"] [unique_id "auwwbLvtuC-WG1N8e_pYBgAAAAE"], referer: https://www.hydrusdetergents.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 07:06:53
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 02:06:47.914134 2026] [security2:error] [pid 32440:tid 32440] [client 180.153.236.81:39775] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 02:06:47.914134 2026] [security2:error] [pid 32440:tid 32440] [client 180.153.236.81:39775] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.trasimeno.ws|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.trasimeno.ws"] [uri "/"] [unique_id "auwrByFsQJXHr10HkeOghQAAABE"], referer: http://www.trasimeno.ws/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 06:30:03
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:29:54.711804 2026] [security2:error] [pid 250732:tid 250841] [client 180.153.236.81:4195 ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:29:54.711804 2026] [security2:error] [pid 250732:tid 250841] [client 180.153.236.81:41959] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.webcraftestudio.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.webcraftestudio.com"] [uri "/"] [unique_id "auwiYqkkNJfTzH3Llr9xZAAAAQM"], referer: https://www.webcraftestudio.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-11-05 05:54:46
UTC ·
(1 week ago)
Abusive crawler | ua: User-Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36 Edg/1 | path: / | 2026-11-05 05:54 UTC
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-05 05:33:39
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 00:33:30.618205 2026] [security2:error] [pid 29009:tid 29009] [client 180.153.236.81:12799] ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.81 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 00:33:30.618205 2026] [security2:error] [pid 29009:tid 29009] [client 180.153.236.81:12799] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.gpusa-ca.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.gpusa-ca.com"] [uri "/"] [unique_id "auwVKlHRpcCe4MajhEcPngAAAA8"], referer: https://www.gpusa-ca.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-11-03 22:04:09
UTC ·
(1 week ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
