🇺🇸
francelink.fr
2026-11-08 02:07:24
UTC ·
(1 day ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-08T02:05:38.000Z.
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-06 22:24:19
UTC ·
(2 days ago)
[Sat Nov 07 09:24:18.410643 2026] [security2:error] [pid 710440] [client 8.217.172.205:37791] [client 8.217.172.205] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ...
show more
[Sat Nov 07 09:24:18.410643 2026] [security2:error] [pid 710440] [client 8.217.172.205:37791] [client 8.217.172.205] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/product/bath-salts-tin-d-bs002/tel:1300701197"] [unique_id "au5TklyVezQIS5ovW5d5kgAAAAE"]
...
show less
Web App Attack
2026-11-05 19:21:21
UTC ·
(3 days ago)
apache vulnerability scan
Web App Attack
🇺🇸
francelink.fr
2026-11-04 08:44:28
UTC ·
(5 days ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-04T08:42:14.000Z.
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-02 22:20:10
UTC ·
(6 days ago)
[Tue Nov 03 09:20:09.690470 2026] [security2:error] [pid 170785] [client 8.217.172.205:26507] [client 8.217.172.205] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ...
show more
[Tue Nov 03 09:20:09.690470 2026] [security2:error] [pid 170785] [client 8.217.172.205:26507] [client 8.217.172.205] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/robots.txt"] [unique_id "aukMmXO4SMJy182nTm__3gAAAAM"]
...
show less
Web App Attack
🇦🇺
paulshipley.com.au
2026-10-31 23:24:41
UTC ·
(1 week ago)
[Sun Nov 01 10:24:41.220650 2026] [security2:error] [pid 852123] [client 8.217.172.205:15569] [client 8.217.172.205] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ...
show more
[Sun Nov 01 10:24:41.220650 2026] [security2:error] [pid 852123] [client 8.217.172.205:15569] [client 8.217.172.205] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/trick-or-treat/tel:1300701197"] [unique_id "auZ4uQYgDSe3yPvALaJ60QAAAAE"]
...
show less
Web App Attack
🇫🇷
Sklurk
2026-10-31 01:49:42
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇨🇭
4server
2026-10-30 20:05:29
UTC ·
(1 week ago)
[FriOct3021:05:26.1341542026][security2:error][pid291565:tid293011][client8.217.172.205:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLO ...
show more
[FriOct3021:05:26.1341542026][security2:error][pid291565:tid293011][client8.217.172.205:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"avvnicolaurbani.ch\"][uri\"/sofia-inaugurata-la-mostra-san-francesco-la-storia-di-un-volto/\"][unique_id\"auT4hpbGWc7IBq31QOmg6wAAAFc\"]
show less
Hacking
Web App Attack
🇺🇸
1gz
2026-10-29 05:14:27
UTC ·
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/parku-eolik/
UA: TokenFoundryBot/1.0 ([email protected] )
This report was generated by:
https://github.com/sefinek/Cloudfl ...
show more
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/parku-eolik/
UA: TokenFoundryBot/1.0 ([email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇮
pavel Karpenko
2026-10-26 04:10:35
UTC ·
(2 weeks ago)
8.217.172.205 - - [26/Oct/2026:07:10:35 +0300] "GET /property_lir.php?id=ge.dc&tab=as&lang=es HTTP/1.1" 404 162 "-" "TokenFoundryBot/1.0 ([email protected] )" client_port=40273 server_port=443 rt=0.000 urt=- transfer_entry=- server_addr=195.13 ...
show more
8.217.172.205 - - [26/Oct/2026:07:10:35 +0300] "GET /property_lir.php?id=ge.dc&tab=as&lang=es HTTP/1.1" 404 162 "-" "TokenFoundryBot/1.0 ([email protected] )" client_port=40273 server_port=443 rt=0.000 urt=- transfer_entry=- server_addr=195.133.18.6 epoch=1792987835.890
show less
DDoS Attack
🇪🇸
librebit
2026-10-20 23:54:49
UTC ·
(2 weeks ago)
Brute force
Brute-Force
🇦🇺
paulshipley.com.au
2026-10-19 11:29:19
UTC ·
(3 weeks ago)
[Mon Oct 19 22:29:18.791884 2026] [security2:error] [pid 111567] [client 8.217.172.205:61323] [client 8.217.172.205] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ...
show more
[Mon Oct 19 22:29:18.791884 2026] [security2:error] [pid 111567] [client 8.217.172.205:61323] [client 8.217.172.205] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "indigi-print-merch.com.au"] [uri "/product/2-in-1-pencil-set-h-np115/"] [unique_id "atX_DvAXKL5swdI48-LylgAAAAw"]
...
show less
Web App Attack
🇦🇺
paulshipley.com.au
2026-08-11 00:54:15
UTC ·
(2 months ago)
[Tue Aug 11 10:54:14.638560 2026] [security2:error] [pid 189269] [client 8.217.172.205:57632] [client 8.217.172.205] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ...
show more
[Tue Aug 11 10:54:14.638560 2026] [security2:error] [pid 189269] [client 8.217.172.205:57632] [client 8.217.172.205] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/product/name-tag-with-epoxy-finish-e-nch203c/tel:1300701197"] [unique_id "anpyttlChE7dBtxOlX5PPQAAAA4"]
...
show less
Web App Attack
2026-08-11 00:40:59
UTC ·
(2 months ago)
Botnet flood DDOS activity
Web App Attack
🇺🇦
URAN Publishing Service
2026-08-10 20:38:21
UTC ·
(2 months ago)
[10/Aug/2026:23:38:21 +0300] -- 8.217.172.205 Ban reason: User-Agent AliyunSecBot
Bad Web Bot
Web App Attack
