🇨🇦
1gz
2026-11-07 02:46:42
UTC ·
(2 days ago)
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/allen/
UA: TokenFoundryBot/1.0 ([email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflare-WA ...
show more
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/allen/
UA: TokenFoundryBot/1.0 ([email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇦🇺
paulshipley.com.au
2026-11-06 22:33:26
UTC ·
(3 days ago)
[Sat Nov 07 09:33:25.537865 2026] [security2:error] [pid 717135] [client 8.217.191.94:5058] [client 8.217.191.94] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST ...
show more
[Sat Nov 07 09:33:25.537865 2026] [security2:error] [pid 717135] [client 8.217.191.94:5058] [client 8.217.191.94] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/product/compact-first-aid-kit-43-pcs-h-h682/tel:1300701197"] [unique_id "au5VtQCvGs7EQvx7EHNokwAAAAQ"]
...
show less
Web App Attack
🇺🇸
francelink.fr
2026-11-06 19:24:23
UTC ·
(3 days ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-06T19:21:29.000Z.
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-05 20:45:23
UTC ·
(4 days ago)
[Fri Nov 06 07:45:22.034188 2026] [security2:error] [pid 572905] [client 8.217.191.94:61203] [client 8.217.191.94] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUES ...
show more
[Fri Nov 06 07:45:22.034188 2026] [security2:error] [pid 572905] [client 8.217.191.94:61203] [client 8.217.191.94] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "indigi-print-merch.com.au"] [uri "/product/accent-key-ring-d-krl006/"] [unique_id "auzq4kkzEKrlAoAA4gBJYgAAAAQ"]
...
show less
Web App Attack
🇮🇩
hermawan
2026-11-04 04:58:49
UTC ·
(5 days ago)
[Wed Nov 04 11:58:49.480104 2026] [security2:error] [pid 371459:tid 139767533799104] [client 8.217.191.94:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "bot" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4 ...
show more
[Wed Nov 04 11:58:49.480104 2026] [security2:error] [pid 371459:tid 139767533799104] [client 8.217.191.94:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "bot" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: bot found within REQUEST_HEADERS:user-agent: TokenFoundryBot/1.0 ([email protected] ) request_line = GET /index.php/analisis-bulanan/4298-analisis-distribusi-hujan/analisis-distribusi-sifat-hujan/analisis-distribusi-sifat-hujan-jawa-timur-bulanan/analisis-bulanan-distribusi-sifat-hujan-di-provinsi-jawa-timur-tahun-2025/555562491-analisis-bulanan-distribusi-sifat-hujan-bulan-september-tahun-2025-di-provinsi-jawa-timur HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/analisis-bulanan/4298-analisis-distribusi-hujan/analisis-distribusi-sifat-hujan/analisis-distribu
...
show less
Email Spam
Hacking
🇫🇷
COMAITE
2026-11-01 19:53:04
UTC ·
(1 week ago)
SQL injection attempt from 8.217.191.94.
Web App Attack
🇺🇸
francelink.fr
2026-11-01 04:58:24
UTC ·
(1 week ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-01T04:55:50.000Z.
Web App Attack
🇺🇸
francelink.fr
2026-10-30 02:16:24
UTC ·
(1 week ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-10-30T02:13:40.000Z.
Web App Attack
🇫🇮
pavel Karpenko
2026-10-28 06:09:18
UTC ·
(1 week ago)
8.217.191.94 - - [28/Oct/2026:09:09:18 +0300] "GET /property_org.php?org_id=ORG-YIMO2-RIPE&lang=en HTTP/1.1" 404 162 "-" "TokenFoundryBot/1.0 ([email protected] )" client_port=61429 server_port=443 rt=0.000 urt=- transfer_entry=- server_addr=1 ...
show more
8.217.191.94 - - [28/Oct/2026:09:09:18 +0300] "GET /property_org.php?org_id=ORG-YIMO2-RIPE&lang=en HTTP/1.1" 404 162 "-" "TokenFoundryBot/1.0 ([email protected] )" client_port=61429 server_port=443 rt=0.000 urt=- transfer_entry=- server_addr=195.133.18.6 epoch=1793167758.043
show less
DDoS Attack
🇺🇸
1gz
2026-10-26 04:14:24
UTC ·
(2 weeks ago)
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/bureau-law/
UA: TokenFoundryBot/1.0 ([email protected] )
This report was generated by:
https://github.com/sefinek/Cloudfla ...
show more
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/bureau-law/
UA: TokenFoundryBot/1.0 ([email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇦🇺
paulshipley.com.au
2026-10-19 11:11:34
UTC ·
(3 weeks ago)
[Mon Oct 19 22:11:33.735789 2026] [security2:error] [pid 109841] [client 8.217.191.94:62334] [client 8.217.191.94] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUES ...
show more
[Mon Oct 19 22:11:33.735789 2026] [security2:error] [pid 109841] [client 8.217.191.94:62334] [client 8.217.191.94] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/product-category/conferences/badges_lapelpins_nametags/lapel_pins/tel:1300701197"] [unique_id "atX65dqyO7uyXztX2HhBOQAAACQ"]
...
show less
Web App Attack
🇩🇪
conseilgouz
2026-08-11 02:06:22
UTC ·
(2 months ago)
coe-88 : Bloc AI bots=>/joaktree-person/jt-0-j-4/3!I281(AliyunSec)
Hacking
🇺🇦
URAN Publishing Service
2026-08-10 21:14:33
UTC ·
(2 months ago)
[11/Aug/2026:00:14:32 +0300] -- 8.217.191.94 Ban reason: User-Agent AliyunSecBot
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-07-30 14:40:43
UTC ·
(3 months ago)
[30/Jul/2026:17:40:42 +0300] -- 8.217.191.94 Ban reason: User-Agent AliyunSecBot
Bad Web Bot
Web App Attack
🇺🇸
nodepile
2026-06-21 14:33:14
UTC ·
(4 months ago)
Requests denied due to active blacklist hits (tenant=82 method=GET path=/customer/account/login/ ua='AliyunSecBot/Aliyun (
[email protected] )')
Web App Attack
Exploited Host
