🇺🇸
Michael DEBILLY
2026-11-03 19:30:26
UTC ·
(5 days ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-03T19:28:07.000Z.
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-01 19:17:30
UTC ·
(1 week ago)
[Mon Nov 02 06:17:30.063467 2026] [security2:error] [pid 2908] [client 8.217.208.41:26776] [client 8.217.208.41] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST- ...
show more
[Mon Nov 02 06:17:30.063467 2026] [security2:error] [pid 2908] [client 8.217.208.41:26776] [client 8.217.208.41] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/product/hi-vis-jacquard-long-sleeve-polo-4602-1-jb-6hjnl/tel:1300701197"] [unique_id "aueQSmzdJF66uXBQI0iIdAAAAAo"]
...
show less
Web App Attack
🇺🇸
francelink.fr
2026-11-01 01:33:22
UTC ·
(1 week ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-01T01:30:16.000Z.
Web App Attack
🇺🇸
francelink.fr
2026-10-30 20:15:31
UTC ·
(1 week ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-10-30T20:05:35.000Z.
Web App Attack
🇫🇮
pavel Karpenko
2026-10-26 04:09:52
UTC ·
(2 weeks ago)
8.217.208.41 - - [26/Oct/2026:07:09:52 +0300] "GET /property_lir.php?id=kw.kwmoe&tab=pi&lang=ru HTTP/1.1" 404 162 "-" "TokenFoundryBot/1.0 ([email protected] )" client_port=25924 server_port=443 rt=0.000 urt=- transfer_entry=- server_addr=195. ...
show more
8.217.208.41 - - [26/Oct/2026:07:09:52 +0300] "GET /property_lir.php?id=kw.kwmoe&tab=pi&lang=ru HTTP/1.1" 404 162 "-" "TokenFoundryBot/1.0 ([email protected] )" client_port=25924 server_port=443 rt=0.000 urt=- transfer_entry=- server_addr=195.133.18.6 epoch=1792987792.995
show less
DDoS Attack
🇺🇸
SX Communications
2026-10-22 03:25:14
UTC ·
(2 weeks ago)
Blocked abusive HTTP application-layer DoS / botnet traffic from 8.217.208.41: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇦🇺
paulshipley.com.au
2026-10-20 04:54:52
UTC ·
(2 weeks ago)
[Tue Oct 20 15:54:51.118384 2026] [security2:error] [pid 212137] [client 8.217.208.41:21033] [client 8.217.208.41] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUES ...
show more
[Tue Oct 20 15:54:51.118384 2026] [security2:error] [pid 212137] [client 8.217.208.41:21033] [client 8.217.208.41] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/wp-content/uploads/2024/11/Screenshot-2024-11-27-143943-300x300.jpg"] [unique_id "atb0G7BamduhAg7FgsxYqgAAAAM"]
...
show less
Web App Attack
🇦🇺
paulshipley.com.au
2026-10-20 04:01:56
UTC ·
(2 weeks ago)
[Tue Oct 20 15:01:56.479575 2026] [security2:error] [pid 206953] [client 8.217.208.41:39204] [client 8.217.208.41] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUES ...
show more
[Tue Oct 20 15:01:56.479575 2026] [security2:error] [pid 206953] [client 8.217.208.41:39204] [client 8.217.208.41] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/wp-content/uploads/2023/06/Linen-Look-1-scaled-1-600x600.jpg"] [unique_id "atbntPq1KdJo-wJKbiTC0QAAAAE"]
...
show less
Web App Attack
🇺🇸
SX Communications
2026-10-19 11:06:17
UTC ·
(2 weeks ago)
Blocked abusive HTTP application-layer DoS / botnet traffic from 8.217.208.41: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇦🇺
paulshipley.com.au
2026-08-11 04:36:23
UTC ·
(2 months ago)
[Tue Aug 11 14:36:22.957653 2026] [security2:error] [pid 209451] [client 8.217.208.41:7716] [client 8.217.208.41] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST ...
show more
[Tue Aug 11 14:36:22.957653 2026] [security2:error] [pid 209451] [client 8.217.208.41:7716] [client 8.217.208.41] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "shop.levellapromotions.com.au"] [uri "/product-category/maserati/merch_maserati/"] [unique_id "anqmxv5JGAINeymhNuqOAQAAAAc"]
...
show less
Web App Attack
🇦🇺
paulshipley.com.au
2026-08-11 03:37:04
UTC ·
(2 months ago)
[Tue Aug 11 13:37:03.665235 2026] [security2:error] [pid 200994] [client 8.217.208.41:62996] [client 8.217.208.41] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUES ...
show more
[Tue Aug 11 13:37:03.665235 2026] [security2:error] [pid 200994] [client 8.217.208.41:62996] [client 8.217.208.41] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "shop.levellapromotions.com.au"] [uri "/robots.txt"] [unique_id "anqY37kldmg7BjD2LRIxgQAAABA"]
...
show less
Web App Attack
🇺🇦
URAN Publishing Service
2026-08-10 22:40:01
UTC ·
(2 months ago)
[11/Aug/2026:01:40:01 +0300] -- 8.217.208.41 Ban reason: User-Agent AliyunSecBot
Bad Web Bot
Web App Attack
🇩🇪
conseilgouz
2026-07-27 19:28:00
UTC ·
(3 months ago)
coe-88 : Bloc AI bots=>/en/component/joaktree/jt-0-a-4/3!I1205?Itemid=305(AliyunSec)
Hacking
🇩🇪
filstal.org
2026-06-06 08:09:05
UTC ·
(5 months ago)
Persistent bad bot: repeated automated abuse detected
Bad Web Bot
Web App Attack
🇩🇪
filstal.org
2026-06-04 19:30:06
UTC ·
(5 months ago)
Unauthorized web crawling by known aggressive crawler or data harvesting bot detected by Fail2Ban
Bad Web Bot
