🇺🇸
francelink.fr
2026-11-08 00:37:23
UTC ·
(2 days ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-07T19:52:33.000Z.
Web App Attack
🇨🇦
1gz
2026-11-07 01:52:48
UTC ·
(3 days ago)
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/ferme/
UA: TokenFoundryBot/1.0 ([email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflare-WA ...
show more
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/ferme/
UA: TokenFoundryBot/1.0 ([email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
francelink.fr
2026-11-07 01:36:27
UTC ·
(3 days ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-07T01:34:09.000Z.
Web App Attack
🇺🇸
francelink.fr
2026-11-05 20:23:23
UTC ·
(4 days ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-05T20:20:56.000Z.
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-04 10:30:41
UTC ·
(6 days ago)
[Wed Nov 04 21:30:41.563898 2026] [security2:error] [pid 370974] [client 8.217.212.79:3038] [client 8.217.212.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST ...
show more
[Wed Nov 04 21:30:41.563898 2026] [security2:error] [pid 370974] [client 8.217.212.79:3038] [client 8.217.212.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/product/hydra-sports-umbrella-white-panels-tc-107909/tel:1300701197"] [unique_id "ausJUZcZgeB7wYxhbajzigAAAAQ"]
...
show less
Web App Attack
🇮🇩
hermawan
2026-11-01 01:46:33
UTC ·
(1 week ago)
[Sun Nov 01 08:46:33.126393 2026] [security2:error] [pid 353237:tid 140141226096320] [client 8.217.212.79:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "bot" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4 ...
show more
[Sun Nov 01 08:46:33.126393 2026] [security2:error] [pid 353237:tid 140141226096320] [client 8.217.212.79:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "bot" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: bot found within REQUEST_HEADERS:user-agent: TokenFoundryBot/1.0 ([email protected] ) request_line = GET /index.php/analisis-musim/4393-perbandingan-klimatologi/perbandingan-prakiraan-awal-musim-hujan-dengan-normalnya-zona-musim-di-propinsi-jawa-timur/analisis-6-bulanan-perbandingan-prediksi-awal-musim-hujan-tahun-2026-2027-dengan-normalnya-1991-2020-zona-musim-di-provinsi-jawa-timur HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/analisis-musim/4393-perbandingan-klimatologi/perbandingan-prakiraan-awal-musim-hujan-dengan-normalnya-zona-musim-di-propinsi-jawa-t
...
show less
Email Spam
Hacking
🇺🇸
1gz
2026-10-28 03:53:33
UTC ·
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/ambaadori/
UA: TokenFoundryBot/1.0 ([email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflar ...
show more
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/ambaadori/
UA: TokenFoundryBot/1.0 ([email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇮
pavel Karpenko
2026-10-26 04:07:12
UTC ·
(2 weeks ago)
8.217.212.79 - - [26/Oct/2026:07:07:12 +0300] "GET /property_lir.php?id=fr.eolas&tab=pi&lang=pl HTTP/1.1" 404 162 "-" "TokenFoundryBot/1.0 ([email protected] )" client_port=17815 server_port=443 rt=0.000 urt=- transfer_entry=- server_addr=195. ...
show more
8.217.212.79 - - [26/Oct/2026:07:07:12 +0300] "GET /property_lir.php?id=fr.eolas&tab=pi&lang=pl HTTP/1.1" 404 162 "-" "TokenFoundryBot/1.0 ([email protected] )" client_port=17815 server_port=443 rt=0.000 urt=- transfer_entry=- server_addr=195.133.18.6 epoch=1792987632.941
show less
DDoS Attack
🇫🇷
Sklurk
2026-10-20 04:19:42
UTC ·
(3 weeks ago)
Web App Attack
Web App Attack
🇺🇦
URAN Publishing Service
2026-08-10 20:59:29
UTC ·
(2 months ago)
[10/Aug/2026:23:59:28 +0300] -- 8.217.212.79 Ban reason: User-Agent AliyunSecBot
Bad Web Bot
Web App Attack
🇩🇪
filstal.org
2026-08-10 06:39:14
UTC ·
(3 months ago)
Persistent bad bot: repeated automated abuse detected
Bad Web Bot
Web App Attack
🇩🇪
filstal.org
2026-08-08 12:09:10
UTC ·
(3 months ago)
Persistent bad bot: repeated automated abuse detected
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-07-30 16:02:43
UTC ·
(3 months ago)
[30/Jul/2026:19:02:42 +0300] -- 8.217.212.79 Ban reason: User-Agent AliyunSecBot
Bad Web Bot
Web App Attack
🇫🇷
bigorre.org
2026-06-21 15:25:38
UTC ·
(4 months ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot
🇦🇺
paulshipley.com.au
2026-06-17 00:37:44
UTC ·
(4 months ago)
[Wed Jun 17 10:37:43.115200 2026] [security2:error] [pid 321574] [client 8.217.212.79:64310] [client 8.217.212.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUES ...
show more
[Wed Jun 17 10:37:43.115200 2026] [security2:error] [pid 321574] [client 8.217.212.79:64310] [client 8.217.212.79] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "indigi-print-merch.com.au"] [uri "/robots.txt"] [unique_id "ajHsV5Fm1OsH2thdkmyBQwAAAAQ"]
...
show less
Web App Attack
