2026-04-25 09:27:34
(1 month ago)
scanning for potential vulnerable apps (wordpress etc.) and database accesses (GHR). Requested URI: ...
show more
scanning for potential vulnerable apps (wordpress etc.) and database accesses (GHR). Requested URI: /llms.txt
show less
Web App Attack
🇨🇭
filou812
2026-01-31 03:24:35
(4 months ago)
urls tried are "/sitemap.xml", "/llms.txt", "/humans.txt", "/security.txt", "/.well-known/security.t ...
show more
urls tried are "/sitemap.xml", "/llms.txt", "/humans.txt", "/security.txt", "/.well-known/security.txt"
show less
Web App Attack
🇬🇧
Shadymint
2026-01-11 09:11:51
(4 months ago)
url probing
Web App Attack
🇨🇭
blinx
2026-01-04 16:45:06
(5 months ago)
Suspicious activity detected by Modsecurity
Web Spam
Port Scan
Hacking
Bad Web Bot
Web App Attack
🇯🇵
S.O.B.A. Dev.
2025-09-18 22:15:25
(8 months ago)
Web vulnerability scanning
Web Spam
Brute-Force
Web App Attack
2025-09-11 18:38:32
(8 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-09-11 11:14:09
(8 months ago)
Excessive crawling/scraping
Hacking
Brute-Force
2025-07-28 09:52:28
(10 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2025-07-21 21:17:12
(10 months ago)
Excessive crawling/scraping
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2025-06-25 09:47:10
(11 months ago)
(mod_security) mod_security (id:243420) triggered by 149.56.150.78 (crawl-149-56-150-78.dataprovider ...
show more
(mod_security) mod_security (id:243420) triggered by 149.56.150.78 (crawl-149-56-150-78.dataproviderbot.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 25 05:47:05.074072 2025] [security2:error] [pid 80974:tid 80974] [client 149.56.150.78:43737] ModSecurity: Access denied with code 403 (phase 3). Match of "validateByteRange 0-31" against "REQUEST_HEADERS:Accept-Encoding" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6640"] [id "243420"] [rev "4"] [msg "COMODO WAF: Information disclosure vulnerability in Eclipse Jetty before 9.2.9.v20150224 (CVE-2015-2080)||www.disenowebprofesional.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.disenowebprofesional.com"] [uri "/contacto/"] [unique_id "aFvFmWWvxBv66l2xkCrGGgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-06-22 22:50:44
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 149.56.150.78 (crawl-149-56-150-78.dataprovider ...
show more
(mod_security) mod_security (id:210730) triggered by 149.56.150.78 (crawl-149-56-150-78.dataproviderbot.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 22 18:50:38.884928 2025] [security2:error] [pid 1413280:tid 1413280] [client 149.56.150.78:47299] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.citystreetsalon.com|F|2"] [data ".fionnardesign.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.citystreetsalon.com"] [uri "/www.fionnardesign.com"] [unique_id "aFiIvvePh3xPMDZQKJyNpAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
CryptoYakari
2025-05-10 20:41:48
(1 year ago)
149.56.150.78 - - [10/May/2025:23:41:45 +0300] "GET /sitemap.xml HTTP/1.0" 404 3184 "-" "Mozilla/5.0 ...
show more
149.56.150.78 - - [10/May/2025:23:41:45 +0300] "GET /sitemap.xml HTTP/1.0" 404 3184 "-" "Mozilla/5.0 (compatible; Dataprovider.com)"
149.56.150.78 - - [10/May/2025:23:41:46 +0300] "GET /ads.txt HTTP/1.0" 404 3184 "-" "Mozilla/5.0 (compatible; Dataprovider.com)"
149.56.150.78 - - [10/May/2025:23:41:46 +0300] "GET /humans.txt HTTP/1.0" 404 3184 "-" "Mozilla/5.0 (compatible; Dataprovider.com)"
149.56.150.78 - - [10/May/2025:23:41:46 +0300] "GET /security.txt HTTP/1.0" 404 3184 "-" "Mozilla/5.0 (compatible; Dataprovider.com)"
149.56.150.78 - - [10/May/2025:23:41:47 +0300] "GET /.well-known/security.txt HTTP/1.0" 404 3184 "-" "Mozilla/5.0 (compatible; Dataprovider.com)"
...
show less
Web Spam
Blog Spam
Bad Web Bot
Web App Attack
🇺🇸
Charlesiv
2025-05-04 21:06:55
(1 year ago)
Triggered Cloudflare WAF (firewallCustom) from CA.
Action taken: BLOCK
ASN: 16276 (OVH)
Protocol: HT ...
show more
Triggered Cloudflare WAF (firewallCustom) from CA.
Action taken: BLOCK
ASN: 16276 (OVH)
Protocol: HTTP/1.1 (GET method)
Endpoint: /
Timestamp: 2025-05-04T20:44:24Z
Ray ID: 93aad5ff4e7339f2
UA: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.90 Safari/537.36 React.org
show less
Bad Web Bot
2025-04-29 01:21:18
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-04-11 21:26:29
(1 year ago)
(mod_security) mod_security (id:243420) triggered by 149.56.150.78 (crawl-149-56-150-78.dataprovider ...
show more
(mod_security) mod_security (id:243420) triggered by 149.56.150.78 (crawl-149-56-150-78.dataproviderbot.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 11 17:26:24.417808 2025] [security2:error] [pid 26110:tid 26110] [client 149.56.150.78:47851] [client 149.56.150.78] ModSecurity: Access denied with code 403 (phase 3). Match of "validateByteRange 0-31" against "REQUEST_HEADERS:Accept-Encoding" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6640"] [id "243420"] [rev "4"] [msg "COMODO WAF: Information disclosure vulnerability in Eclipse Jetty before 9.2.9.v20150224 (CVE-2015-2080)||relationshipecology.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "relationshipecology.com"] [uri "/consulting.html"] [unique_id "Z_mJAM6tZwVdx3ZcZGDXIgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack