🇺🇸
TPI-Abuse
2026-10-11 18:30:38
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 149.56.160.207 (crawl-149-56-160-207.dataprovid ...
show more
(mod_security) mod_security (id:210730) triggered by 149.56.160.207 (crawl-149-56-160-207.dataproviderbot.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 11 14:30:31.944556 2026] [security2:error] [pid 29857:tid 29857] [client 149.56.160.207:42137] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.elsmithpest.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.elsmithpest.com"] [uri "/[email protected] "] [unique_id "asvVx73ICGrBQCTA-HQv1AAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
filstal.org
2026-09-30 07:03:35
(3 weeks ago)
Unauthorized web crawling by known aggressive crawler or data harvesting bot detected by Fail2Ban
Bad Web Bot
🇩🇪
LRob
2026-09-28 00:37:53
(3 weeks ago)
Abusive crawler | ua: Mozilla/5.0 (compatible; Dataprovider.com) | path: /
Bad Web Bot
🇸🇪
SkyDancer
2026-09-25 18:57:07
(3 weeks ago)
Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by Sk ...
show more
Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by SkyDancer Ai. EXT-SYS-Vx
show less
Hacking
Brute-Force
SSH
🇪🇸
librebit
2026-09-03 15:54:43
(1 month ago)
Brute force
Brute-Force
🇫🇷
cityhunter_rhone
2026-09-02 17:06:06
(1 month ago)
Fail2Ban offender in jail [recidive] — 1 total attempts — tracked by mercurius-guide.com security sy ...
show more
Fail2Ban offender in jail [recidive] — 1 total attempts — tracked by mercurius-guide.com security system.
show less
SSH
Brute-Force
🇵🇱
Budyn
2026-09-01 14:19:26
(1 month ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: www.sweetpuddingtrap.top | URI: /backup.sql | UA: Mozilla/5.0 (compatible; Dataprovider.com) | BODY: [Empty / GET Request]
show less
Hacking
Web App Attack
🇹🇷
neron
2026-08-15 23:06:48
(2 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-07-29 16:19:38
(2 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
🇩🇪
Viveronese
2026-05-27 19:31:28
(4 months ago)
HTTP vulnerability scanning
Web App Attack
🇺🇸
TPI-Abuse
2026-05-21 12:08:42
(5 months ago)
(mod_security) mod_security (id:243420) triggered by 149.56.160.207 (crawl-149-56-160-207.dataprovid ...
show more
(mod_security) mod_security (id:243420) triggered by 149.56.160.207 (crawl-149-56-160-207.dataproviderbot.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 21 08:08:34.518042 2026] [security2:error] [pid 16096:tid 16096] [client 149.56.160.207:48643] ModSecurity: Access denied with code 403 (phase 3). Match of "validateByteRange 0-31" against "REQUEST_HEADERS:Accept-Encoding" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6640"] [id "243420"] [rev "4"] [msg "COMODO WAF: Information disclosure vulnerability in Eclipse Jetty before 9.2.9.v20150224 (CVE-2015-2080)||www.gallodestinationservices.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.gallodestinationservices.com"] [uri "/contact"] [unique_id "ag71wgYDskQY85YHV9Tr9gAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Viveronese
2026-05-04 16:32:39
(5 months ago)
HTTP vulnerability scanning
Web App Attack
🇫🇮
YF
2026-04-28 07:01:43
(5 months ago)
WordPress content enumeration (no WP here)
Web App Attack
🇩🇪
Viveronese
2026-04-27 08:46:03
(5 months ago)
HTTP vulnerability scanning
Web App Attack
🇺🇸
TPI-Abuse
2026-04-19 07:35:26
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 149.56.160.207 (crawl-149-56-160-207.dataprovid ...
show more
(mod_security) mod_security (id:210730) triggered by 149.56.160.207 (crawl-149-56-160-207.dataproviderbot.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 19 03:35:23.154364 2026] [security2:error] [pid 1714673:tid 1714673] [client 149.56.160.207:34769] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.anbruswebdesign.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.anbruswebdesign.com"] [uri "/[email protected] "] [unique_id "aeSFu-QzhM62WUlFrggVmAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack