2024-03-08 01:26:29
(2 years ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2023-11-27 00:29:54
(2 years ago)
(mod_security) mod_security (id:210831) triggered by 154.6.13.132 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210831) triggered by 154.6.13.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 26 19:29:49.096651 2023] [security2:error] [pid 30917:tid 47589271193344] [client 154.6.13.132:42546] [client 154.6.13.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.dpscsde.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.dpscsde.com"] [uri "/robots.txt"] [unique_id "ZWPi_Q8Qbj_zCl0TMUBMOwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2023-11-26 20:59:21
(2 years ago)
(mod_security) mod_security (id:210831) triggered by 154.6.13.132 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210831) triggered by 154.6.13.132 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 26 15:59:14.511898 2023] [security2:error] [pid 19492] [client 154.6.13.132:39392] [client 154.6.13.132] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.pearsonsarahdesign.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.pearsonsarahdesign.com"] [uri "/robots.txt"] [unique_id "ZWOxoj6G4MDv1jUK6W-HBgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
AMRE
2023-11-26 10:07:26
(2 years ago)
Probing PHP vulnerabilities
Brute-Force
🇺🇸
Visualizes
2023-11-07 13:41:10
(2 years ago)
Request overload
Brute-Force
🇺🇸
bigscoots.com
2023-11-06 22:42:00
(2 years ago)
(PERMBLOCK) 154.6.13.132 (US/United States/-) has had more than 4 temp blocks in the last 86400 secs ...
show more
(PERMBLOCK) 154.6.13.132 (US/United States/-) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: 1; Trigger: LF_PERMBLOCK_COUNT; Logs:
show less
Brute-Force
SSH
🇫🇷
vereinshosting
2023-11-06 18:33:28
(2 years ago)
\[2023-11-06 18:33:26 +0000\] \[www\] MALICIOUS BOT 154.6.13.132
...
Bad Web Bot
Web App Attack
🇩🇪
rh24
2023-11-06 07:24:33
(2 years ago)
(mod_security) mod_security triggered on hostname [redacted] 154.6.13.132 (US/United States/-): (CF ...
show more
(mod_security) mod_security triggered on hostname [redacted] 154.6.13.132 (US/United States/-): (CF_ENABLE)
show less
SQL Injection
🇬🇧
mangomad
2023-11-05 19:16:12
(2 years ago)
Repeated Apache mod_security rule triggers
Brute-Force
Web App Attack
🇺🇸
mnsf
2023-11-05 11:07:13
(2 years ago)
Too many Status 40X (13)
Request Overload (172)
Brute-Force
Web App Attack
🇺🇸
ChamberofCommerce.com
2023-08-30 18:37:22
(2 years ago)
Unauthorized Scraping Attempt - More then 225 Pages Requested in a 24 hour period - Total Requested ...
show more
Unauthorized Scraping Attempt - More then 225 Pages Requested in a 24 hour period - Total Requested Before Block:226
show less
Bad Web Bot
🇺🇸
vestibtech
2023-08-04 22:10:23
(2 years ago)
Aug 4 16:10:22 Host-KLAX-C amavis[885945]: (885945-02) Blocked SPAM {RejectedInternal}, AM.PDP-SOCK ...
show more
Aug 4 16:10:22 Host-KLAX-C amavis[885945]: (885945-02) Blocked SPAM {RejectedInternal}, AM.PDP-SOCK LOCAL [154.6.13.132] [154.6.13.132] <[email protected] > -> <[email protected] >, Queue-ID: 558761C06FA, mail_id: wQhllV808nh2, Hits: 14.148, size: 3631, 4426 ms
...
show less
Email Spam
🇺🇸
hostseries
2023-07-13 21:17:00
(3 years ago)
Trigger: LF_DISTATTACK
Brute-Force
🇺🇸
hostseries
2023-07-12 03:37:40
(3 years ago)
Trigger: LF_DISTATTACK
Brute-Force
🇿🇦
Birdflew
2023-06-06 18:24:17
(3 years ago)
Port scanning
Hacking