🇦🇺
MAGIC
2025-02-24 17:00:16
(1 year ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2025-02-24 16:54:25
(1 year ago)
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in ...
show more
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 24 11:54:20.634244 2025] [security2:error] [pid 1995374:tid 1995374] [client 162.19.83.106:41698] [client 162.19.83.106] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||www.elevese.com|F|4"] [data "GET ?C=N;O=D HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.elevese.com"] [uri "/"] [unique_id "Z7ykPFoCeIsW1TjkJeHECwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-02-24 10:53:31
(1 year ago)
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in ...
show more
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 24 05:53:28.518867 2025] [security2:error] [pid 31855:tid 31855] [client 162.19.83.106:57162] [client 162.19.83.106] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||www.eaglesnestbandb.com|F|4"] [data "GET ?C=S;O=A HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.eaglesnestbandb.com"] [uri "/"] [unique_id "Z7xPqOyRy5es2u6o-EIVCwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-02-24 09:58:40
(1 year ago)
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in ...
show more
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 24 04:58:33.498841 2025] [security2:error] [pid 18521:tid 18521] [client 162.19.83.106:44718] [client 162.19.83.106] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||texascash.com|F|4"] [data "GET ?C=D;O=A HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "texascash.com"] [uri "/"] [unique_id "Z7xCyTVsDxGpsNXwAkqRlgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-02-24 09:35:38
(1 year ago)
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in ...
show more
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 24 04:35:31.593259 2025] [security2:error] [pid 21094:tid 21094] [client 162.19.83.106:38732] [client 162.19.83.106] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||www.valuerec.com|F|4"] [data "GET ?C=S;O=A HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.valuerec.com"] [uri "/"] [unique_id "Z7w9Y3XbLDcr9zXql6xQrAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Echobit
2025-02-14 13:36:58
(1 year ago)
Crawling, BadBot, Fake User-Agent, Ignore robots.txt
Hacking
Bad Web Bot
🇩🇪
SCHAPPY
2025-02-14 12:35:01
(1 year ago)
Rotating user agents detected to hide crawling or other malicious activitiy, blocked.
Brute-Force
Web App Attack
2025-02-13 12:45:41
(1 year ago)
ALTB WEBFORM SPAM 162.19.83.106 (ns3223011.ip-162-19-83.eu)
Web Spam
🇨🇦
polycoda
2025-02-13 11:13:10
(1 year ago)
📄 Probes for tons of inexistent files and/or PHP scripts
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-02-10 16:09:35
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in ...
show more
(mod_security) mod_security (id:210730) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 10 11:09:30.825176 2025] [security2:error] [pid 16642:tid 16642] [client 162.19.83.106:47510] [client 162.19.83.106] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.dalessalesandservice.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.dalessalesandservice.com"] [uri "/[email protected] "] [unique_id "Z6okuk08fFSDV1Y8ikSF2QAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-02-10 05:06:43
(1 year ago)
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in ...
show more
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 10 00:06:40.361765 2025] [security2:error] [pid 16590:tid 16590] [client 162.19.83.106:50640] [client 162.19.83.106] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||www.jsw4.net|F|4"] [data "GET ?C=S;O=A HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.jsw4.net"] [uri "/"] [unique_id "Z6mJYEL6G0vVQlwHLlHnWQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-02-09 17:17:37
(1 year ago)
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in ...
show more
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 09 12:17:33.429487 2025] [security2:error] [pid 5182:tid 5182] [client 162.19.83.106:60480] [client 162.19.83.106] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||www.wilcoxlawllc.com|F|4"] [data "GET ?C=M;O=A HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.wilcoxlawllc.com"] [uri "/"] [unique_id "Z6jjLe_-_LaMxXquJYBv6wAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-02-09 09:18:54
(1 year ago)
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in ...
show more
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 09 04:18:48.269638 2025] [security2:error] [pid 1035881:tid 1035881] [client 162.19.83.106:58492] [client 162.19.83.106] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||www.toys4themind.com|F|4"] [data "GET ?C=D;O=A HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.toys4themind.com"] [uri "/"] [unique_id "Z6hy-Feyg2hqDBp6NXbHIgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-02-09 08:02:24
(1 year ago)
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in ...
show more
(mod_security) mod_security (id:217210) triggered by 162.19.83.106 (ns3223011.ip-162-19-83.eu): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 09 03:02:19.460208 2025] [security2:error] [pid 19600:tid 19600] [client 162.19.83.106:43498] [client 162.19.83.106] ModSecurity: Access denied with code 403 (phase 2). Match of "rx ^(?i:(?:[a-z]{3,10}\\\\s+(?:\\\\w{3,7}?://[\\\\w\\\\-\\\\./]*(?::\\\\d+)?)?/[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?|connect (?:\\\\d{1,3}\\\\.){3}\\\\d{1,3}\\\\.?(?::\\\\d+)?|options \\\\*)\\\\s+[\\\\w\\\\./]+|get /[^?#]*(?:\\\\?[^#\\\\s]*)?(?:#[\\\\S]*)?)$" against "REQUEST_LINE" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "114"] [id "217210"] [rev "1"] [msg "COMODO WAF: Invalid HTTP Request Line||www.thehandyfamily.net|F|4"] [data "GET ?C=S;O=A HTTP/1.1"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.thehandyfamily.net"] [uri "/"] [unique_id "Z6hhCwIzvuRbXbrEwgVBywAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
conseilgouz
2025-02-09 07:05:36
(1 year ago)
saw-(visforms) : try to access forms...
Hacking