🇺🇸
TPI-Abuse
2026-10-26 00:07:53
(8 hours ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 20:07:49.022621 2026] [security2:error] [pid 3755:tid 3755] [client 180.153.236.44:41291] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||321q.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "321q.com"] [uri "/"] [unique_id "at6Z1YSI-lI9BEL2UpcRZwAAADQ"], referer: https://321q.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 20:41:57
(11 hours ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 16:41:53.529833 2026] [security2:error] [pid 9205:tid 9205] [client 180.153.236.44:43527] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||edscontracting.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "edscontracting.com"] [uri "/403.html"] [unique_id "at5pkR2jHabiHSs4Nm1J8QAAAAI"], referer: http://edscontracting.com/403.html
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
rh24
2026-10-25 20:02:19
(12 hours ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 180.153.236.44 (CN/C ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 180.153.236.44 (CN/China/-)
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-25 19:36:56
(12 hours ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 15:36:50.142709 2026] [security2:error] [pid 26577:tid 26577] [client 180.153.236.44:49895] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||beachweddinginvites.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "beachweddinginvites.com"] [uri "/"] [unique_id "at5aUlh3IbaMh-TIxYGutQAAABs"], referer: https://beachweddinginvites.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-10-25 16:34:59
(15 hours ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 08:43:39
(23 hours ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 04:43:35.130695 2026] [security2:error] [pid 9922:tid 9925] [client 180.153.236.44:45869] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.aspencommission.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.aspencommission.com"] [uri "/"] [unique_id "at3BNz_653E0bIt_r2FUfgAAAQA"], referer: https://www.aspencommission.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 07:32:45
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 03:32:39.331197 2026] [security2:error] [pid 20817:tid 20817] [client 180.153.236.44:43765] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.terfgunclub.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.terfgunclub.com"] [uri "/"] [unique_id "at2wl4NttNgH_EcBriHqUAAAAAY"], referer: https://www.terfgunclub.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 06:57:54
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 02:57:50.400415 2026] [security2:error] [pid 25927:tid 25927] [client 180.153.236.44:62551] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.namisushionline.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.namisushionline.com"] [uri "/"] [unique_id "at2obt26aoW6mkXBkyJ3xgAAABc"], referer: https://www.namisushionline.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2026-10-25 06:08:35
(1 day ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 180.153.236.44 (CN/C ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 180.153.236.44 (CN/China/-)
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-25 05:56:40
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 01:56:33.803081 2026] [security2:error] [pid 12278:tid 12278] [client 180.153.236.44:46249] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.suffe.cool|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.suffe.cool"] [uri "/"] [unique_id "at2aEf8A9zB_4-bl8QQPZQAAAAo"], referer: http://www.suffe.cool/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-10-24 16:34:59
(1 day ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-10-23 16:34:59
(2 days ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 05:10:02
(3 days ago)
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210831) triggered by 180.153.236.44 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 01:09:57.897688 2026] [security2:error] [pid 26365:tid 26365] [client 180.153.236.44:41941] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||informant-systems.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "informant-systems.com"] [uri "/"] [unique_id "atrsJTwXm7XujOCLTRG_ywAAABs"], referer: http://informant-systems.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
neron
2026-10-22 10:34:59
(3 days ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇨🇭
4server
2026-10-22 07:35:09
(4 days ago)
[ThuOct2209:35:04.6924362026][security2:error][pid101975:tid102118][client180.153.236.44:0]ModSecuri ...
show more
[ThuOct2209:35:04.6924362026][security2:error][pid101975:tid102118][client180.153.236.44:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(http://bsalsa\\\\\\\\.com\|\^site24x7\)\"against\"REQUEST_HEADERS:user-agent\"required.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"282\"][id\"330094\"][rev\"5\"][msg\"Atomicorp.comWAFRules:CompromisedUser-AgentAgentAttackblocked\"][severity\"CRITICAL\"][hostname\"www.benvenutialfood.ch\"][uri\"/\"][unique_id\"atm8qJiqsi_K3hV3PA5ZEAAAANg\"]\,referer:https://www.benvenutialfood.ch/
show less
Hacking
Web App Attack
