🇺🇸
TPI-Abuse
2025-03-31 00:22:54
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 2001:41d0:1004:be::1 (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210730) triggered by 2001:41d0:1004:be::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 30 20:22:50.773642 2025] [security2:error] [pid 22626:tid 22626] [client 2001:41d0:1004:be::1:33466] [client 2001:41d0:1004:be::1] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.stansco.com|F|2"] [data ".australiancasinoclub.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.stansco.com"] [uri "/netchess/\\xe2\\x80\\x9chttp:/www.australiancasinoclub.com"] [unique_id "Z-ngWmy-aqit7ZDDIzx4KwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Hazzard
2025-03-30 00:18:47
(1 year ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 2001:41d0:1004:be::1 ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 2001:41d0:1004:be::1 (FR/France/-)
show less
Bad Web Bot
2025-03-29 04:12:39
(1 year ago)
Scenario: crowdsecurity/http-bad-user-agent
Bad Web Bot
🇩🇪
Hazzard
2025-03-26 04:08:35
(1 year ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted])
Bad Web Bot
🇩🇪
MarkGGN
2025-03-24 23:50:14
(1 year ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent
Bad Web Bot
Web App Attack
2025-03-24 23:32:09
(1 year ago)
Fail2Ban: IP flagged for web exploits and DDoS attack attempts (Categories 4, 21).
DDoS Attack
Web App Attack
🇬🇧
Mendip_Defender
2025-03-24 03:59:01
(1 year ago)
2001:41d0:1004:be::1 - - [24/Mar/2025:03:58:57 +0000] "GET /robots.txt HTTP/1.1" 403 146 "-" "Mozill ...
show more
2001:41d0:1004:be::1 - - [24/Mar/2025:03:58:57 +0000] "GET /robots.txt HTTP/1.1" 403 146 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)"
...
show less
Bad Web Bot
2025-03-24 01:31:54
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-03-24 01:31:28
(1 year ago)
(mod_security) mod_security (id:210381) triggered by 2001:41d0:1004:be::1 (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210381) triggered by 2001:41d0:1004:be::1 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 23 21:31:23.194354 2025] [security2:error] [pid 19866:tid 19888] [client 2001:41d0:1004:be::1:39846] [client 2001:41d0:1004:be::1] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "82"] [id "210381"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||orthopedica.org|F|4"] [data "REQUEST_URI=/wp-content/languages/%1$s"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "orthopedica.org"] [uri "/wp-content/languages/%1$s"] [unique_id "Z-C161eX294r4o6d7msfOwAAARI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-03-21 12:12:09
(1 year ago)
2001:41d0:1004:be::1 - - [21/Mar/2025:13:09:16 +0100] "GET /database/?c=aardrijkskunde;algemene-wete ...
show more
2001:41d0:1004:be::1 - - [21/Mar/2025:13:09:16 +0100] "GET /database/?c=aardrijkskunde;algemene-wetenschaptechniek;exacte-vakken;informatica;kunstvakken;maatschappijleer;maatschappijvakken;natuurkunde/page/4/ HTTP/1.1" 404 24309 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)"
2001:41d0:1004:be::1 - - [21/Mar/2025:13:09:18 +0100] "GET /database/?c=aardrijkskunde;algemene-wetenschaptechniek;exacte-vakken;informatica;kunstvakken;maatschappijleer;maatschappijvakken;natuurkunde/page/5/ HTTP/1.1" 404 24309 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)"
2001:41d0:1004:be::1 - - [21/Mar/2025:13:09:21 +0100] "GET /database/?c=aardrijkskunde;algemene-wetenschaptechniek;exacte-vakken;informatica;kunstvakken;maatschappijleer;maatschappijvakken;natuurkunde/page/6/ HTTP/1.1" 404 24309 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)"
2001:41d0:1004:be::1 - - [21/Mar/2025:13:09:22 +0100] "GET /database/?c=aardrijkskunde;algemene-wetenschaptec
...
show less
DDoS Attack
🇬🇧
Mendip_Defender
2025-03-18 21:02:26
(1 year ago)
2001:41d0:1004:be::1 - - [18/Mar/2025:21:02:22 +0000] "GET /robots.txt HTTP/1.1" 403 146 "-" "Mozill ...
show more
2001:41d0:1004:be::1 - - [18/Mar/2025:21:02:22 +0000] "GET /robots.txt HTTP/1.1" 403 146 "-" "Mozilla/5.0 (compatible; MJ12bot/v1.4.8; http://mj12bot.com/)"
...
show less
Bad Web Bot
2025-03-16 04:27:59
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇬🇧
Buster
2025-03-14 18:38:00
(1 year ago)
Continual pointless script kiddie DOS attack attempts on multiple sites from Perm Blocked ASN and co ...
show more
Continual pointless script kiddie DOS attack attempts on multiple sites from Perm Blocked ASN and country:
show less
DDoS Attack
Open Proxy
Hacking
Web App Attack
2025-03-14 11:44:50
(1 year ago)
Scenario: crowdsecurity/http-bad-user-agent
Bad Web Bot
2025-03-14 06:56:32
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH