🇫🇷
Bensay
2026-09-23 09:06:47
(6 hours ago)
Repeated suspicious HTTP service scan against a blocked web sinkhole; threshold=3 events/10m; result ...
show more
Repeated suspicious HTTP service scan against a blocked web sinkhole; threshold=3 events/10m; result=blocked; user-agent=Mozilla/5.0 (compatible; SecurityTxtSurveyBot/1.0; recherche journalistique sur l'adoption de security.txt sur le TLD .fr; contact: [email protected] )
show less
Port Scan
🇺🇸
TPI-Abuse
2026-09-23 05:33:10
(9 hours ago)
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 23 01:33:05.001589 2026] [security2:error] [pid 31629:tid 31629] [client 2a01:e0a:ba9:de60::9b13:bd34:49822] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||lemay.design|F|4"] [data "SurveyBot"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "lemay.design"] [uri "/.well-known/security.txt"] [unique_id "arNkkPgWj65-ZkV9zPsy3AAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Hazael
2026-09-23 04:52:23
(10 hours ago)
SNOOPING - intended to probe for or exploit website vulnerabilities. From: Paris, France - ProXad ne ...
show more
SNOOPING - intended to probe for or exploit website vulnerabilities. From: Paris, France - ProXad network / Free (AS12322 Free SAS) - Agent: Mozilla/5.0 (compatible; SecurityTxtSurveyBot/1.0; recherche journalistique sur l'adoption de security.txt sur le TLD .fr; contact: [email protected] )
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 18:03:41
(21 hours ago)
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 14:03:37.703144 2026] [security2:error] [pid 15421:tid 15421] [client 2a01:e0a:ba9:de60::9b13:bd34:50296] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||suffe.cool|F|4"] [data "SurveyBot"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "suffe.cool"] [uri "/.well-known/security.txt"] [unique_id "arLC-f_-vOIaZCUTVj9yugAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 14:07:06
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 10:07:00.185744 2026] [security2:error] [pid 618:tid 692] [client 2a01:e0a:ba9:de60::9b13:bd34:56506] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||dba.center|F|4"] [data "SurveyBot"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "dba.center"] [uri "/.well-known/security.txt"] [unique_id "arKLhIsR8AwdqEFzoJVHigAAANY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 08:53:44
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 04:53:37.542446 2026] [security2:error] [pid 23323:tid 23323] [client 2a01:e0a:ba9:de60::9b13:bd34:51538] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||cityoffoley.gov|F|4"] [data "SurveyBot"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "cityoffoley.gov"] [uri "/.well-known/security.txt"] [unique_id "arJCEVT7dOSOHNsJnCvECAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 07:43:34
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 03:43:26.868456 2026] [security2:error] [pid 30393:tid 30393] [client 2a01:e0a:ba9:de60::9b13:bd34:54982] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||cynosure.email|F|4"] [data "SurveyBot"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "cynosure.email"] [uri "/.well-known/security.txt"] [unique_id "arIxnnPfMFwTeaQACAH4eQAAAEY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-22 06:41:45
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 22 02:41:39.903348 2026] [security2:error] [pid 14470:tid 14470] [client 2a01:e0a:ba9:de60::9b13:bd34:48688] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||andrewweigel.name|F|4"] [data "SurveyBot"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "andrewweigel.name"] [uri "/.well-known/security.txt"] [unique_id "arIjI67es8s9YHjnkZxThgAAAFU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Mendip_Defender
2026-09-22 03:33:53
(1 day ago)
[22/Sep/2026:04:34:10.009333 +0100] arH3MXhRxfi7dZxnsWKlKQAAAAI 2a01:e0a:ba9:de60::9b13:bd34 58060 1 ...
show more
[22/Sep/2026:04:34:10.009333 +0100] arH3MXhRxfi7dZxnsWKlKQAAAAI 2a01:e0a:ba9:de60::9b13:bd34 58060 188.246.206.60 7081
[22/Sep/2026:04:34:10.262679 +0100] arH3MnhRxfi7dZxnsWKlKgAAAA0 2a01:e0a:ba9:de60::9b13:bd34 58064 188.246.206.60 7081
...
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-09-21 23:02:37
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 19:02:29.370303 2026] [security2:error] [pid 2854:tid 2854] [client 2a01:e0a:ba9:de60::9b13:bd34:43038] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||alknetso.name|F|4"] [data "SurveyBot"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "alknetso.name"] [uri "/.well-known/security.txt"] [unique_id "arG3hShksAXUJIcFHN6bzAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 17:27:35
(1 day ago)
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 13:27:25.757175 2026] [security2:error] [pid 29544:tid 29544] [client 2a01:e0a:ba9:de60::9b13:bd34:41722] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||winders.name|F|4"] [data "SurveyBot"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "winders.name"] [uri "/.well-known/security.txt"] [unique_id "arFo_T6S-2PjTgqyIA5eIAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 05:54:51
(2 days ago)
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 01:54:43.675691 2026] [security2:error] [pid 27171:tid 27171] [client 2a01:e0a:ba9:de60::9b13:bd34:52110] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||bofill.name|F|4"] [data "SurveyBot"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "bofill.name"] [uri "/.well-known/security.txt"] [unique_id "arDGozJlUsD2WhEioj-NGQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 23:48:41
(2 days ago)
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 19:48:36.749905 2026] [security2:error] [pid 9367:tid 9367] [client 2a01:e0a:ba9:de60::9b13:bd34:59860] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||llew.life|F|4"] [data "SurveyBot"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "llew.life"] [uri "/.well-known/security.txt"] [unique_id "arBw1PRJvOzVO3Jp4VpiPgAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 23:19:26
(2 days ago)
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 19:19:21.015429 2026] [security2:error] [pid 1584:tid 1584] [client 2a01:e0a:ba9:de60::9b13:bd34:43300] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||bees.properties|F|4"] [data "SurveyBot"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "bees.properties"] [uri "/.well-known/security.txt"] [unique_id "arBp-aVbHAViL9oc_Dn_gQAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 00:37:38
(3 days ago)
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210831) triggered by 2a01:e0a:ba9:de60::9b13:bd34 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 19 20:37:32.386800 2026] [security2:error] [pid 22755:tid 22755] [client 2a01:e0a:ba9:de60::9b13:bd34:36280] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||dubb.productions|F|4"] [data "SurveyBot"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "dubb.productions"] [uri "/.well-known/security.txt"] [unique_id "aq8qzGe6aiJH81jEQEyRvwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack