2026-05-22 03:47:21
(2 weeks ago)
Total IP rate limit exceeded: 6 q/min (Magento Site) (Botnet activity attributed to: Angara Technolo ...
show more
Total IP rate limit exceeded: 6 q/min (Magento Site) (Botnet activity attributed to: Angara Technologies Group / mikhail-smirnov-79830322)
show less
Hacking
🇨🇭
backslash
2026-05-20 23:57:00
(2 weeks ago)
block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-16 22:26:15
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 45.147.233.13 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 45.147.233.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 16 18:26:08.559511 2026] [security2:error] [pid 15379:tid 15379] [client 45.147.233.13:48851] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Barcalounger/Images/Hansen II/Thumbs.db"] [unique_id "agjvAKgQSU4fvUutEAlFcgAAABQ"], referer: https://vitalitywebb.com/backstore/Barcalounger/Images/Hansen%20II/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-04-29 03:03:12
(1 month ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 45.147.233.13 (US/United States/-): 1 ...
show more
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 45.147.233.13 (US/United States/-): 1 in the last 3600 secs (0-195)
show less
Hacking
🇺🇸
TPI-Abuse
2026-04-27 10:18:05
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 45.147.233.13 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 45.147.233.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 06:17:58.958395 2026] [security2:error] [pid 27382:tid 27382] [client 45.147.233.13:13093] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.expreso.aguasolar.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.expreso.aguasolar.com"] [uri "/s3cmd.ini"] [unique_id "ae831lDWUgGgi1Pexzz6_wAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-26 11:25:46
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 45.147.233.13 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 45.147.233.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 26 07:25:43.028190 2026] [security2:error] [pid 19976:tid 19976] [client 45.147.233.13:33999] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.goldenvalley1.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.goldenvalley1.com"] [uri "/s3cmd.ini"] [unique_id "ae32N7709s1nrBcfrCMT3wAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-04-16 15:12:01
(1 month ago)
block ruleset CC531825F9395F9A07FB06C1247C46770A2690F8
Bad Web Bot
2025-12-16 06:53:57
(5 months ago)
Web App Attack
Brute-Force
Web App Attack
🇺🇸
fbarela
2025-10-14 15:00:14
(7 months ago)
FortiGate SSL VPN login failures.
Hacking
Brute-Force
🇧🇷
hostseries
2025-09-16 21:31:30
(8 months ago)
Trigger: LF_DISTATTACK
Brute-Force
🇺🇸
TPI-Abuse
2025-08-14 07:27:10
(9 months ago)
(mod_security) mod_security (id:210831) triggered by 45.147.233.13 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210831) triggered by 45.147.233.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 14 03:27:00.103171 2025] [security2:error] [pid 18601:tid 18601] [client 45.147.233.13:12751] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||thechoiceint.com|F|4"] [data "a href="] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "thechoiceint.com"] [uri "/webalizer/usage_201009.html"] [unique_id "aJ2PxMwY5yIL8o9fcxYtHQAAABs"], referer: http://thechoiceint.com/
show less
Brute-Force
Bad Web Bot
Web App Attack