2026-09-01 15:01:01
(1 month ago)
2026-09-01 06:00:57,696 fail2ban.actions [242592]: NOTICE [tor] Ban 45.9.149.34
2026-09-01 0 ...
show more
2026-09-01 06:00:57,696 fail2ban.actions [242592]: NOTICE [tor] Ban 45.9.149.34
2026-09-01 09:00:53,095 fail2ban.actions [242592]: NOTICE [tor] Ban 45.9.149.34
2026-09-01 12:00:55,188 fail2ban.actions [242592]: NOTICE [tor] Ban 45.9.149.34
2026-09-01 15:00:58,094 fail2ban.actions [242592]: NOTICE [tor] Ban 45.9.149.34
2026-09-01 18:01:01,102 fail2ban.actions [242592]: NOTICE [tor] Ban 45.9.149.34
show less
Brute-Force
🇫🇷
dynamix
2026-08-13 22:01:30
(1 month ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇩🇪
LRob
2026-08-07 02:55:09
(2 months ago)
CrowdSec: crowdsecurity/http-bad-user-agent | req: /wp-includes/js/dist/hooks.min.js?ver=7496969728c ...
show more
CrowdSec: crowdsecurity/http-bad-user-agent | req: /wp-includes/js/dist/hooks.min.js?ver=7496969728ca0f95732d | 2 distinct paths | UA: \x22Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/142.0.0.0 Safari/537.36\x22
show less
Bad Web Bot
🇪🇸
masterguru
2026-08-02 08:40:39
(2 months ago)
xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (5000900-122)
Web App Attack
2026-08-01 15:00:47
(2 months ago)
2026-08-01 06:00:49,786 fail2ban.actions [3625835]: NOTICE [tor] Ban 45.9.149.34
2026-08-01 ...
show more
2026-08-01 06:00:49,786 fail2ban.actions [3625835]: NOTICE [tor] Ban 45.9.149.34
2026-08-01 09:00:56,548 fail2ban.actions [3625835]: NOTICE [tor] Ban 45.9.149.34
2026-08-01 12:00:58,568 fail2ban.actions [3625835]: NOTICE [tor] Ban 45.9.149.34
2026-08-01 15:00:52,072 fail2ban.actions [3625835]: NOTICE [tor] Ban 45.9.149.34
2026-08-01 18:00:47,450 fail2ban.actions [3625835]: NOTICE [tor] Ban 45.9.149.34
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-07-15 22:37:26
(2 months ago)
(mod_security) mod_security (id:210831) triggered by 45.9.149.34 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210831) triggered by 45.9.149.34 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 18:37:18.226887 2026] [security2:error] [pid 17669:tid 17669] [client 45.9.149.34:55292] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.avaliantlife.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.avaliantlife.com"] [uri "/robots.txt"] [unique_id "algLnmopHv3vo0Wv9rrynAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-07-09 00:41:00
(3 months ago)
[SQL UNION SELECT] f2b match %{+Q}r for ^.*haproxy\[[0-9]+\]: <HOST>:.* (GET |POST ).*\?.*(UNION%20| ...
show more
[SQL UNION SELECT] f2b match %{+Q}r for ^.*haproxy\[[0-9]+\]: <HOST>:.* (GET |POST ).*\?.*(UNION%20|union%20|SELECT%20|select%20).* HTTP/1.1$
show less
SQL Injection
🇩🇪
XICTRON
2026-07-07 07:50:03
(3 months ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
🇩🇪
FeG Deutschland
2026-07-02 22:26:16
(3 months ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
2026-06-23 04:26:06
(3 months ago)
PSCDE WEBFORM SPAM 45.9.149.34 (45.9.149.34)
Web Spam
🇺🇸
TPI-Abuse
2026-06-19 23:26:10
(3 months ago)
(mod_security) mod_security (id:211220) triggered by 45.9.149.34 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:211220) triggered by 45.9.149.34 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 19:26:05.955677 2026] [security2:error] [pid 17844:tid 17844] [client 45.9.149.34:50440] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<\\\\?(?!xml\\\\s)" at ARGS:vars[0]. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "70"] [id "211220"] [rev "4"] [msg "COMODO WAF: PHP Injection Attack||atidysort.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "atidysort.com"] [uri "/index.php"] [unique_id "ajXQDVv5TbrAUVAqC1lm4gAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-06-18 09:00:04
(3 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-17 00:53:25
(3 months ago)
(mod_security) mod_security (id:240335) triggered by 45.9.149.34 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:240335) triggered by 45.9.149.34 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 20:53:17.595684 2026] [security2:error] [pid 24645:tid 24645] [client 45.9.149.34:58782] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 45.9.149.34 (+1 hits since last alert)|birdlovesfish.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "birdlovesfish.com"] [uri "/xmlrpc.php"] [unique_id "ajHv_X1D_N0cwSlboSFERQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-06-17 00:29:01
(3 months ago)
Abuse Detected (1)
Brute-Force
Web App Attack
🇩🇪
LRob
2026-06-15 21:15:04
(3 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
