5.49.94.136

Botnet flood DDOS activity

[Tue Sep 01 09:34:13.132475 2026] [security2:error] [pid 8255:tid 8599] [client 5.49.94.136:53992] [client 5.49.94.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:(?:alter|create|drop)[[:space:]]*(?:column|database|procedur ... show more [Tue Sep 01 09:34:13.132475 2026] [security2:error] [pid 8255:tid 8599] [client 5.49.94.136:53992] [client 5.49.94.136] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:(?:alter|create|drop)[[:space:]]*(?:column|database|procedure|table) |delete[[:space:]] .{1,100}+ update [a-z0-9]+ set .{1,100}+=|union all select |\\\\bunion\\\\b.{1,100}?\\\\bselect\\\\b.*[a-z0-9]+ from |select (?:load_file|char ?\\\\()|(?:insert|remark)tes ..." at ARGS:email. [file "/etc/apache2/conf.d/modsec2/10_asl_rules.conf"] [line "318"] [id "340144"] [rev "35"] [msg "Atomicorp.com UNSUPPORTED DELAYED Rules: Generic SQL injection protection 2"] [data "get /subscribe/password_lost.php?email=%29%2f**%2fand%2f**%2f%28314015679%3d314015679%2f**%2funion%2f**%2fall%2f**%2fselect%2f**%2f%27twnvfbnadfwtpkhgvippruvwmlrkktyf%27--%2f**%2figrrrp http/1.1"] [severity "CRITICAL"] [hostname "holtindependent.com"] [uri "/subscribe/password_lost.php"] [unique_id "apbUVYl7qGwm2t751N_i9AAAAWo"] show less

| Multiple SQL injection attempts from same source ip.(multiple servers)

5.49.94.136 - - [12/Aug/2026:05:44:15 +0200] "GET /lka/Record/c0004228/Description?lng=sv&print=1 HTTP/1.1" 200 12655 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.6943.53 Safari/537.36" ...