2026-11-09 23:02:20
UTC ·
(3 hours ago)
[Mon Nov 09 17:37:43.065328 2026] [:error] [pid 3218095:tid 140068429731584] [client 51.158.72.76:34040] [client 51.158.72.76] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/opt ...
show more
[Mon Nov 09 17:37:43.065328 2026] [:error] [pid 3218095:tid 140068429731584] [client 51.158.72.76:34040] [client 51.158.72.76] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/opt/owasp-crs-4.26.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 50)"] [ver "OWASP_CRS/4.26.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "digitalcrete.ims.forth.gr"] [uri "/"] [unique_id "avHoxq@886IccM4SVjRRoQAAAI0"]
[Mon Nov 09 17:37:43.480051 2026] [:error] [pid 3226568:tid 140068589127424] [client 51.158.72.76:34048] [client 51.158.72.76] ModSecurity: Access denied with code 400 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "81"] [id "200003"] [msg "Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM 0, IQ 0, IP 0, IH 0, FL 0"] [hostna
...
show less
Hacking
Web App Attack
🇺🇸
HamSammich
2026-11-09 12:34:40
UTC ·
(14 hours ago)
Automated sensor: 4 HTTPS connection/probe attempts over the last 24h (latest 2026-11-09T12:34Z).
Port Scan
Web App Attack
🇺🇸
Rip
2026-11-09 10:01:56
UTC ·
(16 hours ago)
PHP Injection Attack – High-Risk PHP Function Call Found
Web App Attack
🇬🇧
consul.to
2026-11-09 09:16:47
UTC ·
(17 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
FeG Deutschland
2026-11-09 05:19:46
UTC ·
(21 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇪🇸
pipeline.es
2026-11-09 03:09:16
UTC ·
(23 hours ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Thu Nov 05 16:58:02.735443 2026] [:error] [pid 1522870] [client 51.158.72.76:35336] [client 51.158.72.76] WAF: Access denied with code 403 (phase 2). Operator GT matched ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Thu Nov 05 16:58:02.735443 2026] [:error] [pid 1522870] [client 51.158.72.76:35336] [client 51.158.72.76] WAF: Access denied with code 403 (phase 2). Operator GT matched 0 at TX:php_injection_score. [file \"/etc/httpd/conf.d/zz-WAF-php2shell.conf\"] [line \"17\"] [id \"9261008\"] [msg \"php2shell: inyeccion PHP (CRS 933) en bloqueo\"] [tag \"php2shell\"] [hostname \"mafertravelworld.com\"] [uri \ | ASN: Scaleway S.a.s. | Country: FR
show less
Web App Attack
2026-11-08 18:00:11
UTC ·
(1 day ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
🇩🇪
4server
2026-11-08 12:54:11
UTC ·
(1 day ago)
[SunNov0813:54:07.4067392026][security2:error][pid4140315:tid4140433][client51.158.72.76:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\|wget\|python\|nikto\|sqlmap\|acunetix\|fimap\|dirbuster\|cmsmap\)\"atREQUEST_HEADERS ...
show more
[SunNov0813:54:07.4067392026][security2:error][pid4140315:tid4140433][client51.158.72.76:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\|wget\|python\|nikto\|sqlmap\|acunetix\|fimap\|dirbuster\|cmsmap\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"217\"][id\"990210\"][msg\"Suspicioususer-agentblocked\"][hostname\"autoeuro.lv\"][uri\"/\"][unique_id\"avBw78VoDSJN4aQQh0yY_QAAARI\"]
show less
Port Scan
Brute-Force
Web App Attack
🇳🇱
Ike57
2026-11-08 07:09:12
UTC ·
(1 day ago)
Detected activity: Proxycheck.io Risk score: 33%; GetIPIntel score: 1 (= high risk); Unauthorized web crawling by known aggressive crawler or data harvesting bot detected and subsequently denied by web application firewall; Datacenter IP detected; Is ...
show more
Detected activity: Proxycheck.io Risk score: 33%; GetIPIntel score: 1 (= high risk); Unauthorized web crawling by known aggressive crawler or data harvesting bot detected and subsequently denied by web application firewall; Datacenter IP detected; Is also listed in DNSBL: (Spamhaus ZEN) | User-Agent: Python/3.10 aiohttp/3.14.5
show less
Bad Web Bot
🇪🇸
pipeline.es
2026-11-08 01:22:07
UTC ·
(2 days ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Thu Nov 05 16:58:02.735443 2026] [:error] [pid 1522870] [client 51.158.72.76:35336] [client 51.158.72.76] WAF: Access denied with code 403 (phase 2). Operator GT matched ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Thu Nov 05 16:58:02.735443 2026] [:error] [pid 1522870] [client 51.158.72.76:35336] [client 51.158.72.76] WAF: Access denied with code 403 (phase 2). Operator GT matched 0 at TX:php_injection_score. [file \"/etc/httpd/conf.d/zz-WAF-php2shell.conf\"] [line \"17\"] [id \"9261008\"] [msg \"php2shell: inyeccion PHP (CRS 933) en bloqueo\"] [tag \"php2shell\"] [hostname \"mafertravelworld.com\"] [uri \ | ASN: Scaleway S.a.s. | Country: FR
show less
Web App Attack
🇨🇦
1gz
2026-11-08 00:14:53
UTC ·
(2 days ago)
Triggered Cloudflare WAF (firewallManaged) from FR.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /
UA: Python/3.10 aiohttp/3.14.5
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
Bad Web Bot
🇳🇱
homeshowdomain.nl
2026-11-07 22:59:37
UTC ·
(2 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-06.
Web App Attack
SSH
Hacking
2026-11-07 13:19:11
UTC ·
(2 days ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇩🇪
FeG Deutschland
2026-11-07 12:49:18
UTC ·
(2 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇺🇸
HamSammich
2026-11-07 03:33:49
UTC ·
(2 days ago)
Automated sensor: 4 HTTPS connection/probe attempts over the last 24h (latest 2026-11-07T03:33Z).
Port Scan
Web App Attack
