🇦🇺
paulshipley.com.au
2026-06-23 15:53:00
(10 hours ago)
[Wed Jun 24 01:53:00.452060 2026] [security2:error] [pid 265094] [client 54.81.43.75:57508] [client ...
show more
[Wed Jun 24 01:53:00.452060 2026] [security2:error] [pid 265094] [client 54.81.43.75:57508] [client 54.81.43.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/feed"] [unique_id "ajqr3DazFmTaxYDGbCcLlgAAAAU"]
...
show less
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-23 14:06:52
(12 hours ago)
[Wed Jun 24 00:06:52.555141 2026] [security2:error] [pid 255556] [client 54.81.43.75:60730] [client ...
show more
[Wed Jun 24 00:06:52.555141 2026] [security2:error] [pid 255556] [client 54.81.43.75:60730] [client 54.81.43.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/feed"] [unique_id "ajqS_Or_Y2Mf6qaAvUtuKAAAAAU"]
...
show less
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-23 01:41:52
(1 day ago)
[Tue Jun 23 11:41:51.576153 2026] [security2:error] [pid 190357] [client 54.81.43.75:56880] [client ...
show more
[Tue Jun 23 11:41:51.576153 2026] [security2:error] [pid 190357] [client 54.81.43.75:56880] [client 54.81.43.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/feed"] [unique_id "ajnkX89zCYzgaMGQcrxkKgAAABA"]
...
show less
Web App Attack
🇮🇹
Progetto1
2026-06-22 08:35:02
(1 day ago)
Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-19 20:06:44
(4 days ago)
[Sat Jun 20 06:06:43.444172 2026] [security2:error] [pid 689827] [client 54.81.43.75:35306] [client ...
show more
[Sat Jun 20 06:06:43.444172 2026] [security2:error] [pid 689827] [client 54.81.43.75:35306] [client 54.81.43.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "winesbydesign.com.au"] [uri "/feed"] [unique_id "ajWhU3r-jRRm80Ig9ChHggAAADI"]
...
show less
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-19 03:11:51
(4 days ago)
[Fri Jun 19 13:11:50.620375 2026] [security2:error] [pid 611657] [client 54.81.43.75:35584] [client ...
show more
[Fri Jun 19 13:11:50.620375 2026] [security2:error] [pid 611657] [client 54.81.43.75:35584] [client 54.81.43.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dance4fitness.com.au"] [uri "/feed"] [unique_id "ajSzdtHZVwsfxNjBeejj6gAAAA4"]
...
show less
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-17 13:35:34
(6 days ago)
[Wed Jun 17 23:35:33.366317 2026] [security2:error] [pid 391695] [client 54.81.43.75:38050] [client ...
show more
[Wed Jun 17 23:35:33.366317 2026] [security2:error] [pid 391695] [client 54.81.43.75:38050] [client 54.81.43.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stkildashule.org.au"] [uri "/feed"] [unique_id "ajKipYHdclMvDcy1NjCQLAAAAAw"]
...
show less
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-17 03:26:16
(6 days ago)
[Wed Jun 17 13:26:15.426656 2026] [security2:error] [pid 338643] [client 54.81.43.75:53792] [client ...
show more
[Wed Jun 17 13:26:15.426656 2026] [security2:error] [pid 338643] [client 54.81.43.75:53792] [client 54.81.43.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dance4fitness.com.au"] [uri "/feed"] [unique_id "ajIT1zKQSl_09tbiFWfnCAAAAAU"]
...
show less
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-17 01:38:25
(1 week ago)
[Wed Jun 17 11:38:24.691512 2026] [security2:error] [pid 329341] [client 54.81.43.75:33838] [client ...
show more
[Wed Jun 17 11:38:24.691512 2026] [security2:error] [pid 329341] [client 54.81.43.75:33838] [client 54.81.43.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "stkildashule.org.au"] [uri "/feed"] [unique_id "ajH6kHM-sdmIqRPC1sQPAAAAABE"]
...
show less
Web App Attack
🇺🇸
cwytech
2026-06-15 10:06:08
(1 week ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/tpot-web-high.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-10 17:47:52
(1 week ago)
(mod_security) mod_security (id:211180) triggered by 54.81.43.75 (ec2-54-81-43-75.compute-1.amazonaw ...
show more
(mod_security) mod_security (id:211180) triggered by 54.81.43.75 (ec2-54-81-43-75.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 10 13:47:45.957961 2026] [security2:error] [pid 2557:tid 2557] [client 54.81.43.75:41810] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "50"] [id "211180"] [rev "3"] [msg "COMODO WAF: Session Fixation: SessionID Parameter Name with No Referer||bookingsouthafrica.com|F|2"] [data "Matched Data: phpsessid found within REQUEST_HEADERS: 0"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bookingsouthafrica.com"] [uri "/forums/index.php"] [unique_id "aimjQe8wskB90eOOBwcNdgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-09 01:17:28
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 54.81.43.75 (ec2-54-81-43-75.compute-1.amazonaw ...
show more
(mod_security) mod_security (id:210730) triggered by 54.81.43.75 (ec2-54-81-43-75.compute-1.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 21:17:22.222006 2026] [security2:error] [pid 3241:tid 3241] [client 54.81.43.75:44150] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||directcch.com|F|2"] [data ".axd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "directcch.com"] [uri "/Blog/syndication.axd"] [unique_id "aidpom05wsEqEDQso2HZ9QAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-06-08 23:01:51
(2 weeks ago)
[TueJun0901:01:49.0991572026][security2:error][pid1982668:tid1982795][client54.81.43.75:0]ModSecurit ...
show more
[TueJun0901:01:49.0991572026][security2:error][pid1982668:tid1982795][client54.81.43.75:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"chesasilva.ch\"][uri\"/feed\"][unique_id\"aidJ3dyBDf5zjlkYB4Bi1AAAARA\"]
show less
Port Scan
Brute-Force
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-08 15:40:28
(2 weeks ago)
[Tue Jun 09 01:40:27.449301 2026] [security2:error] [pid 130851] [client 54.81.43.75:47318] [client ...
show more
[Tue Jun 09 01:40:27.449301 2026] [security2:error] [pid 130851] [client 54.81.43.75:47318] [client 54.81.43.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/feed"] [unique_id "aibia7z2bN0Ks17K18n5kAAAAAU"]
...
show less
Web App Attack
🇦🇺
paulshipley.com.au
2026-06-07 22:47:40
(2 weeks ago)
[Mon Jun 08 08:47:39.299698 2026] [security2:error] [pid 36939] [client 54.81.43.75:50690] [client 5 ...
show more
[Mon Jun 08 08:47:39.299698 2026] [security2:error] [pid 36939] [client 54.81.43.75:50690] [client 54.81.43.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/feed"] [unique_id "aiX1C9TnWl6XoXyoXqnUhQAAAAM"]
...
show less
Web App Attack