🇦🇺
paulshipley.com.au
2026-11-08 19:52:55
UTC ·
(2 hours ago)
[Mon Nov 09 06:52:55.157349 2026] [security2:error] [pid 26354] [client 8.217.213.252:11693] [client 8.217.213.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUE ...
show more
[Mon Nov 09 06:52:55.157349 2026] [security2:error] [pid 26354] [client 8.217.213.252:11693] [client 8.217.213.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/product/compact-handheld-massager-tc-127142/tel:1300701197"] [unique_id "avDTFyCZNkNt1R4edl-3VgAAAAY"]
...
show less
Web App Attack
🇨🇦
1gz
2026-11-07 02:00:12
UTC ·
(1 day ago)
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/draw/
UA: TokenFoundryBot/1.0 ([email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF ...
show more
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/draw/
UA: TokenFoundryBot/1.0 ([email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇦🇺
paulshipley.com.au
2026-11-06 23:23:39
UTC ·
(1 day ago)
[Sat Nov 07 10:23:39.249812 2026] [security2:error] [pid 722248] [client 8.217.213.252:18551] [client 8.217.213.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ...
show more
[Sat Nov 07 10:23:39.249812 2026] [security2:error] [pid 722248] [client 8.217.213.252:18551] [client 8.217.213.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/product/tech-stylus-pen-tc-107061/tel:1300701197"] [unique_id "au5he12LfiMt1Lt8z861PQAAAAA"]
...
show less
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-05 19:20:06
UTC ·
(3 days ago)
[Fri Nov 06 06:20:04.989487 2026] [security2:error] [pid 558388] [client 8.217.213.252:19888] [client 8.217.213.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ...
show more
[Fri Nov 06 06:20:04.989487 2026] [security2:error] [pid 558388] [client 8.217.213.252:19888] [client 8.217.213.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/product/express-paper-bag-small-ll547/tel:1300701197"] [unique_id "auzW5Mhk8C5oPl9ulCKK6QAAAAA"]
...
show less
Web App Attack
🇺🇸
francelink.fr
2026-11-04 06:04:24
UTC ·
(4 days ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-04T06:01:37.000Z.
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-04 04:28:47
UTC ·
(4 days ago)
[Wed Nov 04 15:28:46.731921 2026] [security2:error] [pid 339095] [client 8.217.213.252:19835] [client 8.217.213.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ...
show more
[Wed Nov 04 15:28:46.731921 2026] [security2:error] [pid 339095] [client 8.217.213.252:19835] [client 8.217.213.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "indigi-print-merch.com.au"] [uri "/store/page/19/"] [unique_id "auq0fvhKbyqtbVxr3R8qVwAAAAc"]
...
show less
Web App Attack
🇫🇮
pavel Karpenko
2026-10-29 05:08:09
UTC ·
(1 week ago)
8.217.213.252 - - [29/Oct/2026:08:08:09 +0300] "GET /property_org.php?org_id=ORG-aDCG1-RIPE&lang=pl HTTP/1.1" 404 162 "-" "TokenFoundryBot/1.0 ([email protected] )" client_port=51407 server_port=443 rt=0.000 urt=- transfer_entry=- server_addr= ...
show more
8.217.213.252 - - [29/Oct/2026:08:08:09 +0300] "GET /property_org.php?org_id=ORG-aDCG1-RIPE&lang=pl HTTP/1.1" 404 162 "-" "TokenFoundryBot/1.0 ([email protected] )" client_port=51407 server_port=443 rt=0.000 urt=- transfer_entry=- server_addr=195.133.18.6 epoch=1793250489.795
show less
DDoS Attack
🇺🇸
1gz
2026-10-26 04:28:18
UTC ·
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/procedure/
UA: TokenFoundryBot/1.0 ([email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflar ...
show more
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/procedure/
UA: TokenFoundryBot/1.0 ([email protected] )
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
francelink.fr
2026-10-20 04:15:24
UTC ·
(2 weeks ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-10-20T04:14:13.000Z.
Web App Attack
🇺🇸
SX Communications
2026-10-19 12:53:28
UTC ·
(2 weeks ago)
Blocked abusive HTTP application-layer DoS / botnet traffic from 8.217.213.252: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host ...
show more
Blocked abusive HTTP application-layer DoS / botnet traffic from 8.217.213.252: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host.
show less
DDoS Attack
Bad Web Bot
Exploited Host
🇦🇺
paulshipley.com.au
2026-08-11 04:18:05
UTC ·
(2 months ago)
[Tue Aug 11 14:18:04.895651 2026] [security2:error] [pid 201158] [client 8.217.213.252:39766] [client 8.217.213.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQU ...
show more
[Tue Aug 11 14:18:04.895651 2026] [security2:error] [pid 201158] [client 8.217.213.252:39766] [client 8.217.213.252] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "levellapromotions.com.au"] [uri "/product-category/mechandise/office_items/pens-and-other-writing-instruments/pencil-cases/"] [unique_id "anqifP7TjlyIMoqI5OliTAAAAAU"]
...
show less
Web App Attack
🇺🇦
URAN Publishing Service
2026-08-10 21:31:34
UTC ·
(2 months ago)
[11/Aug/2026:00:31:33 +0300] -- 8.217.213.252 Ban reason: User-Agent AliyunSecBot
Bad Web Bot
Web App Attack
🇩🇪
filstal.org
2026-08-02 12:09:11
UTC ·
(3 months ago)
Persistent bad bot: repeated automated abuse detected
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-07-30 15:44:40
UTC ·
(3 months ago)
[30/Jul/2026:18:44:40 +0300] -- 8.217.213.252 Ban reason: User-Agent AliyunSecBot
Bad Web Bot
Web App Attack
🇦🇺
oncord
2026-07-27 18:13:45
UTC ·
(3 months ago)
Form spam
Web Spam
