🇨🇭
backslash
2026-07-09 06:06:02
(1 month ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇩🇪
SCHAPPY
2026-07-08 04:33:44
(1 month ago)
Brute-force attack to identify web exploits
Brute-Force
Web App Attack
🇱🇻
garmtech.com
2026-06-30 16:53:22
(2 months ago)
Attempted access to sensitive endpoint (/adminer.php) detected. Automated scan or unauthorized probi ...
show more
Attempted access to sensitive endpoint (/adminer.php) detected. Automated scan or unauthorized probing.
show less
Web App Attack
🇫🇷
IRISIO
2026-06-08 08:02:08
(2 months ago)
scans/SQL injection/spam posts : 1398 queries
Web App Attack
SQL Injection
🇺🇸
rdpguard.com
2026-05-25 18:02:47
(3 months ago)
RdpGuard detected brute-force attempt on HTTP
Brute-Force
🇺🇸
TPI-Abuse
2026-05-25 17:14:24
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 82.118.30.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 82.118.30.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 13:14:16.351016 2026] [security2:error] [pid 3672:tid 3672] [client 82.118.30.2:29237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "infolinkqr.com"] [uri "/.env.dev"] [unique_id "ahSDaExSl2kWYP94wzH2ZwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 15:45:19
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 82.118.30.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 82.118.30.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 11:45:06.932358 2026] [security2:error] [pid 16028:tid 16028] [client 82.118.30.2:30689] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "techworksunlimited.com"] [uri "/config/.env"] [unique_id "ahRugjZwSK7zY8TUwn0jmwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 14:45:12
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 82.118.30.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 82.118.30.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 10:44:56.862559 2026] [security2:error] [pid 19647:tid 19647] [client 82.118.30.2:28053] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jedaenterprises.com"] [uri "/.env.local"] [unique_id "ahRgaBta0XDEGiQ-8QU_GwAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-05-25 13:20:21
(3 months ago)
[Mon May 25 23:20:20.097262 2026] [security2:error] [pid 121907] [client 82.118.30.2:20969] [client ...
show more
[Mon May 25 23:20:20.097262 2026] [security2:error] [pid 121907] [client 82.118.30.2:20969] [client 82.118.30.2] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "shotbysuzanne.com.au"] [uri "/.env"] [unique_id "ahRMlLu1_J8EheyC1VRJYgAAAFE"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 11:56:49
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 82.118.30.2 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 82.118.30.2 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 07:56:40.510278 2026] [security2:error] [pid 6435:tid 6435] [client 82.118.30.2:55111] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pa-ksa.com"] [uri "/.env.old"] [unique_id "ahQ4-OXtRrviTzNOgByFtAAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-05-25 11:31:57
(3 months ago)
[Mon May 25 21:31:55.804902 2026] [security2:error] [pid 111197] [client 82.118.30.2:52751] [client ...
show more
[Mon May 25 21:31:55.804902 2026] [security2:error] [pid 111197] [client 82.118.30.2:52751] [client 82.118.30.2] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "paulshipley.info"] [uri "/.env.production"] [unique_id "ahQzK8JP5N3c4ejXsMd8FwAAAAs"]
...
show less
Web App Attack
🇬🇧
consul.to
2026-05-25 10:05:00
(3 months ago)
Web attack/malicious scanning detected
Web App Attack
🇯🇵
VXG-NET
2026-05-23 05:54:36
(3 months ago)
port=80, indicator_type=code-execution
Hacking
🇩🇪
Oakley
2026-05-23 04:28:12
(3 months ago)
(antiscrape_rule) Web application abuse detected 82.118.30.2 (CZ/Czechia/-): 5 in the last 900 secs
Hacking
🇩🇪
raph
2026-05-11 14:31:01
(3 months ago)
[SQL INJECTION] f2b match %{+Q}r for ^.*haproxy\[[0-9]+\]: <HOST>:.* (GET |POST ).*\?.*(%20AND%20|%2 ...
show more
[SQL INJECTION] f2b match %{+Q}r for ^.*haproxy\[[0-9]+\]: <HOST>:.* (GET |POST ).*\?.*(%20AND%20|%20and%20|%20OR%20|%20or%20).* HTTP/1.1$
show less
SQL Injection
