|
🇺🇸
173.255.225.15
|
|
173.255.225.15 - - [06/Sep/2026:19:55:17 -0600] "GET / HTTP/1.0" 400 744 "-" "-"
...
|
Bad Web Bot
|
|
🇺🇸
172.104.210.105
|
|
172.104.210.105 - - [06/Sep/2026:19:54:56 -0600] "GET / HTTP/1.0" 400 744 "-" "-"
...
|
Bad Web Bot
|
|
🇰🇷
43.164.131.148
|
|
[Sun Sep 06 19:40:03.512374 2026] [security2:error] [pid 1196430:tid 1196430] [client 43.164.131.148 ...
show more
[Sun Sep 06 19:40:03.512374 2026] [security2:error] [pid 1196430:tid 1196430] [client 43.164.131.148:53334] ModSecurity: Warning. Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "ap4V8_6pkjg0BSKgqC_ZTQAAAAE"]
[Sun Sep 06 19:40:03.512547 2026] [security2:error] [pid 1196430:tid 1196430] [client 43.164.131.148:53334] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [fil
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇫🇷
34.155.189.147
|
|
[Sun Sep 06 19:16:23.455243 2026] [security2:error] [pid 1188882:tid 1188882] [client 34.155.189.147 ...
show more
[Sun Sep 06 19:16:23.455243 2026] [security2:error] [pid 1188882:tid 1188882] [client 34.155.189.147:51014] ModSecurity: Warning. Pattern match "(?i)(?:b[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?u[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?s[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\ ..." at ARGS:0. [file "/etc/modsecurity/crs/current/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "205"] [id "932235"] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: | base64 found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22:\\x5c\\x22$B1337\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var R=(process.main
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇧🇷
205.210.31.231
|
|
[Sun Sep 06 19:06:37.568608 2026] [security2:error] [pid 1188882:tid 1188882] [client 205.210.31.231 ...
show more
[Sun Sep 06 19:06:37.568608 2026] [security2:error] [pid 1188882:tid 1188882] [client 205.210.31.231:49935] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "cursos.robertomurillo.net"] [uri "/"] [unique_id "ap4OHTXc6oWzuHtq5R790gAAAAA"]
[Sun Sep 06 19:06:37.571018 2026] [security2:error] [pid 1188882:tid 1188882] [client 205.210.31.231:49935] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980170"] [msg "Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=5-0
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
66.132.172.110
|
|
[Sun Sep 06 18:48:39.631860 2026] [security2:error] [pid 1188882:tid 1188882] [client 66.132.172.110 ...
show more
[Sun Sep 06 18:48:39.631860 2026] [security2:error] [pid 1188882:tid 1188882] [client 66.132.172.110:9830] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "ap4J5zXc6oWzuHtq5R79yAAAAAA"]
[Sun Sep 06 18:48:39.633759 2026] [security2:error] [pid 1188882:tid 1188882] [client 66.132.172.110:9830] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "9801
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
71.6.134.229
|
|
[Sun Sep 06 18:28:28.300595 2026] [security2:error] [pid 1170755:tid 1170755] [client 71.6.134.229:4 ...
show more
[Sun Sep 06 18:28:28.300595 2026] [security2:error] [pid 1170755:tid 1170755] [client 71.6.134.229:41592] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "ap4FLB4MHO0XLHSJvgXNmgAAAAo"]
[Sun Sep 06 18:28:28.302426 2026] [security2:error] [pid 1170755:tid 1170755] [client 71.6.134.229:41592] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980170
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
136.124.35.119
|
|
[Sun Sep 06 18:24:13.028203 2026] [security2:error] [pid 1184226:tid 1184226] [client 136.124.35.119 ...
show more
[Sun Sep 06 18:24:13.028203 2026] [security2:error] [pid 1184226:tid 1184226] [client 136.124.35.119:19032] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:80"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "ap4ELXMV4SQXlljYba-G8wAAAAw"]
[Sun Sep 06 18:24:13.204378 2026] [security2:error] [pid 1184226:tid 1184226] [client 136.124.35.119:19032] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇮🇩
43.165.195.234
|
|
43.165.195.234 - - [06/Sep/2026:18:23:46 -0600] "GET / HTTP/1.0" 400 744 "-" "-"
...
|
Bad Web Bot
|
|
🇭🇰
152.32.213.13
|
|
[Sun Sep 06 17:56:52.370472 2026] [security2:error] [pid 1165945:tid 1165945] [client 152.32.213.13: ...
show more
[Sun Sep 06 17:56:52.370472 2026] [security2:error] [pid 1165945:tid 1165945] [client 152.32.213.13:14768] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:80"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/version"] [unique_id "ap39xDUnXoQqKlctfitLRwAAAAk"]
[Sun Sep 06 17:56:52.372449 2026] [security2:error] [pid 1165945:tid 1165945] [client 152.32.213.13:14768] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"]
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇨🇭
209.99.185.69
|
|
[Sun Sep 06 17:41:27.310983 2026] [security2:error] [pid 1196430:tid 1196430] [client 209.99.185.69: ...
show more
[Sun Sep 06 17:41:27.310983 2026] [security2:error] [pid 1196430:tid 1196430] [client 209.99.185.69:34700] ModSecurity: Warning. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1146"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".config"] [sever
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇩🇪
49.51.132.100
|
|
[Sun Sep 06 17:35:08.569979 2026] [security2:error] [pid 1170755:tid 1170755] [client 49.51.132.100: ...
show more
[Sun Sep 06 17:35:08.569979 2026] [security2:error] [pid 1170755:tid 1170755] [client 49.51.132.100:33396] ModSecurity: Warning. Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "www.robertomurillo.net"] [uri "/"] [unique_id "ap34rB4MHO0XLHSJvgXNgQAAAAo"]
[Sun Sep 06 17:35:08.571873 2026] [security2:error] [pid 1170755:tid 1170755] [client 49.51.132.100:33396] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.con
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇸🇬
104.64.208.24
|
|
[Sun Sep 06 17:20:36.244174 2026] [security2:error] [pid 1206010:tid 1206010] [client 104.64.208.24: ...
show more
[Sun Sep 06 17:20:36.244174 2026] [security2:error] [pid 1206010:tid 1206010] [client 104.64.208.24:40030] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:80"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/boaform/admin/formLogin"] [unique_id "ap31RLna8l-aAzbs8Kr69QAAAAM"], referer: http://186.32.240.17:80/admin/login.asp
[Sun Sep 06 17:20:36.246687 2026] [security2:error] [pid 1206010:tid 1206010] [client 104.64.208.24:40030] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecu
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
43.135.144.126
|
|
[Sun Sep 06 17:14:54.026179 2026] [security2:error] [pid 1184226:tid 1184226] [client 43.135.144.126 ...
show more
[Sun Sep 06 17:14:54.026179 2026] [security2:error] [pid 1184226:tid 1184226] [client 43.135.144.126:33462] ModSecurity: Warning. Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "ap3z7nMV4SQXlljYba-GxgAAAAw"]
[Sun Sep 06 17:14:54.026322 2026] [security2:error] [pid 1184226:tid 1184226] [client 43.135.144.126:33462] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [fil
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇯🇵
47.245.30.30
|
|
[Sun Sep 06 16:31:07.195912 2026] [security2:error] [pid 1165945:tid 1165945] [client 47.245.30.30:2 ...
show more
[Sun Sep 06 16:31:07.195912 2026] [security2:error] [pid 1165945:tid 1165945] [client 47.245.30.30:27854] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:80"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "ap3pqzUnXoQqKlctfitLGwAAAAk"]
[Sun Sep 06 16:31:07.197965 2026] [security2:error] [pid 1165945:tid 1165945] [client 47.245.30.30:27854] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
159.89.53.210
|
|
[Sun Sep 06 16:25:28.794441 2026] [security2:error] [pid 1188889:tid 1188889] [client 159.89.53.210: ...
show more
[Sun Sep 06 16:25:28.794441 2026] [security2:error] [pid 1188889:tid 1188889] [client 159.89.53.210:60604] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "ap3oWBjzDsPUd2ZYygKdtQAAAAQ"]
[Sun Sep 06 16:25:28.954051 2026] [security2:error] [pid 1188889:tid 1188889] [client 159.89.53.210:60604] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "9801
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
43.153.73.200
|
|
[Sun Sep 06 16:14:19.983995 2026] [security2:error] [pid 1139965:tid 1139965] [client 43.153.73.200: ...
show more
[Sun Sep 06 16:14:19.983995 2026] [security2:error] [pid 1139965:tid 1139965] [client 43.153.73.200:45130] ModSecurity: Warning. Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "robertomurillo.net"] [uri "/"] [unique_id "ap3luyPhu9bEueBBc-fQ7QAAAAc"]
[Sun Sep 06 16:14:19.985868 2026] [security2:error] [pid 1139965:tid 1139965] [client 43.153.73.200:45130] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"]
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
35.202.9.133
|
|
[Sun Sep 06 16:04:56.321257 2026] [security2:error] [pid 1184226:tid 1184226] [client 35.202.9.133:3 ...
show more
[Sun Sep 06 16:04:56.321257 2026] [security2:error] [pid 1184226:tid 1184226] [client 35.202.9.133:38070] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "ap3jiHMV4SQXlljYba-GngAAAAw"]
[Sun Sep 06 16:04:56.579617 2026] [security2:error] [pid 1184226:tid 1184226] [client 35.202.9.133:38070] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980170
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇸🇬
104.28.166.117
|
|
[Sun Sep 06 16:02:19.760775 2026] [security2:error] [pid 1170755:tid 1170755] [client 104.28.166.117 ...
show more
[Sun Sep 06 16:02:19.760775 2026] [security2:error] [pid 1170755:tid 1170755] [client 104.28.166.117:58130] ModSecurity: Warning. Matched phrase ".continue/" at REQUEST_FILENAME. [file "/etc/modsecurity/crs/current/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "180"] [id "930140"] [msg "Restricted File Access Attempt: AI Coding Assistant Artifact"] [data "Matched Data: .continue/ found within REQUEST_FILENAME: /.continue/config.json"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-LFI"] [tag "capec/1000/255/153/126"] [hostname "musics.baselinux.net"] [uri "/.continue/config.json"] [unique_id "ap3i6x4MHO0XLHSJvgXNRwAAAAo"], referer: https://www.google.com/search?q=musics.baselinux.net
[Sun Sep 06 16:02:19.762442 2026] [security2:error] [pid 1170755:tid 1170755] [client 104.28.166.117:58130] ModSecurity: Warning. Unconditiona
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇸🇬
104.28.163.235
|
|
[Sun Sep 06 16:02:16.822362 2026] [security2:error] [pid 1188882:tid 1188882] [client 104.28.163.235 ...
show more
[Sun Sep 06 16:02:16.822362 2026] [security2:error] [pid 1188882:tid 1188882] [client 104.28.163.235:42883] ModSecurity: Warning. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1146"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".save"] [severi
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇸🇬
104.28.156.110
|
|
[Sun Sep 06 16:02:16.806404 2026] [security2:error] [pid 1140541:tid 1140541] [client 104.28.156.110 ...
show more
[Sun Sep 06 16:02:16.806404 2026] [security2:error] [pid 1140541:tid 1140541] [client 104.28.156.110:49800] ModSecurity: Warning. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1146"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [seve
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇸🇬
104.28.163.40
|
|
[Sun Sep 06 16:02:16.242443 2026] [security2:error] [pid 1139965:tid 1139965] [client 104.28.163.40: ...
show more
[Sun Sep 06 16:02:16.242443 2026] [security2:error] [pid 1139965:tid 1139965] [client 104.28.163.40:34622] ModSecurity: Warning. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1146"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".dist"] [severit
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇸🇬
104.28.163.97
|
|
[Sun Sep 06 16:02:16.808540 2026] [security2:error] [pid 1140758:tid 1140758] [client 104.28.163.97: ...
show more
[Sun Sep 06 16:02:16.808540 2026] [security2:error] [pid 1140758:tid 1140758] [client 104.28.163.97:54389] ModSecurity: Warning. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1146"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇸🇬
104.28.156.112
|
|
[Sun Sep 06 16:02:16.211882 2026] [security2:error] [pid 1140758:tid 1140758] [client 104.28.156.112 ...
show more
[Sun Sep 06 16:02:16.211882 2026] [security2:error] [pid 1140758:tid 1140758] [client 104.28.156.112:46594] ModSecurity: Warning. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1146"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severit
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇸🇬
104.28.162.12
|
|
[Sun Sep 06 16:02:16.214315 2026] [security2:error] [pid 1170755:tid 1170755] [client 104.28.162.12: ...
show more
[Sun Sep 06 16:02:16.214315 2026] [security2:error] [pid 1170755:tid 1170755] [client 104.28.162.12:25226] ModSecurity: Warning. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1146"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|