AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User remurillod80 joined AbuseIPDB in August 2025 and has reported 379 IP addresses.

Standing (weight) is good.

INACTIVE USER

IP	Date	Comment	Categories
🇺🇸 172.212.200.142	05 Sep 2026	[Sat Sep 05 17:24:22.429994 2026] [security2:error] [pid 901836:tid 901836] [client 172.212.200.142: ... show more [Sat Sep 05 17:24:22.429994 2026] [security2:error] [pid 901836:tid 901836] [client 172.212.200.142:37670] ModSecurity: Warning. Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/crs/current/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 zgrab/0.x"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apykpmbCeJjpmmJOagvlEwAAAAI"] [Sat Sep 05 17:24:22.430185 2026] [security2:error] [pid 901836:tid 901836] [client 172.212.200.142:37670] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at RE ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇺🇸 34.9.217.146	05 Sep 2026	[Sat Sep 05 17:08:23.469673 2026] [security2:error] [pid 891011:tid 891011] [client 34.9.217.146:411 ... show more [Sat Sep 05 17:08:23.469673 2026] [security2:error] [pid 891011:tid 891011] [client 34.9.217.146:41138] ModSecurity: Warning. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1146"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "C ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇺🇸 136.113.153.248	05 Sep 2026	[Sat Sep 05 16:31:15.338380 2026] [security2:error] [pid 891011:tid 891011] [client 136.113.153.248: ... show more [Sat Sep 05 16:31:15.338380 2026] [security2:error] [pid 891011:tid 891011] [client 136.113.153.248:34002] ModSecurity: Warning. Pattern match "(?i)\\\\b\\\\(?[\\"']*(?:assert(?:_options)?\|c(?:hr\|reate_function)\|e(?:val\|x(?:ec\|p))\|f(?:ile(?:group)?\|open\|puts)\|glob\|i(?:mage(?:gif\|(?:jpe\|pn)g\|wbmp\|xbm)\|s_a\|ntval)\|m(?:d5\|kdir)\|o(?:pendir\|rd)\|p(?:assthru\|hpinfo\|open\|r(?:intf\|ev))\|r(?:eadfile\|trim)\|s(?: ..." at ARGS:0. [file "/etc/modsecurity/crs/current/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "406"] [id "933160"] [msg "PHP Injection Attack: High-Risk PHP Function Call Found"] [data "Matched Data: eval(user_code) found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function('return import(\\x5c\\x22node:child_process\\x5c\\x22) ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇮🇩 34.50.79.176	05 Sep 2026	[Sat Sep 05 16:20:13.557651 2026] [security2:error] [pid 889446:tid 889446] [client 34.50.79.176:553 ... show more [Sat Sep 05 16:20:13.557651 2026] [security2:error] [pid 889446:tid 889446] [client 34.50.79.176:55322] ModSecurity: Warning. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1146"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".bak"] [severity "C ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇸🇬 136.85.27.246	05 Sep 2026	[Sat Sep 05 16:12:42.858273 2026] [security2:error] [pid 882912:tid 882912] [client 136.85.27.246:57 ... show more [Sat Sep 05 16:12:42.858273 2026] [security2:error] [pid 882912:tid 882912] [client 136.85.27.246:57406] ModSecurity: Warning. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1146"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".old"] [severity " ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇸🇬 47.84.103.91	05 Sep 2026	[Sat Sep 05 15:30:28.967676 2026] [security2:error] [pid 865592:tid 865592] [client 47.84.103.91:522 ... show more [Sat Sep 05 15:30:28.967676 2026] [security2:error] [pid 865592:tid 865592] [client 47.84.103.91:52264] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:80"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apyJ9OWdhEdod3lv91zMFgAAAAQ"] [Sat Sep 05 15:30:28.969762 2026] [security2:error] [pid 865592:tid 865592] [client 47.84.103.91:52264] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980170" ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇩🇪 159.89.6.40	05 Sep 2026	[Sat Sep 05 15:09:03.659427 2026] [security2:error] [pid 865592:tid 865592] [client 159.89.6.40:8272 ... show more [Sat Sep 05 15:09:03.659427 2026] [security2:error] [pid 865592:tid 865592] [client 159.89.6.40:8272] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:80"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/query"] [unique_id "apyE7-WdhEdod3lv91zMAQAAAAQ"] [Sat Sep 05 15:09:03.750549 2026] [security2:error] [pid 865592:tid 865592] [client 159.89.6.40:8272] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980170 ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇩🇪 138.68.103.246	05 Sep 2026	[Sat Sep 05 15:09:03.651371 2026] [security2:error] [pid 869907:tid 869907] [client 138.68.103.246:5 ... show more [Sat Sep 05 15:09:03.651371 2026] [security2:error] [pid 869907:tid 869907] [client 138.68.103.246:54814] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:80"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/solr/admin/info/system"] [unique_id "apyE7-XZB54QLAOGhoWz1QAAAAA"] [Sat Sep 05 15:09:03.747972 2026] [security2:error] [pid 869907:tid 869907] [client 138.68.103.246:54814] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf" ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇩🇪 157.230.28.219	05 Sep 2026	[Sat Sep 05 15:08:49.393119 2026] [security2:error] [pid 874554:tid 874554] [client 157.230.28.219:2 ... show more [Sat Sep 05 15:08:49.393119 2026] [security2:error] [pid 874554:tid 874554] [client 157.230.28.219:28515] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "cursos.robertomurillo.net"] [uri "/"] [unique_id "apyE4TZcMHE7kwh0j7WrugAAAAU"] [Sat Sep 05 15:08:49.394650 2026] [security2:error] [pid 874554:tid 874554] [client 157.230.28.219:28515] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980170"] [msg "Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=5-0-0-0 ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇮🇳 103.146.111.175	05 Sep 2026	[Sat Sep 05 14:57:20.709431 2026] [security2:error] [pid 853852:tid 853852] [client 103.146.111.175: ... show more [Sat Sep 05 14:57:20.709431 2026] [security2:error] [pid 853852:tid 853852] [client 103.146.111.175:51497] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "728"] [id "920340"] [msg "Content-Type header missing from request with non-zero Content-Length"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "127.0.0.1"] [uri "/GponForm/diag_Form"] [unique_id "apyCMDyP3JFZ7QXxcfafvwAAAAg"] [Sat Sep 05 14:57:20.709561 2026] [security2:error] [pid 853852:tid 853852] [client 103.146.111.175:51497] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCO ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇩🇪 213.209.159.154	05 Sep 2026	[Sat Sep 05 14:44:36.820283 2026] [security2:error] [pid 853852:tid 853852] [client 213.209.159.154: ... show more [Sat Sep 05 14:44:36.820283 2026] [security2:error] [pid 853852:tid 853852] [client 213.209.159.154:33359] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:80"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apx_NDyP3JFZ7QXxcfafsQAAAAg"] [Sat Sep 05 14:44:36.853969 2026] [security2:error] [pid 853852:tid 853852] [client 213.209.159.154:33359] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "9 ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇧🇷 16.5.0.238	05 Sep 2026	16.5.0.238 - - [05/Sep/2026:14:16:28 -0600] "GET / HTTP/1.0" 400 744 "-" "-" ...	Bad Web Bot
🇺🇸 20.15.160.91	05 Sep 2026	[Sat Sep 05 13:59:48.121825 2026] [security2:error] [pid 810329:tid 810329] [client 20.15.160.91:473 ... show more [Sat Sep 05 13:59:48.121825 2026] [security2:error] [pid 810329:tid 810329] [client 20.15.160.91:47314] ModSecurity: Warning. Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/crs/current/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 zgrab/0.x"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [hostname "186.32.240.17"] [uri "/actuator/health"] [unique_id "apx0tIjA-G2NT6T1ZkkVlgAAAAQ"] [Sat Sep 05 13:59:48.122014 2026] [security2:error] [pid 810329:tid 810329] [client 20.15.160.91:47314] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)? ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇧🇷 43.157.181.189	05 Sep 2026	[Sat Sep 05 13:54:27.904411 2026] [security2:error] [pid 857303:tid 857303] [client 43.157.181.189:3 ... show more [Sat Sep 05 13:54:27.904411 2026] [security2:error] [pid 857303:tid 857303] [client 43.157.181.189:37480] ModSecurity: Warning. Pattern match "\\\\b(?:keep-alive\|close),\\\\s?(?:keep-alive\|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "www.robertomurillo.net"] [uri "/"] [unique_id "apxzcx0w-U3xvX7roH3DzQAAAAk"] [Sat Sep 05 13:54:27.906351 2026] [security2:error] [pid 857303:tid 857303] [client 43.157.181.189:37480] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf" ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇩🇪 64.226.96.73	05 Sep 2026	[Sat Sep 05 13:47:14.215922 2026] [security2:error] [pid 857303:tid 857303] [client 64.226.96.73:430 ... show more [Sat Sep 05 13:47:14.215922 2026] [security2:error] [pid 857303:tid 857303] [client 64.226.96.73:43020] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apxxwh0w-U3xvX7roH3DxQAAAAk"] [Sat Sep 05 13:47:14.293727 2026] [security2:error] [pid 857303:tid 857303] [client 64.226.96.73:43020] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980170"] [ ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇩🇪 68.183.74.193	05 Sep 2026	[Sat Sep 05 13:47:14.224657 2026] [security2:error] [pid 857298:tid 857298] [client 68.183.74.193:33 ... show more [Sat Sep 05 13:47:14.224657 2026] [security2:error] [pid 857298:tid 857298] [client 68.183.74.193:33548] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:80"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/cgi-bin/authLogin.cgi"] [unique_id "apxxwrXNIf00Wi-l_LC3pAAAAAI"] [Sat Sep 05 13:47:14.299785 2026] [security2:error] [pid 857298:tid 857298] [client 68.183.74.193:33548] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [ ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇩🇪 165.22.21.93	05 Sep 2026	[Sat Sep 05 13:47:14.227121 2026] [security2:error] [pid 853856:tid 853856] [client 165.22.21.93:221 ... show more [Sat Sep 05 13:47:14.227121 2026] [security2:error] [pid 853856:tid 853856] [client 165.22.21.93:22156] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:80"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/v2/_catalog"] [unique_id "apxxwnj_-qjwY3x6hXSkNQAAAAo"] [Sat Sep 05 13:47:14.299778 2026] [security2:error] [pid 853856:tid 853856] [client 165.22.21.93:22156] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [ ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇩🇪 164.90.208.203	05 Sep 2026	[Sat Sep 05 13:47:14.217238 2026] [security2:error] [pid 853852:tid 853852] [client 164.90.208.203:3 ... show more [Sat Sep 05 13:47:14.217238 2026] [security2:error] [pid 853852:tid 853852] [client 164.90.208.203:31108] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:80"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/solr/admin/info/system"] [unique_id "apxxwjyP3JFZ7QXxcfafcQAAAAg"] [Sat Sep 05 13:47:14.293501 2026] [security2:error] [pid 853852:tid 853852] [client 164.90.208.203:31108] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf" ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇩🇪 157.230.21.162	05 Sep 2026	157.230.21.162 - - [05/Sep/2026:13:47:01 -0600] "GET / HTTP/1.0" 301 676 "-" "-" ...	Bad Web Bot
🇸🇬 124.156.206.145	05 Sep 2026	[Sat Sep 05 13:14:38.163364 2026] [security2:error] [pid 850774:tid 850774] [client 124.156.206.145: ... show more [Sat Sep 05 13:14:38.163364 2026] [security2:error] [pid 850774:tid 850774] [client 124.156.206.145:49230] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "cursos.robertomurillo.net"] [uri "/"] [unique_id "apxqHnGeXIn12ToSQn-fYQAAAA8"] [Sat Sep 05 13:14:38.164975 2026] [security2:error] [pid 850774:tid 850774] [client 124.156.206.145:49230] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980170"] [msg "Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=5-0-0 ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇩🇪 36.255.97.104	05 Sep 2026	[Sat Sep 05 13:08:53.455014 2026] [security2:error] [pid 810329:tid 810329] [client 36.255.97.104:55 ... show more [Sat Sep 05 13:08:53.455014 2026] [security2:error] [pid 810329:tid 810329] [client 36.255.97.104:55071] ModSecurity: Warning. Matched phrase "Mozlila" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/crs/current/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: Mozlila found within REQUEST_HEADERS:User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [hostname "robertomurillo.net"] [uri "/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "apxoxYjA-G2NT6T1ZkkVXAAAAAQ"], referer: www.google.com [Sat Sep 05 13:08:53.45 ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇨🇳 43.140.247.223	05 Sep 2026	[Sat Sep 05 12:55:23.982629 2026] [security2:error] [pid 841012:tid 841012] [client 43.140.247.223:4 ... show more [Sat Sep 05 12:55:23.982629 2026] [security2:error] [pid 841012:tid 841012] [client 43.140.247.223:43014] ModSecurity: Warning. Pattern match "\\\\b(?:keep-alive\|close),\\\\s?(?:keep-alive\|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "www.robertomurillo.net"] [uri "/"] [unique_id "apxlmySJixs3t5a0Og0NKQAAAAU"] [Sat Sep 05 12:55:23.984658 2026] [security2:error] [pid 841012:tid 841012] [client 43.140.247.223:43014] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf" ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇺🇸 35.247.101.152	05 Sep 2026	35.247.101.152 - - [05/Sep/2026:12:40:26 -0600] "GET /.git/config HTTP/1.1" 301 4669 "-" "-" ...	Bad Web Bot
🇭🇰 43.161.251.162	05 Sep 2026	[Sat Sep 05 12:25:45.249695 2026] [security2:error] [pid 810329:tid 810329] [client 43.161.251.162:5 ... show more [Sat Sep 05 12:25:45.249695 2026] [security2:error] [pid 810329:tid 810329] [client 43.161.251.162:50532] ModSecurity: Warning. Pattern match "\\\\b(?:keep-alive\|close),\\\\s?(?:keep-alive\|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "robertomurillo.net"] [uri "/"] [unique_id "apxeqYjA-G2NT6T1ZkkVFwAAAAQ"] [Sat Sep 05 12:25:45.251540 2026] [security2:error] [pid 810329:tid 810329] [client 43.161.251.162:50532] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [l ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack
🇫🇷 81.171.72.135	05 Sep 2026	[Sat Sep 05 12:24:15.076476 2026] [security2:error] [pid 802870:tid 802870] [client 81.171.72.135:55 ... show more [Sat Sep 05 12:24:15.076476 2026] [security2:error] [pid 802870:tid 802870] [client 81.171.72.135:55066] ModSecurity: Warning. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1146"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".pwd"] [severity " ... show less	Web Spam Hacking SQL Injection Brute-Force Web App Attack