🇺🇸
xmission.com
2026-09-04 17:18:24
UTC ·
(2 months ago)
Blocked by UFW (TCP on 8333)
Source port: 59938
Packet length: 80
This report (for 2001:067c:289c:0002:0000:0000:0000:0235) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇺🇸
xmission.com
2026-08-23 16:24:00
UTC ·
(2 months ago)
Blocked by UFW (TCP on 8333)
Source port: 31520
Packet length: 80
This report (for 2001:067c:289c:0002:0000:0000:0000:0235) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇺🇸
xmission.com
2026-08-21 17:11:56
UTC ·
(2 months ago)
Blocked by UFW (TCP on 8333)
Source port: 10940
Packet length: 80
This report (for 2001:067c:289c:0002:0000:0000:0000:0235) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇺🇸
xmission.com
2026-07-28 10:09:06
UTC ·
(3 months ago)
Blocked by UFW (TCP on 8333)
Source port: 48360
Packet length: 80
This report (for 2001:067c:289c:0002:0000:0000:0000:0235) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇺🇸
xmission.com
2026-06-27 01:11:17
UTC ·
(4 months ago)
Blocked by UFW (TCP on 8333)
Source port: 48058
Packet length: 80
This report (for 2001:067c:289c:0002:0000:0000:0000:0235) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇪🇸
gnom4ik
2026-06-26 19:03:58
UTC ·
(4 months ago)
ban-reviewer auto report; ip=2001:67c:289c:2::235; scenario=http:scan; scenario_context=http:scan,tor-exit-nodes; verdict=valid_ban; confidence=0.92; categories=14,15,18,22; active_decisions=2; lookback_decisions=2; nginx_requests=0; appsec_matches=0 ...
show more
ban-reviewer auto report; ip=2001:67c:289c:2::235; scenario=http:scan; scenario_context=http:scan,tor-exit-nodes; verdict=valid_ban; confidence=0.92; categories=14,15,18,22; active_decisions=2; lookback_decisions=2; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=ip_decision_count_high
show less
Port Scan
Hacking
Brute-Force
SSH
🇵🇱
sefinek.net
2026-06-26 14:37:13
UTC ·
(4 months ago)
Triggered Cloudflare WAF (firewallCustom) from T1.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: / | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-Ab ...
show more
Triggered Cloudflare WAF (firewallCustom) from T1.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: / | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-11 22:59:06
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 18:58:58.215780 2026] [security2:error] [pid 2026:tid 2026] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 18:58:58.215780 2026] [security2:error] [pid 2026:tid 2026] [client 2001:67c:289c:2::235:37570] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.pikcasa.com"] [uri "/.git/config"] [unique_id "ais9sq0ILYwS5ytq-rhVAQAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 05:41:38
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 01:41:31.089438 2026] [security2:error] [pid 28860:tid 28860] ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 01:41:31.089438 2026] [security2:error] [pid 28860:tid 28860] [client 2001:67c:289c:2::235:24642] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.dynarol.com"] [uri "/.git/config"] [unique_id "aiUEi-Bl6pm6vufqqB8XdQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
chronos
2026-06-01 06:31:37
UTC ·
(5 months ago)
[AUTORAVALT][[01/06/2026 - 03:31:36 -03:00 UTC]
Attack from [2001:67c:289c:2::235][tor-exit-read-me.dfri.se]
Action: BLocKed
Phishing -> Phishing websites and/or email.
Email Spam -> Spam email content, infected attachments, and phishing emails.
Ha ...
show more
[AUTORAVALT][[01/06/2026 - 03:31:36 -03:00 UTC]
Attack from [2001:67c:289c:2::235][tor-exit-read-me.dfri.se]
Action: BLocKed
Phishing -> Phishing websites and/or email.
Email Spam -> Spam email content, infected attachments, and phishing emails.
Hacking... Unauthorized attempts to access the server.
Spoofing -> Email sender spoofing.
Brute-Force -> Credential]
...
show less
Brute-Force
Email Spam
Spoofing
Phishing
Hacking
🇺🇸
chronos
2026-05-31 10:15:59
UTC ·
(5 months ago)
[AUTORAVALT][[31/05/2026 - 07:15:58 -03:00 UTC]
Attack from [2001:67c:289c:2::235][tor-exit-read-me.dfri.se]
Action: BLocKed
Phishing -> Phishing websites and/or email.
Email Spam -> Spam email content, infected attachments, and phishing emails.
Ha ...
show more
[AUTORAVALT][[31/05/2026 - 07:15:58 -03:00 UTC]
Attack from [2001:67c:289c:2::235][tor-exit-read-me.dfri.se]
Action: BLocKed
Phishing -> Phishing websites and/or email.
Email Spam -> Spam email content, infected attachments, and phishing emails.
Hacking... Unauthorized attempts to access the server.
Spoofing -> Email sender spoofing.
Brute-Force -> Credential]
...
show less
Brute-Force
Email Spam
Spoofing
Phishing
Hacking
2026-04-26 21:01:29
UTC ·
(6 months ago)
2026-04-26 08:00:23,738 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::235
2026-04-26 12:01:23,409 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::235
2026-04-26 18:01:21,152 fail2ban.actions [7718]: NOTI ...
show more
2026-04-26 08:00:23,738 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::235
2026-04-26 12:01:23,409 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::235
2026-04-26 18:01:21,152 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::235
2026-04-26 21:01:18,181 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::235
2026-04-27 00:01:28,609 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::235
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-04-25 20:34:58
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 25 16:34:51.512137 2026] [security2:error] [pid 10595:tid 10595] ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 25 16:34:51.512137 2026] [security2:error] [pid 10595:tid 10595] [client 2001:67c:289c:2::235:16726] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bayareamustangs.com"] [uri "/wp-config.phpn"] [unique_id "ae0la4HKTOLY0w83b_VsxgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-23 20:29:47
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 23 16:29:41.734057 2026] [security2:error] [pid 24199:tid 24199] ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 23 16:29:41.734057 2026] [security2:error] [pid 24199:tid 24199] [client 2001:67c:289c:2::235:2844] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "freemanfoundationcle.org"] [uri "/wp-config.phpnew"] [unique_id "aeqBNZIXNqZOwbv07zA70AAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-18 18:48:22
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 18 14:48:17.400264 2026] [security2:error] [pid 3378399:tid 33783 ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::235 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 18 14:48:17.400264 2026] [security2:error] [pid 3378399:tid 3378399] [client 2001:67c:289c:2::235:17468] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "medusakenya.com"] [uri "/wp-config.phpn"] [unique_id "aePR8VQjFGkW79lppiFyhAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack