🇩🇪
ksol-hostmaster
2026-10-10 07:08:37
UTC ·
(1 month ago)
Oct 10 09:08:33 ksol postfix/submissions-465/smtpd[40325]: NOQUEUE: lost connection after CONNECT from tor-exit-read-me.dfri.se[2001:67c:289c:2::36]:60304
Oct 10 09:08:36 ksol postfix/submissions-465/smtpd[34746]: NOQUEUE: lost connection after CONNE ...
show more
Oct 10 09:08:33 ksol postfix/submissions-465/smtpd[40325]: NOQUEUE: lost connection after CONNECT from tor-exit-read-me.dfri.se[2001:67c:289c:2::36]:60304
Oct 10 09:08:36 ksol postfix/submissions-465/smtpd[34746]: NOQUEUE: lost connection after CONNECT from tor-exit-read-me.dfri.se[2001:67c:289c:2::36]:60310
...
show less
Email Spam
🇺🇸
1gz
2026-10-01 10:11:22
UTC ·
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from T1.
Action taken: CHALLENGE
Protocol: HTTP/2 (GET method)
Endpoint: /script.js
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
This report was generated by:
https:// ...
show more
Triggered Cloudflare WAF (firewallCustom) from T1.
Action taken: CHALLENGE
Protocol: HTTP/2 (GET method)
Endpoint: /script.js
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
xmission.com
2026-08-30 00:02:37
UTC ·
(2 months ago)
Blocked by UFW (TCP on 8333)
Source port: 49728
Packet length: 80
This report (for 2001:067c:289c:0002:0000:0000:0000:0036) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇺🇸
xmission.com
2026-08-20 13:03:14
UTC ·
(2 months ago)
Blocked by UFW (TCP on 58890)
Source port: 9050
Packet length: 96
This report (for 2001:067c:289c:0002:0000:0000:0000:0036) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇺🇸
xmission.com
2026-08-18 12:08:35
UTC ·
(2 months ago)
Blocked by UFW (TCP on 45404)
Source port: 80
Packet length: 2294
This report (for 2001:067c:289c:0002:0000:0000:0000:0036) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇺🇸
xmission.com
2026-08-15 00:03:24
UTC ·
(2 months ago)
Blocked by UFW (TCP on 50194)
Source port: 9001
Packet length: 2297
This report (for 2001:067c:289c:0002:0000:0000:0000:0036) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇨🇭
Peter-Johann Sarbach
2026-07-15 03:55:26
UTC ·
(3 months ago)
Jul 14 08:05:37 imap-login: Info: Disconnected: Connection closed (no auth attempts in 1 secs): user=<>, rip=2001:67c:289c:2::36, lip=x.x.x.x, TLS, TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)
Hacking
🇺🇸
TPI-Abuse
2026-06-12 14:08:29
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::36 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 10:08:21.787248 2026] [security2:error] [pid 6015:tid 6015] [cl ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::36 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 10:08:21.787248 2026] [security2:error] [pid 6015:tid 6015] [client 2001:67c:289c:2::36:59760] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.tandemfamilycoaching.com"] [uri "/.git/config"] [unique_id "aiwS1Z2mIN4OlDVg88wBFwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-11 20:57:09
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::36 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 16:56:59.193141 2026] [security2:error] [pid 29834:tid 29834] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::36 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 11 16:56:59.193141 2026] [security2:error] [pid 29834:tid 29834] [client 2001:67c:289c:2::36:42284] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.manaplas.com"] [uri "/.git/config"] [unique_id "aishG0p5Ux3s6DzdJfVmyQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Savvii
2026-06-10 08:10:01
UTC ·
(5 months ago)
20 attempts against mh-misbehave-ban on web-new
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-08 23:18:08
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::36 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 19:18:01.413139 2026] [security2:error] [pid 13542:tid 13542] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::36 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 08 19:18:01.413139 2026] [security2:error] [pid 13542:tid 13542] [client 2001:67c:289c:2::36:55082] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.joycebrown.com"] [uri "/.git/config"] [unique_id "aidNqfq6j4svf8OOz84pFwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 19:11:58
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::36 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 15:11:45.995661 2026] [security2:error] [pid 11949:tid 11949] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 2001:67c:289c:2::36 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 15:11:45.995661 2026] [security2:error] [pid 11949:tid 11949] [client 2001:67c:289c:2::36:49976] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.loveoflearning.com"] [uri "/.git/config"] [unique_id "aiXCcVFAdZc8yWpPBtIAYAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 09:01:39
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 2001:67c:289c:2::36 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 05:01:32.938220 2026] [security2:error] [pid 19840:tid 19840] [ ...
show more
(mod_security) mod_security (id:210730) triggered by 2001:67c:289c:2::36 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 05:01:32.938220 2026] [security2:error] [pid 19840:tid 19840] [client 2001:67c:289c:2::36:57988] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||customhumanrobots.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "customhumanrobots.com"] [uri "/customhumanro.sql"] [unique_id "af2mbDAETtu7wMuMAVuUYQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-06 19:32:14
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 2001:67c:289c:2::36 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 15:32:06.188743 2026] [security2:error] [pid 17815:tid 17815] [ ...
show more
(mod_security) mod_security (id:210730) triggered by 2001:67c:289c:2::36 (tor-exit-read-me.dfri.se): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 15:32:06.188743 2026] [security2:error] [pid 17815:tid 17815] [client 2001:67c:289c:2::36:46646] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||faithlines.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "faithlines.com"] [uri "/s_com.sql"] [unique_id "afuXNpZ5xPJGOoRI-DzRyQAAACo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-04-26 21:01:27
UTC ·
(6 months ago)
2026-04-26 08:00:23,203 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::36
2026-04-26 12:01:23,089 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::36
2026-04-26 18:01:20,840 fail2ban.actions [7718]: NOTICE ...
show more
2026-04-26 08:00:23,203 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::36
2026-04-26 12:01:23,089 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::36
2026-04-26 18:01:20,840 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::36
2026-04-26 21:01:17,859 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::36
2026-04-27 00:01:26,627 fail2ban.actions [7718]: NOTICE [tor] Ban 2001:67c:289c:2::36
show less
Brute-Force
