🇺🇸
TPI-Abuse
2026-07-20 09:25:14
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2602:fa5d::559 (Unknown): 1 in the last 300 sec ...
show more
(mod_security) mod_security (id:210730) triggered by 2602:fa5d::559 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 20 05:24:55.777488 2026] [security2:error] [pid 30944:tid 30944] [client 2602:fa5d::559:37736] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.wfowisdom.systemcapacityoptimization.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.wfowisdom.systemcapacityoptimization.com"] [uri "/php5.ini"] [unique_id "al3pZzoPC-LIVVfq9fESzgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-19 10:59:40
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2602:fa5d::559 (Unknown): 1 in the last 300 sec ...
show more
(mod_security) mod_security (id:210730) triggered by 2602:fa5d::559 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 06:59:26.654041 2026] [security2:error] [pid 21927:tid 21927] [client 2602:fa5d::559:37412] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||accordionstars.com|F|2"] [data ".accordionfactory.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "accordionstars.com"] [uri "/www.accordionfactory.com"] [unique_id "alyuDsjYXH8qt66LvjZypAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
SCHAPPY
2026-07-19 06:30:08
(1 month ago)
Excessive crawling, scraping, request limit exceeded, HTTP code 429.
Web App Attack
🇺🇸
TPI-Abuse
2026-07-18 11:13:39
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2602:fa5d::559 (Unknown): 1 in the last 300 sec ...
show more
(mod_security) mod_security (id:210730) triggered by 2602:fa5d::559 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 07:13:24.573627 2026] [security2:error] [pid 155298:tid 155298] [client 2602:fa5d::559:40392] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||john-bell-associates.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "john-bell-associates.com"] [uri "/reddit.com"] [unique_id "altf1Oux9WfVw7VxIlIHNQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-18 05:31:57
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2602:fa5d::559 (Unknown): 1 in the last 300 sec ...
show more
(mod_security) mod_security (id:210730) triggered by 2602:fa5d::559 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 01:31:41.147568 2026] [security2:error] [pid 12449:tid 12466] [client 2602:fa5d::559:34614] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.oldcarz.com|F|2"] [data ".daewoo.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.oldcarz.com"] [uri "/www.daewoo.com"] [unique_id "alsPvSZcXzVfIbVpF5qXfQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
CK_beats
2026-07-18 05:25:01
(1 month ago)
Blocked by os-abuseipdb on OPNsense firewall KN-FW01; 14 hits, proto=tcp, ports=443,80
Port Scan
Hacking
🇺🇸
Penny Packer
2026-07-13 15:11:46
(1 month ago)
Fail2Ban apache-404
Web App Attack
🇫🇷
Nicolmn
2026-07-09 15:50:35
(1 month ago)
Web form spam ( id lft.l )
Web Spam
2026-07-09 09:44:00
(1 month ago)
Form spam
Web Spam
🇩🇪
AetherFox
2026-07-07 12:41:56
(1 month ago)
AetherFox VoidGuard detected: [Tue Jul 07 12:41:55.791027 2026] [authz_core:error] [pid 4003239:tid ...
show more
AetherFox VoidGuard detected: [Tue Jul 07 12:41:55.791027 2026] [authz_core:error] [pid 4003239:tid 4003255] [client 2602:fa5d::559:59904] AH01630: client denied by server configuration: proxy:https://[MASKED]/
[Tue Jul 07 12:41:55.941586 2026] [authz_core:error] [pid 4003239:tid 4003280] [client 2602:fa5d::559:59912] AH01630: client denied by server configuration: proxy:https://[MASKED]/
[Tue Jul 07 12:41:55.903630 2026] [authz_core:error] [pid 4003238:tid 4003289] [client 2602:fa5d::559:39878] AH01630: client denied by server configuration: proxy:http://[MASKED]/
[Tue Jul 07 12:41:55.903931 2026] [authz_core:error] [pid 4003238:tid 4003289] [client 2602:fa5d::559:39878] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html
[Tue Jul 07 12:41:56.057215 2026] [authz_core:error] [pid 4003238:tid 4003274] [client 2602:fa5d::559:39894] AH01630: client denied by server configuration: proxy:http://[MASKED]/
...
show less
Bad Web Bot
Web App Attack
🇩🇪
CK_beats
2026-07-05 06:45:02
(1 month ago)
Blocked by os-abuseipdb on OPNsense firewall KN-FW01; 28 hits, proto=tcp, ports=443,80
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-07-04 17:11:03
(1 month ago)
(mod_security) mod_security (id:949110) triggered by 2602:fa5d::559 (Unknown): 1 in the last 300 sec ...
show more
(mod_security) mod_security (id:949110) triggered by 2602:fa5d::559 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 04 13:10:49.119725 2026] [security2:error] [pid 24784:tid 24784] [client 2602:fa5d::559:51528] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "clintess.biz"] [uri "/mailto:[email protected] "] [unique_id "akk-mUGUhPKGu5sPD-llKgAAAAw"], referer: https://clintess.biz/contact.htm
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
as211431.net
2026-07-01 17:39:07
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from TR.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from TR.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; WOW64; Trident/7.0)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇳🇿
nixnut
2026-06-30 13:19:00
(1 month ago)
A bot tried to submit your contact form.
IP Address: 2602:fa5d::559
Browser: Mozilla/5.0 (iPad; ...
show more
A bot tried to submit your contact form.
IP Address: 2602:fa5d::559
Browser: Mozilla/5.0 (iPad; CPU OS 8_1 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) GSA/7.0.55539 Mobile/12B410 Safari/600.1.4
Bot Name/Realname: djwqgffwqd
Bot Email Used: [email protected]
Trapped Field Value: ylptrzkkgj
show less
Web Spam
Email Spam
🇳🇱
Mangelot Hosting
2026-06-30 09:14:20
(1 month ago)
(bad_user_agent) srv101 Bad User-Agent 2602:fa5d::559 (TR/Turkey/-): 10 in the last 3600 secs; Ports ...
show more
(bad_user_agent) srv101 Bad User-Agent 2602:fa5d::559 (TR/Turkey/-): 10 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack