🇺🇸
TPI-Abuse
2026-06-13 00:09:07
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 2a01:4f8:191:8159::2 (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a01:4f8:191:8159::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 12 20:09:01.504378 2026] [security2:error] [pid 4486:tid 4486] [client 2a01:4f8:191:8159::2:32848] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bali-nanny-babysitter.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bali-nanny-babysitter.com"] [uri "/[email protected] "] [unique_id "aiyfnVp2z3uzjSY0JugLuQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
aranguren.org
2026-05-30 07:04:01
(3 weeks ago)
2a01:4f8:191:8159::2 - - [30/May/2026:16:52:46 +1000] "GET /?displaymode=n&end=now&start=2025-11-21+ ...
show more
2a01:4f8:191:8159::2 - - [30/May/2026:16:52:46 +1000] "GET /?displaymode=n&end=now&start=2025-11-21+21%3A29&target=network.bitcoin_abc HTTP/1.1" 200 8546 "-" "serpstatbot/2.1 (advanced backlink tracking bot; https://serpstatbot.com/; [email protected] )"
2a01:4f8:191:8159::2 - - [30/May/2026:17:03:48 +1000] "GET /?target=network.bitcoin HTTP/1.1" 200 8474 "-" "serpstatbot/2.1 (advanced backlink tracking bot; https://serpstatbot.com/; [email protected] )"
2a01:4f8:191:8159::2 - - [30/May/2026:17:04:00 +1000] "GET /?target=network.bitcoin_abc HTTP/1.1" 200 8508 "-" "serpstatbot/2.1 (advanced backlink tracking bot; https://serpstatbot.com/; [email protected] )"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-05-29 23:02:00
(3 weeks ago)
(mod_security) mod_security (id:210730) triggered by 2a01:4f8:191:8159::2 (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a01:4f8:191:8159::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 19:01:55.096241 2026] [security2:error] [pid 31847:tid 31847] [client 2a01:4f8:191:8159::2:39530] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||lloydprins.com|F|2"] [data ".nealcitron.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lloydprins.com"] [uri "/www.nealcitron.com"] [unique_id "ahoa4xT5OtveRtNpaKX1GwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-25 12:49:54
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 2a01:4f8:191:8159::2 (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a01:4f8:191:8159::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 25 07:49:48.919884 2026] [security2:error] [pid 14918:tid 14931] [client 2a01:4f8:191:8159::2:55030] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||jean-paullederer.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jean-paullederer.com"] [uri "/[email protected] "] [unique_id "aZ7v7EHzjPsGPhpeYLWUqgAAAEo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-25 07:55:17
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 2a01:4f8:191:8159::2 (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a01:4f8:191:8159::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 25 02:55:11.856158 2026] [security2:error] [pid 15644:tid 15644] [client 2a01:4f8:191:8159::2:58304] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||idodat.com|F|2"] [data ".php.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "idodat.com"] [uri "/index.php.OLD"] [unique_id "aZ6q30XMjGPLA6mAApF-3AAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-12 06:34:59
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 2a01:4f8:191:8159::2 (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a01:4f8:191:8159::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 01:34:55.490454 2026] [security2:error] [pid 24578:tid 24578] [client 2a01:4f8:191:8159::2:57314] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||keystroke.info|F|2"] [data ".php.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "keystroke.info"] [uri "/LocalSettings.php.backup"] [unique_id "aY10j81nwKQGObU9iG2AKQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
2000cn.com.au
2026-01-09 22:37:54
(5 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent
Bad Web Bot
Web App Attack
🇦🇺
2000cn.com.au
2025-12-25 07:50:37
(5 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent
Bad Web Bot
Web App Attack
🇦🇺
aranguren.org
2025-11-21 14:08:32
(7 months ago)
2a01:4f8:191:8159::2 - - [22/Nov/2025:00:29:15 +1100] "GET /?target=network.bitcoin_abc HTTP/1.1" 20 ...
show more
2a01:4f8:191:8159::2 - - [22/Nov/2025:00:29:15 +1100] "GET /?target=network.bitcoin_abc HTTP/1.1" 200 8508 "-" "serpstatbot/2.1 (advanced backlink tracking bot; https://serpstatbot.com/; [email protected] )"
2a01:4f8:191:8159::2 - - [22/Nov/2025:00:29:25 +1100] "GET /?target=network.bitcoin HTTP/1.1" 200 8474 "-" "serpstatbot/2.1 (advanced backlink tracking bot; https://serpstatbot.com/; [email protected] )"
2a01:4f8:191:8159::2 - - [22/Nov/2025:01:08:31 +1100] "GET /?displaymode=n&end=now&start=2025-11-21+21%3A29&target=network.bitcoin_abc HTTP/1.1" 200 8548 "-" "serpstatbot/2.1 (advanced backlink tracking bot; https://serpstatbot.com/; [email protected] )"
...
show less
Web App Attack
🇦🇺
2000cn.com.au
2025-10-31 20:03:57
(7 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent
Bad Web Bot
Web App Attack
🇺🇸
LotPhantom
2025-10-10 07:42:01
(8 months ago)
2a01:4f8:191:8159::2 - - [10/Oct/2025:07:41:00 +0000] "GET /services/technologies/nitrous-oxide HTTP ...
show more
2a01:4f8:191:8159::2 - - [10/Oct/2025:07:41:00 +0000] "GET /services/technologies/nitrous-oxide HTTP/1.1" 404 9 "-" "serpstatbot/2.1 (advanced backlink tracking bot; https://serpstatbot.com/; [email protected] )"
...
show less
Web App Attack
🇮🇩
securejdprop
2025-09-20 17:04:54
(9 months ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent. Ip 2a01:4f8:191:8159: ...
show more
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent. Ip 2a01:4f8:191:8159::2 performed 'crowdsecurity/http-bad-user-agent' (2 events over 13.381675992s) at 2025-09-20 17:04:52.431048952 +0000 UTC
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-09 03:29:38
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 2a01:4f8:191:8159::2 (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a01:4f8:191:8159::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 23:29:31.356737 2025] [security2:error] [pid 15862:tid 15862] [client 2a01:4f8:191:8159::2:54226] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||justinrudd.com|F|2"] [data ".barkbarkdaycare.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "justinrudd.com"] [uri "/www.barkbarkdaycare.com"] [unique_id "aL-fG6Pb4zPrgssG3NrciwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-27 06:54:13
(9 months ago)
(mod_security) mod_security (id:220030) triggered by 2a01:4f8:191:8159::2 (Unknown): 1 in the last 3 ...
show more
(mod_security) mod_security (id:220030) triggered by 2a01:4f8:191:8159::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 27 02:54:06.575420 2025] [security2:error] [pid 22478:tid 22478] [client 2a01:4f8:191:8159::2:44322] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "-C" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "19"] [id "220030"] [rev "9"] [msg "COMODO WAF: Vulnerability in PHP before 5.3.12 and 5.4.x before 5.4.2 (CVE-2012-1823)||www.bestcountryclubs.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.bestcountryclubs.com"] [uri "/country-club-directory/countryclubs-minnesota/farmers-golf-"] [unique_id "aK6rjpaMet-wP2XXLfSmNQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
LotPhantom
2025-08-01 02:26:37
(10 months ago)
2a01:4f8:191:8159::2 - - [01/Aug/2025:02:26:14 +0000] "GET /services/technologies/nitrous-oxide HTTP ...
show more
2a01:4f8:191:8159::2 - - [01/Aug/2025:02:26:14 +0000] "GET /services/technologies/nitrous-oxide HTTP/1.1" 404 9 "-" "serpstatbot/2.1 (advanced backlink tracking bot; https://serpstatbot.com/; [email protected] )"
...
show less
Web App Attack