🇵🇱
Budyn
2026-11-03 11:34:22
UTC ·
(1 week ago)
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: backup.astropot.site | Path: /wp-admin/ | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb ...
show more
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: backup.astropot.site | Path: /wp-admin/ | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.co... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇵🇱
mscode.pl
2026-10-12 04:45:25
UTC ·
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
ASN: 32934 (Facebook, Inc.)
Protocol: HTTP/2 (GET method)
Zone: r2.selify.io
Endpoint: /
UA: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-10 22:29:06
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f804:b:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 18:28:57.740379 2026] [security2:error] [pid 1196:tid 1196] [client 2a03:2880:f80 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f804:b:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 18:28:57.740379 2026] [security2:error] [pid 1196:tid 1196] [client 2a03:2880:f804:b:::24436] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||roselockecasting.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "roselockecasting.com"] [uri "/roselockecasting.com"] [unique_id "asq8KYzSk1kzdMQ8As5tFwAAAFg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
WebServ
2026-10-09 14:43:50
UTC ·
(1 month ago)
Fail2Ban jail [nginx-noscript]: banned after 3 failed attempt(s). Probing for disallowed script extensions
Hacking
Web App Attack
🇵🇱
mscode.pl
2026-10-08 16:46:15
UTC ·
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
ASN: 32934 (Facebook, Inc.)
Protocol: HTTP/2 (GET method)
Zone: r2.selify.io
Endpoint: /
UA: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-05 08:19:35
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f804:b:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 04:19:29.351588 2026] [security2:error] [pid 3382:tid 3382] [client 2a03:2880:f80 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f804:b:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 04:19:29.351588 2026] [security2:error] [pid 3382:tid 3382] [client 2a03:2880:f804:b:::27200] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.williamfitzsimmons.com|F|2"] [data ".theparishaustin.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.williamfitzsimmons.com"] [uri "/www.theparishaustin.com"] [unique_id "asNdkcV9u4Wp753bj2vn-wAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 14:38:50
UTC ·
(1 month ago)
(mod_security) mod_security (id:225170) triggered by 2a03:2880:f804:b:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 10:38:45.836660 2026] [security2:error] [pid 3726:tid 3726] [client 2a03:2880:f80 ...
show more
(mod_security) mod_security (id:225170) triggered by 2a03:2880:f804:b:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 10:38:45.836660 2026] [security2:error] [pid 3726:tid 3726] [client 2a03:2880:f804:b:::50190] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||lawrencehale.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "lawrencehale.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "asJk9S0u6tRjJLYYYmqOCgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-29 18:47:37
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f804:b:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 14:47:30.822324 2026] [security2:error] [pid 22990:tid 22990] [client 2a03:2880:f ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f804:b:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 14:47:30.822324 2026] [security2:error] [pid 22990:tid 22990] [client 2a03:2880:f804:b:::20048] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||schwanpaint.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "schwanpaint.com"] [uri "/schwanpaint.com"] [unique_id "arwHwlEWtObbghy7mmoK7QAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
jbcrn
2026-09-28 10:32:35
UTC ·
(1 month ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Facebook, ruleset: ai.robots.txt. Requested honeypot path: /. User-Agent: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
Bad Web Bot
Web App Attack
🇩🇪
jbcrn
2026-09-25 23:32:31
UTC ·
(1 month ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Facebook, ruleset: ai.robots.txt. Requested honeypot path: /. User-Agent: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
Bad Web Bot
Web App Attack
🇩🇪
jbcrn
2026-09-19 18:32:15
UTC ·
(1 month ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Facebook, ruleset: ai.robots.txt. Requested honeypot path: /. User-Agent: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
Bad Web Bot
Web App Attack
🇩🇪
jbcrn
2026-09-18 12:32:35
UTC ·
(1 month ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Facebook, ruleset: ai.robots.txt. Requested honeypot path: /. User-Agent: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
Bad Web Bot
Web App Attack
🇫🇮
000rosiu
2026-09-17 21:04:09
UTC ·
(1 month ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /purchase/rescuedrive/ | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /purchase/rescuedrive/ | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇵🇱
sefinek.net
2026-09-17 11:20:29
UTC ·
(1 month ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /dbvictory-stats | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0. ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /dbvictory-stats | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36 Edg/144.0.0.0 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
jbcrn
2026-09-16 15:32:33
UTC ·
(1 month ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Facebook, ruleset: ai.robots.txt. Requested honeypot path: /. User-Agent: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
Bad Web Bot
Web App Attack
