🇺🇸
LotPhantom
2025-12-01 20:27:10
(9 months ago)
2a03:2880:f806:26:: - - [01/Dec/2025:20:26:09 +0000] "GET /SiteMap.aspx HTTP/2.0" 404 9 "-" "meta-ex ...
show more
2a03:2880:f806:26:: - - [01/Dec/2025:20:26:09 +0000] "GET /SiteMap.aspx HTTP/2.0" 404 9 "-" "meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)"
...
show less
Web App Attack
🇳🇱
Roderic
2025-11-29 22:58:28
(10 months ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted])
Bad Web Bot
🇺🇸
TPI-Abuse
2025-11-29 19:26:47
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 29 14:26:44.166254 2025] [security2:error] [pid 25148:tid 25148] [client 2a03:2880:f806:26:::51746] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||lumentravel.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lumentravel.com"] [uri "/lumentravel.com"] [unique_id "aStI9OgjNxNr0XkTPa_zygAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-28 04:08:19
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 23:08:13.719910 2025] [security2:error] [pid 32557:tid 32557] [client 2a03:2880:f806:26:::46106] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cw-enterprises.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cw-enterprises.com"] [uri "/cw-enterprises.com"] [unique_id "aSkgLXwYz4In7n1HYicwxgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-27 04:29:56
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 23:29:51.458322 2025] [security2:error] [pid 15559:tid 15559] [client 2a03:2880:f806:26:::48484] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||arellasoc.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "arellasoc.com"] [uri "/arellasoc.com"] [unique_id "aSfTv4mjrqcaE_Jo_YEVEAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
mrcrassi
2025-11-25 05:54:53
(10 months ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/2 (GET method ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /blog/manutencao-preventiva-portao-automatico/
UA: meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇷
mrcrassi
2025-11-20 21:52:46
(10 months ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/2 (GET method ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /produto/pivo-duo-simples-1-2/
UA: meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇳🇱
Roderic
2025-11-19 02:45:48
(10 months ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted])
Bad Web Bot
🇺🇸
TPI-Abuse
2025-11-18 02:32:49
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 17 21:32:43.885447 2025] [security2:error] [pid 25949:tid 25949] [client 2a03:2880:f806:26:::48252] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||automationmp.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "automationmp.com"] [uri "/automationmp.com"] [unique_id "aRvay2ZkIEQfvWKoGXTQEgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-17 19:25:50
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 17 14:25:44.646147 2025] [security2:error] [pid 9814:tid 9814] [client 2a03:2880:f806:26:::41886] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||vc1.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vc1.com"] [uri "/vc1.com"] [unique_id "aRt2uIrfoPoD8VTz5HC6iAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-16 20:39:29
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 16 15:39:24.102893 2025] [security2:error] [pid 19452:tid 19452] [client 2a03:2880:f806:26:::58092] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bjfrancislaw.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bjfrancislaw.com"] [uri "/bjfrancislaw.com"] [unique_id "aRo2fJjo9v0FO2aO2WCTGgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-13 22:40:46
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 13 17:40:42.424574 2025] [security2:error] [pid 25292:tid 25292] [client 2a03:2880:f806:26:::40462] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||edfisherco.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "edfisherco.com"] [uri "/edfisherco.com"] [unique_id "aRZeakPs0tptVXfTLr62HwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Roderic
2025-11-12 17:47:12
(10 months ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted])
Bad Web Bot
🇺🇸
TPI-Abuse
2025-11-12 07:35:43
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 12 02:35:37.640191 2025] [security2:error] [pid 3735:tid 3735] [client 2a03:2880:f806:26:::42266] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||robertgregorybrowne.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "robertgregorybrowne.com"] [uri "/robertgregorybrowne.com"] [unique_id "aRQ4ye-r8kNdOEytY2uXNAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-09 19:38:45
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 30 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:26:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 09 14:38:42.265865 2025] [security2:error] [pid 30403:tid 30403] [client 2a03:2880:f806:26:::48244] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||go-901.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "go-901.com"] [uri "/go-901.com"] [unique_id "aRDtwr-A-XZ039GNOPk1IgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
