🇩🇪
jbcrn
2026-10-08 05:44:10
UTC ·
(1 month ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Facebook, ruleset: ai.robots.txt. Requested honeypot path: /. User-Agent: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
Bad Web Bot
Web App Attack
Anonymous
2026-10-07 22:47:21
UTC ·
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
Anonymous
2026-10-07 21:49:53
UTC ·
(1 month ago)
IP matched detection query 50 and more bad rqs apache.
Hacking
Bad Web Bot
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-07 18:12:10
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:27:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 14:12:02.778307 2026] [security2:error] [pid 16703:tid 16703] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:27:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 14:12:02.778307 2026] [security2:error] [pid 16703:tid 16703] [client 2a03:2880:f806:27:::61448] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||atlwarehouse.net|F|2"] [data ".com.seowebstat.com.seowebstat.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "atlwarehouse.net"] [uri "/:/iwantnoon.com.seowebstat.com.seowebstat.com"] [unique_id "asaLchwHBgQ8yxRBKfzfiQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-07 14:50:45
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:27:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 10:50:42.079923 2026] [security2:error] [pid 916:tid 916] [client 2a03:2880:f806 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:27:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 10:50:42.079923 2026] [security2:error] [pid 916:tid 916] [client 2a03:2880:f806:27:::35974] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||genevaatlantic.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "genevaatlantic.com"] [uri "/genevaatlantic.com"] [unique_id "asZcQm5_urjPTCaHAOruWQAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-10-06 22:02:55
UTC ·
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-06 18:01:41
UTC ·
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 2a03:2880:f806:27:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 14:01:34.051103 2026] [security2:error] [pid 4675:tid 4675] [client 2a03:2880:f8 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a03:2880:f806:27:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 06 14:01:34.051103 2026] [security2:error] [pid 4675:tid 4675] [client 2a03:2880:f806:27:::23824] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "iotgardening.nextngnr.com"] [uri "/c7zgAj.htaccess"] [unique_id "asU3fnxkDUbA2sh278p45AAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
000rosiu
2026-10-06 04:29:41
UTC ·
(1 month ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /login-customizer | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /login-customizer | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
Anonymous
2026-10-05 20:18:27
UTC ·
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
1cyb3rpunk
2026-10-05 09:43:16
UTC ·
(1 month ago)
Honeypot interaction [EXFIL]: canary_token_triggered on /api/verify. MITRE: T1074 (Data Staged). UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 ( ...
show more
Honeypot interaction [EXFIL]: canary_token_triggered on /api/verify. MITRE: T1074 (Data Staged). UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+. Observed on sectrace.org honeypot surface — automated scanner/attacker activity.
show less
Port Scan
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-10-04 17:41:33
UTC ·
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-04 07:01:34
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:27:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 03:01:27.100425 2026] [security2:error] [pid 26391:tid 26391] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:27:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 04 03:01:27.100425 2026] [security2:error] [pid 26391:tid 26391] [client 2a03:2880:f806:27:::39724] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||gamepart.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "gamepart.com"] [uri "/home/tancedi1/gamepart.com"] [unique_id "asH5x2Gi3Lkm1ca-r1HChQAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-04 03:39:28
UTC ·
(1 month ago)
(mod_security) mod_security (id:240950) triggered by 2a03:2880:f806:27:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 23:39:23.608936 2026] [security2:error] [pid 14401:tid 14401] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:240950) triggered by 2a03:2880:f806:27:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 23:39:23.608936 2026] [security2:error] [pid 14401:tid 14401] [client 2a03:2880:f806:27:::49682] ModSecurity: Access denied with code 403 (phase 1). Pattern match "\\\\D" at TX:1. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "4530"] [id "240950"] [rev "2"] [msg "COMODO WAF: XSS & SQL injection vulnerability in Pragyan CMS 3.0 (CVE-2015-1471)||www.noelramos.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.noelramos.com"] [uri "/wiki/index.php"] [unique_id "asHKa7kpFgHLb3buEqCYgwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-03 13:39:15
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:27:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 09:39:08.097034 2026] [security2:error] [pid 12298:tid 12298] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:27:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 03 09:39:08.097034 2026] [security2:error] [pid 12298:tid 12298] [client 2a03:2880:f806:27:::27486] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||williamfitzsimmons.com|F|2"] [data ".majesticmadison.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "williamfitzsimmons.com"] [uri "/news/0328-william-adds-chattanooga-date-uscan-tour/www.majesticmadison.com"] [unique_id "asEFfHUd0uY-5N2RUZdZXgAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-10-03 10:15:11
UTC ·
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking