🇫🇷
abuseipdb.amaze321
2026-11-12 12:39:31
UTC ·
(8 hours ago)
Automated reconnaissance: repeated requests for sensitive/non-existent paths.
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-08 14:12:10
UTC ·
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:39:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 09:12:05.398041 2026] [security2:error] [pid 29130:tid 29130] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:39:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 09:12:05.398041 2026] [security2:error] [pid 29130:tid 29130] [client 2a03:2880:f806:39:::43778] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||raynernet.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "raynernet.com"] [uri "/raynernet.com"] [unique_id "avCDNfOpTLGV7v8GemznQgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-05 08:08:39
UTC ·
(1 week ago)
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: www.dont-eat-the-pudding.online | Path: /xmlrpc.php?rsd | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win6 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: www.dont-eat-the-pudding.online | Path: /xmlrpc.php?rsd | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.co... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇵🇱
sefinek.net
2026-11-03 22:14:33
UTC ·
(1 week ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru/artist/%E3%81%84%E3%82%8D%E3%81%AF | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 S ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru/artist/%E3%81%84%E3%82%8D%E3%81%AF | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇵🇱
Budyn
2026-11-03 08:24:59
UTC ·
(1 week ago)
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: metrics.teddypot.cloud | Path: /backup.sql | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: metrics.teddypot.cloud | Path: /backup.sql | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.co... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇫🇷
abuseipdb.amaze321
2026-10-29 09:40:53
UTC ·
(2 weeks ago)
Automated reconnaissance: repeated requests for sensitive/non-existent paths.
Web App Attack
Bad Web Bot
🇵🇱
sefinek.net
2026-10-28 08:05:42
UTC ·
(2 weeks ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru/artist/polecat | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compat ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru/artist/polecat | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇵🇱
sefinek.net
2026-10-23 19:33:09
UTC ·
(2 weeks ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-exte ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇵🇱
sefinek.net
2026-10-21 17:22:59
UTC ·
(3 weeks ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru/artist/%E9%9B%A8%E9%9F%B3%E3%81%8F%E3%82%8B%E3%81%BF | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145 ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru/artist/%E9%9B%A8%E9%9F%B3%E3%81%8F%E3%82%8B%E3%81%BF | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇷
abuseipdb.amaze321
2026-10-15 06:37:33
UTC ·
(4 weeks ago)
Automated reconnaissance: repeated requests for sensitive/non-existent paths.
Web App Attack
Bad Web Bot
🇵🇱
mscode.pl
2026-10-11 23:56:50
UTC ·
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
ASN: 32934 (Facebook, Inc.)
Protocol: HTTP/2 (GET method)
Zone: r2.selify.io
Endpoint: /
UA: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
Bad Web Bot
🇩🇪
jbcrn
2026-10-09 16:49:23
UTC ·
(1 month ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Facebook, ruleset: ai.robots.txt. Requested honeypot path: /. User-Agent: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
Bad Web Bot
Web App Attack
Anonymous
2026-10-07 22:50:04
UTC ·
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-07 11:41:47
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:39:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 07:41:44.068391 2026] [security2:error] [pid 7961:tid 8025] [client 2a03:2880:f8 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:39:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 07 07:41:44.068391 2026] [security2:error] [pid 7961:tid 8025] [client 2a03:2880:f806:39:::60422] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mouserart.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mouserart.com"] [uri "/mouserart.com"] [unique_id "asYv-LwOZALNEIVjkmX8zwAAAEA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
000rosiu
2026-10-07 00:48:44
UTC ·
(1 month ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /kategoria-produktu/resonance | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /kategoria-produktu/resonance | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot