🇺🇸
TPI-Abuse
2026-11-11 23:36:47
UTC ·
(21 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 18:36:42.001871 2026] [security2:error] [pid 29536:tid 29536] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 18:36:42.001871 2026] [security2:error] [pid 29536:tid 29536] [client 2a03:2880:f806:49:::55550] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||earlyfordv8crrg10.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "earlyfordv8crrg10.com"] [uri "/earlyfordv8crrg10.com"] [unique_id "avT8CU0sga46wgH4hwUvNAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-11 21:39:18
UTC ·
(23 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: prometheus.budyn.top | Path: /wp-admin/ | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Ap ...
show more
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: prometheus.budyn.top | Path: /wp-admin/ | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.faceb... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 12:17:36
UTC ·
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 07:17:29.099646 2026] [security2:error] [pid 849:tid 849] [client 2a03:2880:f806 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 07:17:29.099646 2026] [security2:error] [pid 849:tid 849] [client 2a03:2880:f806:49:::65324] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||proinsaca.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "proinsaca.com"] [uri "/proinsaca.com"] [unique_id "avRc2fMPS-cTlOghc7QF6gAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-10 03:43:48
UTC ·
(2 days ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: cluster.budyn.top | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: cluster.budyn.top | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.co... | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 00:54:41
UTC ·
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:54:33.324211 2026] [security2:error] [pid 30745:tid 30745] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 19:54:33.324211 2026] [security2:error] [pid 30745:tid 30745] [client 2a03:2880:f806:49:::37932] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||mitchellamazing.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mitchellamazing.com"] [uri "/mitchellamazing.com"] [unique_id "avJrSUn6JzhmmVAeU4IdHwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 15:45:16
UTC ·
(3 days ago)
(mod_security) mod_security (id:213060) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 10:45:12.492755 2026] [security2:error] [pid 30600:tid 30600] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:213060) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 10:45:12.492755 2026] [security2:error] [pid 30600:tid 30600] [client 2a03:2880:f806:49:::51480] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)((?:\\\\bx(?:link:href|html|mlns)|!ENTITY\\\\b.{0,399}?\\\\b(?:SYSTEM|PUBLIC)|\\\\bdata:text\\\\/html))" at ARGS:_bd_prev_page. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "170"] [id "213060"] [rev "7"] [msg "COMODO WAF: XSS Filter - Category 3: Attribute Vector||essentialee.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "essentialee.com"] [uri "/"] [unique_id "avHqiJkd8gGZrJdmGBM1fQAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 05:25:20
UTC ·
(3 days ago)
(mod_security) mod_security (id:240950) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 00:25:16.376078 2026] [security2:error] [pid 13743:tid 13743] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:240950) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 00:25:16.376078 2026] [security2:error] [pid 13743:tid 13743] [client 2a03:2880:f806:49:::46554] ModSecurity: Access denied with code 403 (phase 1). Pattern match "\\\\D" at TX:1. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "4530"] [id "240950"] [rev "2"] [msg "COMODO WAF: XSS & SQL injection vulnerability in Pragyan CMS 3.0 (CVE-2015-1471)||www.nancyscafeandcatering.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.nancyscafeandcatering.com"] [uri "/wp-content/themes/eatery/nav.php"] [unique_id "avFZPB4di6E56AM72MbTgwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 13:52:57
UTC ·
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:52:54.208516 2026] [security2:error] [pid 32174:tid 32174] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:52:54.208516 2026] [security2:error] [pid 32174:tid 32174] [client 2a03:2880:f806:49:::39064] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||csm-dtc.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "csm-dtc.com"] [uri "/csm-dtc.com"] [unique_id "avB-ttXYzw-K02wjH7KxLgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 01:44:19
UTC ·
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 20:44:12.291236 2026] [security2:error] [pid 29915:tid 29915] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 20:44:12.291236 2026] [security2:error] [pid 29915:tid 29915] [client 2a03:2880:f806:49:::59300] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||scoretopicturenetwork.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "scoretopicturenetwork.com"] [uri "/scoretopicturenetwork.com"] [unique_id "au_T7IZRYbi8IEbb9fsBmgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-07 23:27:07
UTC ·
(4 days ago)
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: vpn.teddypot.store | Path: /wp-admin/ | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Appl ...
show more
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: vpn.teddypot.store | Path: /wp-admin/ | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.faceb... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-07 20:27:32
UTC ·
(5 days ago)
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: beta.goblinpot.online | Path: /xmlrpc.php?rsd | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ap ...
show more
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: beta.goblinpot.online | Path: /xmlrpc.php?rsd | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.co... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 03:12:34
UTC ·
(5 days ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 22:12:27.308636 2026] [security2:error] [pid 17088:tid 17088] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:49:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 22:12:27.308636 2026] [security2:error] [pid 17088:tid 17088] [client 2a03:2880:f806:49:::58682] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.kingstoneproperties.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.kingstoneproperties.com"] [uri "/[email protected] "] [unique_id "au6XG1joHMDRxV7AQGxlywAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-05 05:16:25
UTC ·
(1 week ago)
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: beta.teddypot.cloud | Path: /xmlrpc.php?rsd | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Appl ...
show more
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: beta.teddypot.cloud | Path: /xmlrpc.php?rsd | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 (compatible; meta-webindexer/1.1 (+https://develope... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-05 00:21:04
UTC ·
(1 week ago)
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: vpn.teddypot.cloud | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: vpn.teddypot.cloud | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.co... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-04 14:11:21
UTC ·
(1 week ago)
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: backup.dont-eat-the-pudding.online | Path: /backup.sql | User-Agent: Mozilla/5.0 (Windows NT ...
show more
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: backup.dont-eat-the-pudding.online | Path: /backup.sql | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.co... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
