🇺🇸
TPI-Abuse
2026-06-05 11:57:11
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 07:57:03.655665 2026] [security2:error] [pid 1933 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 07:57:03.655665 2026] [security2:error] [pid 19339:tid 19339] [client 2a03:e600:100::8:49092] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.bostonscience.com"] [uri "/.git/config"] [unique_id "aiK5jw0c-Vry73oCex4G0QAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-05-09 04:37:52
UTC ·
(5 months ago)
[SatMay0906:37:44.6740992026][security2:error][pid3025856:tid3025959][client2a03:e600:100::8:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.ht ...
show more
[SatMay0906:37:44.6740992026][security2:error][pid3025856:tid3025959][client2a03:e600:100::8:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"craniosacraltherapy.ch\"][uri\"/craniosacralthe.sql\"][unique_id\"af66GKQ20bhK78i3cQzWXAAAAMw\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 22:09:32
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 18:09:27.315305 2026] [security2:error] [pid 1449 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 18:09:27.315305 2026] [security2:error] [pid 1449:tid 1449] [client 2a03:e600:100::8:41110] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||hotelausland.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "hotelausland.com"] [uri "/bck.sql"] [unique_id "af5fF3dRiZnEWBo6azqXPgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-08 16:13:10
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 12:13:02.879177 2026] [security2:error] [pid 1003 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 12:13:02.879177 2026] [security2:error] [pid 10037:tid 10037] [client 2a03:e600:100::8:43160] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||doctorspainmanagement.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "doctorspainmanagement.com"] [uri "/anagement_com.sql"] [unique_id "af4LjlAKsOQ7c0DwnwQPlgAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-05 10:50:44
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 05 06:50:37.898270 2026] [security2:error] [pid 2943 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 05 06:50:37.898270 2026] [security2:error] [pid 29439:tid 29439] [client 2a03:e600:100::8:33472] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cajunpicasso.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cajunpicasso.com"] [uri "/o_com.sql"] [unique_id "afnLfUUL4KVsPp-x2NxZUgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-27 05:31:48
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 01:31:41.041950 2026] [security2:error] [pid 2978 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 01:31:41.041950 2026] [security2:error] [pid 29783:tid 29783] [client 2a03:e600:100::8:45018] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.summitmediawv.com"] [uri "/.git/config"] [unique_id "ae70vat1KWIpJVQ-v_awfQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-04-26 21:03:53
UTC ·
(6 months ago)
2026-04-26 08:00:46,996 fail2ban.actions [7718]: NOTICE [tor] Ban 2a03:e600:100::8
2026-04-26 12:01:37,645 fail2ban.actions [7718]: NOTICE [tor] Ban 2a03:e600:100::8
2026-04-26 18:01:35,298 fail2ban.actions [7718]: NOTICE [tor ...
show more
2026-04-26 08:00:46,996 fail2ban.actions [7718]: NOTICE [tor] Ban 2a03:e600:100::8
2026-04-26 12:01:37,645 fail2ban.actions [7718]: NOTICE [tor] Ban 2a03:e600:100::8
2026-04-26 18:01:35,298 fail2ban.actions [7718]: NOTICE [tor] Ban 2a03:e600:100::8
2026-04-26 21:01:32,772 fail2ban.actions [7718]: NOTICE [tor] Ban 2a03:e600:100::8
2026-04-27 00:03:52,655 fail2ban.actions [7718]: NOTICE [tor] Ban 2a03:e600:100::8
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-04-25 04:52:08
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 25 00:52:05.007783 2026] [security2:error] [pid 1686 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 25 00:52:05.007783 2026] [security2:error] [pid 16869:tid 16869] [client 2a03:e600:100::8:40172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "soonerstone.com"] [uri "/wp-config.php.de"] [unique_id "aexIdVXGKx2V-o_X2A0jYQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-23 00:54:58
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 20:54:52.217198 2026] [security2:error] [pid 3281 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 20:54:52.217198 2026] [security2:error] [pid 3281741:tid 3281741] [client 2a03:e600:100::8:45976] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brbcash.com"] [uri "/wp-config.phpnew"] [unique_id "aelt3KHKpJDB-gESXYcmcwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-22 10:38:49
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 06:38:41.540026 2026] [security2:error] [pid 2012 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 22 06:38:41.540026 2026] [security2:error] [pid 20120:tid 20120] [client 2a03:e600:100::8:42314] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "technesa.com"] [uri "/wp-config.phpbak"] [unique_id "aeilMcwPiTFf1HhMIs6MPgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ipblock.com
2026-04-20 04:21:00
UTC ·
(6 months ago)
IPBlock protected site ID [3717-sec].
Robotic site crawling, undeclared spider
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-17 02:34:52
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 16 22:34:41.046558 2026] [security2:error] [pid 3846 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 16 22:34:41.046558 2026] [security2:error] [pid 3846818:tid 3846818] [client 2a03:e600:100::8:43914] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rambleandprose.com"] [uri "/wp-config.phpo"] [unique_id "aeGcQdNh2PjkElpGSuZl7wAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-04-15 01:08:28
UTC ·
(6 months ago)
[WedApr1503:08:23.6334992026][security2:error][pid1644862:tid1644887][client2a03:e600:100::8:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\^/wp-content/plugins/[\^/] /\(readme\\\\\\\\.txt\|changelog\\\\\\\\.txt\)\"atREQUEST_URI.[file ...
show more
[WedApr1503:08:23.6334992026][security2:error][pid1644862:tid1644887][client2a03:e600:100::8:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\^/wp-content/plugins/[\^/] /\(readme\\\\\\\\.txt\|changelog\\\\\\\\.txt\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"359\"][id\"960828\"][msg\"WordPresspluginenumerationblocked\"][hostname\"edelhaut.ch\"][uri\"/wp-content/plugins/marra-core/readme.txt\"][unique_id\"ad7lBwtvJqasAbUKfZLMFAAAARc\"]
show less
Hacking
Web App Attack
🇵🇱
sefinek.net
2026-04-13 21:27:09
UTC ·
(6 months ago)
Triggered Cloudflare WAF (firewallCustom) from T1.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: / | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseI ...
show more
Triggered Cloudflare WAF (firewallCustom) from T1.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: / | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-04-12 03:46:03
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 23:45:56.015227 2026] [security2:error] [pid 1302 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a03:e600:100::8 (tor-exit-anonymizer-v6.appliedprivacy.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 23:45:56.015227 2026] [security2:error] [pid 1302346:tid 1302346] [client 2a03:e600:100::8:45880] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paulsingdahlsen.com"] [uri "/wp-config.phpbak"] [unique_id "adsVdGXe7xRmKrvQS7z2UgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
