🇺🇸
TPI-Abuse
2026-10-23 04:15:47
(3 days ago)
(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657 (Unknown) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 00:15:40.575058 2026] [security2:error] [pid 28658:tid 28658] [client 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657:49282] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||soviaenterprises.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "soviaenterprises.com"] [uri "/usoilinc.com"] [unique_id "atrfbFwqr4421KCK6IP4YgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-21 11:25:42
(5 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.website | URI: /.git/HEAD | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Hacking
Web App Attack
🇵🇱
Budyn
2026-10-18 00:44:04
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicio ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: goblinpot.site | URI: /wp-admin | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇩🇪
keep_out
2026-10-17 14:10:01
(1 week ago)
nginx-444 from fail2ban
...
Web App Attack
🇵🇱
Budyn
2026-10-16 02:27:53
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: dont-eat-the-pudding.xyz | URI: /backup.sql | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Hacking
Web App Attack
🇵🇱
Budyn
2026-10-14 21:50:27
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: budyn.top | URI: /.git/HEAD | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0 | BODY: [Empty / GET Request]
show less
Hacking
Web App Attack
🇵🇱
Budyn
2026-10-14 00:58:51
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: astropot.tech | URI: /backup.sql | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Hacking
Web App Attack
🇵🇱
Budyn
2026-10-13 14:22:15
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: astropot.site | URI: /.git/HEAD | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-12 20:52:10
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657 (Unknown) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 12 16:52:06.528427 2026] [security2:error] [pid 31382:tid 31382] [client 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657:57762] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aaabft.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aaabft.com"] [uri "/[email protected] "] [unique_id "as1Idt24QIzi7z7ua4HZFwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-06 11:01:17
(2 weeks ago)
Web page flood (L7) | path: /, /accueil, /identification (+2 more) | 2026-10-06 11:01 UTC
DDoS Attack
Web App Attack
🇫🇷
conseilgouz
2026-10-06 04:11:26
(2 weeks ago)
saw-Joomla User : try to access forms...
Hacking
🇺🇸
TPI-Abuse
2026-09-04 21:22:07
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657 (Unknown) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 17:21:58.204973 2026] [security2:error] [pid 8908:tid 8908] [client 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657:46822] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||slusarczyk.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "slusarczyk.com"] [uri "/indoorfreeflight.com"] [unique_id "aps2di7Z7FV9f1c9iI9bfAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
1gz
2026-08-15 08:15:14
(2 months ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: CHALLENGE
Protocol: HTTP/2 (GET met ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: CHALLENGE
Protocol: HTTP/2 (GET method)
Endpoint: /script.js
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-13 22:45:21
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657 (Unknown) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 13 18:45:13.521154 2026] [security2:error] [pid 4366:tid 4372] [client 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657:48044] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||newleafpro.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "newleafpro.com"] [uri "/cargostuff.com"] [unique_id "an5I-Yoo3ChrYKR5EfUV8AAAAQI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-13 03:11:13
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657 (Unknown) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Aug 12 23:10:56.297418 2026] [security2:error] [pid 2241812:tid 2241812] [client 2a0a:4cc0:c1:e079:68c3:a9ff:fe57:c657:34180] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||myairbalance.org|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "myairbalance.org"] [uri "/nampac.com"] [unique_id "an01wHcKJ19mYB_CttwqSwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
