🇩🇪
FD-IX
2026-11-04 23:20:14
UTC ·
(3 days ago)
Brute-force login attack detected by WordPress firewall.
Brute-Force
Web App Attack
🇳🇱
MacLotsen
2026-08-02 19:10:12
UTC ·
(3 months ago)
berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:01 +0200] "POST /wp-login.php HTTP/1.1" 200 3903 "https://ellenbakt.nl/wp-login.php" "Mozilla/5.0 (Linux; Android 12; motorola edge 20) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mob ...
show more
berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:01 +0200] "POST /wp-login.php HTTP/1.1" 200 3903 "https://ellenbakt.nl/wp-login.php" "Mozilla/5.0 (Linux; Android 12; motorola edge 20) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36"
berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:03 +0200] "POST /wp-login.php HTTP/1.1" 200 3903 "https://ellenbakt.nl/wp-login.php" "Mozilla/5.0 (Linux; Android 12; motorola edge 20) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36"
berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:06 +0200] "POST /wp-login.php HTTP/1.1" 200 3903 "https://ellenbakt.nl/wp-login.php" "Mozilla/5.0 (Linux; Android 12; motorola edge 20) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36"
berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:08 +0200] "POST /wp-login.php HTTP/1.1" 200 3903 "https://ellenbakt.nl/wp-login.php" "Mozilla/5.0 (Linux; Android 12; motorola edge 20) Ap
...
show less
Web App Attack
Brute-Force
🇹🇷
neron
2026-07-31 01:06:18
UTC ·
(3 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-07-29 20:19:38
UTC ·
(3 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-07-27 22:19:38
UTC ·
(3 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-07-26 19:50:51
UTC ·
(3 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
2026-07-26 08:20:04
UTC ·
(3 months ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇹🇷
neron
2026-07-24 15:30:03
UTC ·
(3 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
🇺🇸
xmission.com
2026-07-22 21:33:52
UTC ·
(3 months ago)
Blocked by UFW (TCP on 8333)
Source port: 11102
Packet length: 80
This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0002) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇺🇸
TPI-Abuse
2026-07-12 16:16:06
UTC ·
(3 months ago)
(mod_security) mod_security (id:210350) triggered by 2a0b:f4c2::2 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 12:15:59.143568 2026] [security2:error] [pid 31070:tid 31070] [ ...
show more
(mod_security) mod_security (id:210350) triggered by 2a0b:f4c2::2 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 12 12:15:59.143568 2026] [security2:error] [pid 31070:tid 31070] [client 2a0b:f4c2::2:65366] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.trasimeno.ws|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.trasimeno.ws"] [uri "/isola_maggiore_it.html"] [unique_id "alO9vwp5CD8RVFB6ojes4AAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-19 17:02:56
UTC ·
(4 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::2 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 13:02:48.293718 2026] [security2:error] [pid 17819:tid 17819] [ ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::2 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 19 13:02:48.293718 2026] [security2:error] [pid 17819:tid 17819] [client 2a0b:f4c2::2:6454] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||astglobalgroup.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "astglobalgroup.com"] [uri "/db_globalgroup.sql"] [unique_id "ajV2OLnMW8_G4XE7xQhl-QAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
HandyTreff.de
2026-05-15 12:22:14
UTC ·
(5 months ago)
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -30.543 (Bad < -10 / Very Bad < -20 / Extreme < -35) | UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Mobile Sa
Web App Attack
Bad Web Bot
🇺🇸
ipblock.com
2026-05-10 11:38:00
UTC ·
(5 months ago)
IPBlock protected site ID [3717-sec].
Robotic site crawling, undeclared spider
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-06 19:32:24
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::2 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 15:32:17.051006 2026] [security2:error] [pid 17815:tid 17815] [ ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::2 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 15:32:17.051006 2026] [security2:error] [pid 17815:tid 17815] [client 2a0b:f4c2::2:8136] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||faithlines.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "faithlines.com"] [uri "/.sql"] [unique_id "afuXQZZ5xPJGOoRI-DzRygAAACo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-28 15:30:25
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::2 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 11:30:20.164741 2026] [security2:error] [pid 23702:tid 23721] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::2 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 11:30:20.164741 2026] [security2:error] [pid 23702:tid 23721] [client 2a0b:f4c2::2:63040] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cheqs.org"] [uri "/wp-config.phpOLD"] [unique_id "afDSjAQXXyoq42Tk345OogAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
