2025-10-04 04:31:42
(11 months ago)
Failed login attempt detected by Fail2Ban in recidive jail
Brute-Force
🇺🇸
TPI-Abuse
2025-10-03 09:27:08
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 03 05:27:03.902090 2025] [security2:error] [pid 15111:tid 15111] [client 2a0b:f4c2::24:65428] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||footballxp.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "footballxp.com"] [uri "/p.sql"] [unique_id "aN-W59E0d0ZmsPGGv2kpvAAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-02 15:33:20
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 02 11:33:16.636666 2025] [security2:error] [pid 2904:tid 2904] [client 2a0b:f4c2::24:13842] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||georgegourmet.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "georgegourmet.com"] [uri "/gegourmet.sql"] [unique_id "aN6bPBz-TbyDya564BI_QAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-02 06:47:37
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 02 02:47:28.377890 2025] [security2:error] [pid 2707898:tid 2707898] [client 2a0b:f4c2::24:9756] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||healthmarkcounseling.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "healthmarkcounseling.com"] [uri "/daily.sql"] [unique_id "aN4gAF165S9FvP-K3XlgSgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-30 03:17:26
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 29 23:17:23.654714 2025] [security2:error] [pid 6021:tid 6021] [client 2a0b:f4c2::24:44656] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||n4fh.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "n4fh.com"] [uri "/n4.sql"] [unique_id "aNtLw4wfqptQ3tKmFqtRtgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-27 08:10:39
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 27 04:10:34.221624 2025] [security2:error] [pid 15245:tid 15245] [client 2a0b:f4c2::24:23034] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||grandriverhomes.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "grandriverhomes.com"] [uri "/grandriverhome.sql"] [unique_id "aNeb-uiYFgjYjSkB9uVVOAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-25 13:16:03
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 25 09:15:59.422969 2025] [security2:error] [pid 29094:tid 29094] [client 2a0b:f4c2::24:39598] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||psscififilmfest.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "psscififilmfest.org"] [uri "/psscififilmfest.sql"] [unique_id "aNVAj5Gd8cQCGFBcujgdwQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2025-09-21 17:51:33
(1 year ago)
(mod_security) mod_security (id:949110) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:949110) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org): N in the last X secs
show less
Web App Attack
🇺🇸
TPI-Abuse
2025-09-18 18:56:37
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 18 14:56:34.625847 2025] [security2:error] [pid 29266:tid 29266] [client 2a0b:f4c2::24:47602] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||rivercityacct.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "rivercityacct.com"] [uri "/riv.sql"] [unique_id "aMxV4sd9XS2-YRJ4rkc8PAAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xmission.com
2025-09-17 23:33:05
(1 year ago)
Blocked by UFW (TCP on 8333)
Source port: 61258
Packet length: 80
This report (for 2a0b:f4c2:0000:0 ...
show more
Blocked by UFW (TCP on 8333)
Source port: 61258
Packet length: 80
This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0024) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇺🇸
TPI-Abuse
2025-09-17 06:38:24
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 17 02:38:16.523479 2025] [security2:error] [pid 1045834:tid 1045874] [client 2a0b:f4c2::24:4864] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.clearwaterpumpservices.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.clearwaterpumpservices.com"] [uri "/clearwater.sql"] [unique_id "aMpXWNpgtAXibKhscKHvCgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-14 14:35:13
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 14 10:35:08.899580 2025] [security2:error] [pid 22645:tid 22645] [client 2a0b:f4c2::24:12692] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||hodlmoser.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "hodlmoser.com"] [uri "/moser.sql"] [unique_id "aMbSnDxIRDpK3Lz7rO2VJAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xmission.com
2025-09-12 01:34:22
(1 year ago)
Blocked by UFW (TCP on 8333)
Source port: 4856
Packet length: 80
This report (for 2a0b:f4c2:0000:00 ...
show more
Blocked by UFW (TCP on 8333)
Source port: 4856
Packet length: 80
This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0024) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇺🇸
TPI-Abuse
2025-09-09 01:19:18
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 08 21:19:13.284389 2025] [security2:error] [pid 19082:tid 19100] [client 2a0b:f4c2::24:47900] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "planillas.net"] [uri "/wp-config.php.maj"] [unique_id "aL-AkZRQZbnXIgzyWtydlAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-07 02:51:41
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org) ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::24 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 06 22:51:34.603041 2025] [security2:error] [pid 1439044:tid 1439064] [client 2a0b:f4c2::24:56424] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||property-management-companies-chicago.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "property-management-companies-chicago.com"] [uri "/property-management-companies.sql"] [unique_id "aLzzNv7FJegdDvSfo7ns3wAAAUQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
