🇧🇷
ICS Labs
2026-10-29 16:35:41
UTC ·
(1 week ago)
ICS Labs threat intelligence (ICS Feeds): Exploited Host. Last observed 2026-10-29 UTC.
Exploited Host
🇺🇸
1gz
2026-08-29 14:10:48
UTC ·
(2 months ago)
Triggered Cloudflare WAF (firewallCustom) from T1.
Action taken: CHALLENGE
Protocol: HTTP/2 (GET method)
Endpoint: /script.js
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
This report was generated by:
https:// ...
show more
Triggered Cloudflare WAF (firewallCustom) from T1.
Action taken: CHALLENGE
Protocol: HTTP/2 (GET method)
Endpoint: /script.js
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:140.0) Gecko/20100101 Firefox/140.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
xmission.com
2026-08-03 09:17:09
UTC ·
(3 months ago)
Blocked by UFW (TCP on 8333)
Source port: 29402
Packet length: 80
This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0008) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇳🇱
MacLotsen
2026-08-02 19:09:37
UTC ·
(3 months ago)
berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:01 +0200] "POST /wp-login.php HTTP/1.1" 200 3903 "https://ellenbakt.nl/wp-login.php" "Mozilla/5.0 (Linux; Android 12; motorola edge 20) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mob ...
show more
berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:01 +0200] "POST /wp-login.php HTTP/1.1" 200 3903 "https://ellenbakt.nl/wp-login.php" "Mozilla/5.0 (Linux; Android 12; motorola edge 20) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36"
berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:03 +0200] "POST /wp-login.php HTTP/1.1" 200 3903 "https://ellenbakt.nl/wp-login.php" "Mozilla/5.0 (Linux; Android 12; motorola edge 20) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36"
berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:06 +0200] "POST /wp-login.php HTTP/1.1" 200 3903 "https://ellenbakt.nl/wp-login.php" "Mozilla/5.0 (Linux; Android 12; motorola edge 20) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36"
berlin01.tor-exit.artikel10.org - - [02/Aug/2026:21:09:08 +0200] "POST /wp-login.php HTTP/1.1" 200 3903 "https://ellenbakt.nl/wp-login.php" "Mozilla/5.0 (Linux; Android 12; motorola edge 20) Ap
...
show less
Web App Attack
Brute-Force
🇺🇸
xmission.com
2026-07-23 18:04:01
UTC ·
(3 months ago)
Blocked by UFW (TCP on 8333)
Source port: 50444
Packet length: 80
This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0008) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇺🇸
xmission.com
2026-06-19 17:35:10
UTC ·
(4 months ago)
Blocked by UFW (TCP on 8333)
Source port: 19330
Packet length: 80
This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0008) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇺🇸
TPI-Abuse
2026-06-16 12:49:09
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 08:49:05.604325 2026] [security2:error] [pid 25203:tid 25203] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 08:49:05.604325 2026] [security2:error] [pid 25203:tid 25203] [client 2a0b:f4c2::8:27084] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.rentaroller.com.au"] [uri "/.git/config"] [unique_id "ajFGQQjNlhGkC__-28IbLwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 14:26:02
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 10:25:55.124977 2026] [security2:error] [pid 23613:tid 23613] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 10:25:55.124977 2026] [security2:error] [pid 23613:tid 23613] [client 2a0b:f4c2::8:48888] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.hi-niemczuras.net"] [uri "/.git/config"] [unique_id "ajALc33uxIpaQuPbP9lDlwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 14:07:18
UTC ·
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 10:07:11.958497 2026] [security2:error] [pid 29521:tid 29521] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 10:07:11.958497 2026] [security2:error] [pid 29521:tid 29521] [client 2a0b:f4c2::8:63298] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.casatualiving.com"] [uri "/.git/config"] [unique_id "ajAHD-xRcuhmnaHFI99aiAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-07 05:53:28
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 01:53:22.473610 2026] [security2:error] [pid 19587:tid 19587] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 07 01:53:22.473610 2026] [security2:error] [pid 19587:tid 19587] [client 2a0b:f4c2::8:46544] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.wildcroc.us"] [uri "/.git/config"] [unique_id "aiUHUimDiBSPhO9gFWnYVgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-05 11:54:50
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 07:54:42.185883 2026] [security2:error] [pid 21569:tid 21569] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jun 05 07:54:42.185883 2026] [security2:error] [pid 21569:tid 21569] [client 2a0b:f4c2::8:9244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.markrikey.com"] [uri "/.git/config"] [unique_id "aiK5Ai2VJ9ZpLTKs5R0FRwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-29 15:23:34
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 11:23:29.424670 2026] [security2:error] [pid 32469:tid 32469] [ ...
show more
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 11:23:29.424670 2026] [security2:error] [pid 32469:tid 32469] [client 2a0b:f4c2::8:16688] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.lobibilisim.com"] [uri "/.git/config"] [unique_id "ahmvcYIMBUXTcqSLBZorLQAAACs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ipblock.com
2026-05-23 18:56:00
UTC ·
(5 months ago)
IPBlock protected site ID [3717-sec].
Robotic site crawling, undeclared spider
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-09 12:44:43
UTC ·
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 08:44:39.768637 2026] [security2:error] [pid 8093:tid 8093] [cl ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 08:44:39.768637 2026] [security2:error] [pid 8093:tid 8093] [client 2a0b:f4c2::8:27080] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||energycapitalinvestments.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "energycapitalinvestments.com"] [uri "/energycapitalinvestme.sql"] [unique_id "af8sN3uwQSCDXVjCpiN9ywAAAEs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-05 11:03:31
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 05 07:03:20.869892 2026] [security2:error] [pid 21629:tid 21629] [ ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 05 07:03:20.869892 2026] [security2:error] [pid 21629:tid 21629] [client 2a0b:f4c2::8:51630] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||billymitchell.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "billymitchell.com"] [uri "/billymi.sql"] [unique_id "afnOeDabbRaRWGnDesqiTwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
