🇺🇸
TPI-Abuse
2026-04-19 06:48:37
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): ...
show more
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Apr 19 02:48:27.283226 2026] [security2:error] [pid 1669272:tid 1669272] [client 2a0b:f4c2::8:28800] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "starsmogsandiego.com"] [uri "/wp-config.phpr"] [unique_id "aeR6u1pTsVoEf84-As_xGwAAACc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-17 02:34:41
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): ...
show more
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 16 22:34:31.003680 2026] [security2:error] [pid 3847277:tid 3847277] [client 2a0b:f4c2::8:37426] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rambleandprose.com"] [uri "/wp-config.php_"] [unique_id "aeGcN5YGDM1Eb5DHBEmEYwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-02 18:56:06
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 02 14:56:01.412824 2026] [security2:error] [pid 16681:tid 16681] [client 2a0b:f4c2::8:46998] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||daisydoesoap.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "daisydoesoap.com"] [uri "/daisydoesoap_com.sql"] [unique_id "ac67wT9yk_gVJXabLO1cyQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xmission.com
2026-03-25 06:04:19
(5 months ago)
Blocked by UFW (TCP on 8333)
Source port: 46026
Packet length: 80
This report (for 2a0b:f4c2:0000:0 ...
show more
Blocked by UFW (TCP on 8333)
Source port: 46026
Packet length: 80
This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0008) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇺🇸
TPI-Abuse
2026-03-24 03:48:33
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): ...
show more
(mod_security) mod_security (id:210492) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 23 23:48:27.716321 2026] [security2:error] [pid 29531:tid 29539] [client 2a0b:f4c2::8:21972] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ipv6.rbarw.com"] [uri "/.git/config"] [unique_id "acIJi8B9-bM6FzkJXagDzwAAAIY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xmission.com
2026-03-18 03:06:42
(5 months ago)
Blocked by UFW (TCP on 8333)
Source port: 13738
Packet length: 80
This report (for 2a0b:f4c2:0000:0 ...
show more
Blocked by UFW (TCP on 8333)
Source port: 13738
Packet length: 80
This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0008) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇺🇸
TPI-Abuse
2026-03-09 04:14:24
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 09 00:14:12.963802 2026] [security2:error] [pid 28080:tid 28080] [client 2a0b:f4c2::8:40178] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||geckoturner.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "geckoturner.com"] [uri "/dbgeckoturner.sql"] [unique_id "aa5JFMvaV12IS-Q68silqgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-09 01:41:00
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 08 21:40:55.046118 2026] [security2:error] [pid 21993:tid 21993] [client 2a0b:f4c2::8:15640] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mobileonlinecasinos.co|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mobileonlinecasinos.co"] [uri "/casinos_db.sql"] [unique_id "aa4lJ2bU61q4LolD0xL21gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
jjnxpct
2026-03-05 04:50:47
(6 months ago)
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting UR ...
show more
Automated security incident from hosting server. ModSecurity blocked suspicious request targeting URI: /hologenpraktijk_db.sql (Rule ID: 920440) - URL file extension is restricted by policy
show less
Web App Attack
SQL Injection
Hacking
🇺🇸
pduggusa
2026-03-01 01:56:26
(6 months ago)
Detected attacking dugganusa.com at 2026-03-01T01:56:26.521Z | Source: DugganUSA PreCog auto-block
Hacking
🇺🇸
pduggusa
2026-03-01 01:15:43
(6 months ago)
Detected attacking dugganusa.com at 2026-03-01T01:15:43.193Z | Source: DugganUSA PreCog auto-block
Hacking
🇺🇸
pduggusa
2026-03-01 00:11:28
(6 months ago)
Detected attacking dugganusa.com at 2026-03-01T00:11:28.547Z | Source: DugganUSA PreCog auto-block
Hacking
🇺🇸
xmission.com
2026-02-17 18:02:32
(6 months ago)
Blocked by UFW (TCP on 8333)
Source port: 55532
Packet length: 80
This report (for 2a0b:f4c2:0000:0 ...
show more
Blocked by UFW (TCP on 8333)
Source port: 55532
Packet length: 80
This report (for 2a0b:f4c2:0000:0000:0000:0000:0000:0008) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
🇺🇸
TPI-Abuse
2026-02-02 11:48:27
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0b:f4c2::8 (berlin01.tor-exit.artikel10.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 02 06:48:21.375094 2026] [security2:error] [pid 14190:tid 14190] [client 2a0b:f4c2::8:64902] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||roughexports.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "roughexports.com"] [uri "/roughexports_com.sql"] [unique_id "aYCPBRiGgeCRobkPs4SYwQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-01-31 23:00:21
(7 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-01-30.
show less
Hacking
Web App Attack
SSH