🇺🇸
TPI-Abuse
2025-12-08 09:14:30
UTC ·
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 08 04:14:25.543712 2025] [security2:error] [pid 3077:tid 3077] [client 2a0f:df00:0 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 08 04:14:25.543712 2025] [security2:error] [pid 3077:tid 3077] [client 2a0f:df00:0:255::205:3771] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||drdot.xyz|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "drdot.xyz"] [uri "/backups.sql"] [unique_id "aTaW8YpTrOX9FTnv7GdzIgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-08 08:48:34
UTC ·
(10 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 08 03:48:23.812495 2025] [security2:error] [pid 31101:tid 31101] [client 2a0f:df00 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 08 03:48:23.812495 2025] [security2:error] [pid 31101:tid 31101] [client 2a0f:df00:0:255::205:4869] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||cornerstonecharitablescholarshiptrust.org|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "cornerstonecharitablescholarshiptrust.org"] [uri "/co.sql"] [unique_id "aTaQ1zhGKEI3HFoVpoIYRQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-07 18:25:18
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 13:25:14.470315 2025] [security2:error] [pid 22063:tid 22063] [client 2a0f:df00 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 13:25:14.470315 2025] [security2:error] [pid 22063:tid 22063] [client 2a0f:df00:0:255::205:43531] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||corporatepresentation.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "corporatepresentation.net"] [uri "/corporatepresen.sql"] [unique_id "aTXGihFRNgqcJ5Lbo2FQIwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-07 16:42:47
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 11:42:43.652079 2025] [security2:error] [pid 26754:tid 26754] [client 2a0f:df00 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 11:42:43.652079 2025] [security2:error] [pid 26754:tid 26754] [client 2a0f:df00:0:255::205:64597] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||alejandrogorsse.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "alejandrogorsse.com"] [uri "/backupdb.sql"] [unique_id "aTWug4rJusMnFinAp3WVMAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-07 12:25:52
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 07:25:47.974118 2025] [security2:error] [pid 20087:tid 20087] [client 2a0f:df00 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 07:25:47.974118 2025] [security2:error] [pid 20087:tid 20087] [client 2a0f:df00:0:255::205:19153] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||basse.me|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "basse.me"] [uri "/dump.sql"] [unique_id "aTVyS6Ez9yDsD3fEuRB6EAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-07 09:59:16
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 04:58:59.888887 2025] [security2:error] [pid 13017:tid 13017] [client 2a0f:df00 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 04:58:59.888887 2025] [security2:error] [pid 13017:tid 13017] [client 2a0f:df00:0:255::205:62057] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||casadelsolmexico.net|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "casadelsolmexico.net"] [uri "/casadelsolmexi.sql"] [unique_id "aTVP40CNUtRzVM3aHUWsUwAAADc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-07 06:31:27
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 01:31:20.798538 2025] [security2:error] [pid 1774:tid 1774] [client 2a0f:df00:0 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 07 01:31:20.798538 2025] [security2:error] [pid 1774:tid 1774] [client 2a0f:df00:0:255::205:60905] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||glaswoodind.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "glaswoodind.com"] [uri "/latest.sql"] [unique_id "aTUfOGZggzjPZ-XR321o_wAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-07 03:48:58
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 06 22:48:51.686081 2025] [security2:error] [pid 17607:tid 17607] [client 2a0f:df00 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 06 22:48:51.686081 2025] [security2:error] [pid 17607:tid 17607] [client 2a0f:df00:0:255::205:33407] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||indyham.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "indyham.com"] [uri "/dyham.sql"] [unique_id "aTT5IyRcNqRuTjF2Wj2GwQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
xmission.com
2025-12-06 09:45:38
UTC ·
(11 months ago)
Blocked by UFW (TCP on 56654)
Source port: 443
Packet length: 1500
This report (for 2a0f:df00:0000:0255:0000:0000:0000:0205) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
Port Scan
🇺🇸
TPI-Abuse
2025-12-06 07:57:46
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 06 02:57:40.592943 2025] [security2:error] [pid 12776:tid 12776] [client 2a0f:df00 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Dec 06 02:57:40.592943 2025] [security2:error] [pid 12776:tid 12776] [client 2a0f:df00:0:255::205:49583] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||sutherlandyogastudio.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sutherlandyogastudio.com"] [uri "/sutherlandyogastud.sql"] [unique_id "aTPh9Ny2Yvc18-Pj9boUXAAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-06 03:09:05
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 05 22:08:53.655481 2025] [security2:error] [pid 8813:tid 8813] [client 2a0f:df00:0 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 05 22:08:53.655481 2025] [security2:error] [pid 8813:tid 8813] [client 2a0f:df00:0:255::205:22353] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||newmooncafe.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "newmooncafe.com"] [uri "/mooncafe_com.sql"] [unique_id "aTOeRWwTxfa_3ZYYN4fOLwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-05 07:33:47
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 05 02:33:42.529663 2025] [security2:error] [pid 29214:tid 29214] [client 2a0f:df00 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 05 02:33:42.529663 2025] [security2:error] [pid 29214:tid 29214] [client 2a0f:df00:0:255::205:17793] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||grandriverhomes.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "grandriverhomes.com"] [uri "/weekly.sql"] [unique_id "aTKK1sYL1AN3fH_NxoRl7AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-05 05:47:11
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 05 00:47:02.823787 2025] [security2:error] [pid 17742:tid 17742] [client 2a0f:df00 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Dec 05 00:47:02.823787 2025] [security2:error] [pid 17742:tid 17742] [client 2a0f:df00:0:255::205:19137] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||lesbidrawn.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "lesbidrawn.com"] [uri "/n_com.sql"] [unique_id "aTJx1mTzZj27A3SaCKOR_AAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-04 18:58:50
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 04 13:58:33.672290 2025] [security2:error] [pid 6454:tid 6460] [client 2a0f:df00:0 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 04 13:58:33.672290 2025] [security2:error] [pid 6454:tid 6460] [client 2a0f:df00:0:255::205:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mindgardens.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mindgardens.com"] [uri "/ndgardens.sql"] [unique_id "aTHZ2VnbnskLcR1DlKUyVAAAAEQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-04 16:18:21
UTC ·
(11 months ago)
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 04 11:17:54.987700 2025] [security2:error] [pid 27392:tid 27392] [client 2a0f:df00 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a0f:df00:0:255::205 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 04 11:17:54.987700 2025] [security2:error] [pid 27392:tid 27392] [client 2a0f:df00:0:255::205:22331] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||michaelmoorefield.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "michaelmoorefield.com"] [uri "/field_com.sql"] [unique_id "aTG0MsW1gfUxSlWx4g8oYAAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
