🇪🇸
gnom4ik
2026-02-20 19:41:27
UTC ·
(8 months ago)
ban-reviewer auto report; ip=42.236.12.240; scenario=http:scan; verdict=valid_ban; confidence=0.85; categories=14,15,18,22; active_decisions=1; lookback_decisions=1; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=scan/exp ...
show more
ban-reviewer auto report; ip=42.236.12.240; scenario=http:scan; verdict=valid_ban; confidence=0.85; categories=14,15,18,22; active_decisions=1; lookback_decisions=1; nginx_requests=0; appsec_matches=0; auth_events=0; kernel_events=0; signals=scan/exploit pattern detected (http:scan); IP has been banned previously for similar activity; abuseipdb categories 14 (Port Scan), 15 (Hacking), 18 (Brute-Force), 22 (SSH) are relevant
show less
Port Scan
Hacking
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-01-29 13:45:01
UTC ·
(9 months ago)
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 08:44:55.557655 2026] [security2:error] [pid 23448:tid 23448] [client 42.236.12. ...
show more
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 08:44:55.557655 2026] [security2:error] [pid 23448:tid 23448] [client 42.236.12.240:48086] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.judgehall.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.judgehall.com"] [uri "/"] [unique_id "aXtkV2msr-WmUjr2k7T6zQAAABA"], referer: http://www.judgehall.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-29 12:27:15
UTC ·
(9 months ago)
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 07:27:07.775774 2026] [security2:error] [pid 3689035:tid 3689035] [client 42.236 ...
show more
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 07:27:07.775774 2026] [security2:error] [pid 3689035:tid 3689035] [client 42.236.12.240:32053] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||megaandina.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "megaandina.com"] [uri "/index.html"] [unique_id "aXtSGwJwf5QPqzLg4xe-mgAAABU"], referer: https://megaandina.com/index.html
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-29 10:13:31
UTC ·
(9 months ago)
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 05:13:23.732793 2026] [security2:error] [pid 7302:tid 7302] [client 42.236.12.24 ...
show more
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 05:13:23.732793 2026] [security2:error] [pid 7302:tid 7302] [client 42.236.12.240:61031] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||persnicketyinc.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "persnicketyinc.com"] [uri "/"] [unique_id "aXsyw5PXwl_oxZpUIdvjxgAAAAI"], referer: https://persnicketyinc.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-29 09:58:19
UTC ·
(9 months ago)
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 04:58:14.173760 2026] [security2:error] [pid 12390:tid 12390] [client 42.236.12. ...
show more
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 04:58:14.173760 2026] [security2:error] [pid 12390:tid 12390] [client 42.236.12.240:24983] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||five21.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "five21.com"] [uri "/"] [unique_id "aXsvNhLINeEJa6PlcbC3SgAAAAM"], referer: https://five21.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-29 09:23:23
UTC ·
(9 months ago)
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 04:23:19.812985 2026] [security2:error] [pid 27640:tid 27640] [client 42.236.12. ...
show more
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 04:23:19.812985 2026] [security2:error] [pid 27640:tid 27640] [client 42.236.12.240:23269] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||tataylor.net|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "tataylor.net"] [uri "/"] [unique_id "aXsnB5cQ1Ffv3y_X-S75lQAAAB4"], referer: http://tataylor.net/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-29 08:59:51
UTC ·
(9 months ago)
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 03:59:46.700944 2026] [security2:error] [pid 25449:tid 25449] [client 42.236.12. ...
show more
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 03:59:46.700944 2026] [security2:error] [pid 25449:tid 25449] [client 42.236.12.240:4597] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.mhext.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.mhext.com"] [uri "/"] [unique_id "aXshguA-2CEAyXqeE675VwAAAAA"], referer: http://www.mhext.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-29 07:55:09
UTC ·
(9 months ago)
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 02:55:04.965161 2026] [security2:error] [pid 5367:tid 5367] [client 42.236.12.24 ...
show more
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 02:55:04.965161 2026] [security2:error] [pid 5367:tid 5367] [client 42.236.12.240:45568] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.smotheredhope.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.smotheredhope.com"] [uri "/"] [unique_id "aXsSWP5zEffJKpZEE9f44QAAAAM"], referer: http://www.smotheredhope.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-29 07:30:04
UTC ·
(9 months ago)
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 02:29:56.264597 2026] [security2:error] [pid 9986:tid 9986] [client 42.236.12.24 ...
show more
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 29 02:29:56.264597 2026] [security2:error] [pid 9986:tid 9986] [client 42.236.12.240:42642] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.redlinechemical.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.redlinechemical.com"] [uri "/"] [unique_id "aXsMdG-LcWyHahgRCkNC6QAAACI"], referer: http://www.redlinechemical.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-28 07:50:44
UTC ·
(9 months ago)
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 28 02:50:36.953145 2026] [security2:error] [pid 18758:tid 18758] [client 42.236.12. ...
show more
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 28 02:50:36.953145 2026] [security2:error] [pid 18758:tid 18758] [client 42.236.12.240:4896] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.rgvatvrepair.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.rgvatvrepair.com"] [uri "/"] [unique_id "aXm_zLjEbFEPnCNFbJuGGQAAAAY"], referer: https://www.rgvatvrepair.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-26 09:12:29
UTC ·
(9 months ago)
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 26 04:12:23.987803 2026] [security2:error] [pid 14497:tid 14497] [client 42.236.12. ...
show more
(mod_security) mod_security (id:210831) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 26 04:12:23.987803 2026] [security2:error] [pid 14497:tid 14497] [client 42.236.12.240:2847] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||kemela.com|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "kemela.com"] [uri "/"] [unique_id "aXcv90Dk9eNhOLdoVZeuYAAAACg"], referer: https://kemela.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
rh24
2025-10-05 06:21:54
UTC ·
(1 year ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 42.236.12.240 (CN/China/hn.kd.ny.adsl)
Bad Web Bot
🇺🇸
TPI-Abuse
2025-09-29 22:23:54
UTC ·
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 29 18:23:48.062128 2025] [security2:error] [pid 14614:tid 14614] [client 42.236.12. ...
show more
(mod_security) mod_security (id:225170) triggered by 42.236.12.240 (hn.kd.ny.adsl): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 29 18:23:48.062128 2025] [security2:error] [pid 14614:tid 14614] [client 42.236.12.240:44897] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.kengarysp.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.kengarysp.com"] [uri "/wp-json/wp/v2/users/me"] [unique_id "aNsG9MXlwXTRFmMYVVOKuQAAAHQ"], referer: https://www.kengarysp.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
rh24
2025-09-29 11:09:08
UTC ·
(1 year ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 42.236.12.240 (CN/China/hn.kd.ny.adsl)
Bad Web Bot
🇩🇪
rh24
2025-09-14 10:21:16
UTC ·
(1 year ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 42.236.12.240 (CN/China/hn.kd.ny.adsl)
Bad Web Bot