🇩🇪
jbcrn
2026-09-14 09:11:43
(3 hours ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. ...
show more
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /catechumenism-shisn. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 OPR/116.0.0.0
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 08:04:23
(4 hours ago)
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 04:04:19.166186 2026] [security2:error] [pid 414:tid 414] [client 47.79.206.196:26046] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.clossglobal.com|F|2"] [data ".clossglobal.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.clossglobal.com"] [uri "/Solutions/donald-m-temple/www.clossglobal.com"] [unique_id "aqeqg6XYx9Red5R4E7zvfgAAAB8"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
1gz
2026-09-14 07:00:27
(6 hours ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET metho ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-13 19:05:11
(17 hours ago)
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 15:05:05.261588 2026] [security2:error] [pid 20091:tid 20091] [client 47.79.206.196:63110] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.forestvalleyfarm.com|F|2"] [data ".weebly.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.forestvalleyfarm.com"] [uri "/cattle/www.weebly.com"] [unique_id "aqbz4SG_wcf1xiUPQL0ggAAAAA4"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 16:05:17
(20 hours ago)
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 12:05:10.020537 2026] [security2:error] [pid 5844:tid 5844] [client 47.79.206.196:27270] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.owenbee.com|F|2"] [data ".owenbee.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.owenbee.com"] [uri "/NewOwenBee/june-21-2021/www.owenbee.com"] [unique_id "aqbJtqT-E8XrRi3oSygG0QAAAAQ"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 14:05:51
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 10:05:44.271809 2026] [security2:error] [pid 29341:tid 29341] [client 47.79.206.196:49080] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.mardensmith.com|F|2"] [data ".mardensmith.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.mardensmith.com"] [uri "/wordpress/kids/www.mardensmith.com"] [unique_id "aqVcOCRJlttCW1GiPzPioAAAAAI"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 13:15:11
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 09:15:05.554805 2026] [security2:error] [pid 3545:tid 3545] [client 47.79.206.196:57448] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.peterjohnsonauthor.com|F|2"] [data ".peterjohnsonauthor.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.peterjohnsonauthor.com"] [uri "/yanovels/www.peterjohnsonauthor.com"] [unique_id "aqVQWZun3bvf1KzVqBJ1LwAAABY"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
1gz
2026-09-12 13:10:38
(1 day ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET metho ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-12 04:07:45
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 00:07:41.134138 2026] [security2:error] [pid 14957:tid 14957] [client 47.79.206.196:65312] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||smogsandiego.com|F|2"] [data ".starsmogsandiego.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "smogsandiego.com"] [uri "/smog-check-fallbrook/www.STARSmogSanDiego.com"] [unique_id "aqTQDXAeXvzltBYg4TqAdQAAAAs"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-11 17:00:31
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 13:00:26.388665 2026] [security2:error] [pid 3616:tid 3616] [client 47.79.206.196:49128] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||www.danielbrower.com|F|2"] [data ".danielbrower.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.danielbrower.com"] [uri "/sample-page/www.danielbrower.com"] [unique_id "aqQzqn3e_GjkzdOXJmXdvQAAAGY"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-11 16:13:01
(2 days ago)
Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ...
show more
Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for | method: GET | path: /drapeaux-prussiens-guerre-de-7-ans-par-frederic-aubert/kompagniefahne_ir41 | 2026-09-11 16:13 UTC
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-09 18:08:32
(4 days ago)
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 47.79.206.196 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 09 14:08:26.205307 2026] [security2:error] [pid 25328:tid 25418] [client 47.79.206.196:61808] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||newtrendmag.org|F|2"] [data ".voxunion.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "newtrendmag.org"] [uri "/www.voxunion.com"] [unique_id "aqGgmlzTogQsjVtqqN4XXAAAARY"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-08 23:06:19
(5 days ago)
Asking over plain http and never following the redirect served — a crawler that reads nothing it ask ...
show more
Asking over plain http and never following the redirect served — a crawler that reads nothing it asks for | method: GET | path: /actualites/la-lettre-dinformation-n16-est-disponible | 2026-09-08 23:06 UTC
show less
Bad Web Bot
🇩🇪
jbcrn
2026-09-06 14:01:10
(1 week ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. ...
show more
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /deflagration.moted-transitiveness. User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Mobile Safari/537.36
show less
Bad Web Bot
Web App Attack
🇩🇪
jbcrn
2026-09-03 11:10:26
(1 week ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. ...
show more
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /crony-galvanoglyphy. User-Agent: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Mobile Safari/537.36
show less
Bad Web Bot
Web App Attack
