🇺🇸
mnsf
2026-09-15 15:05:46
(11 hours ago)
Abuse Detected (9)
Brute-Force
Web App Attack
🇧🇪
taivas.nl
2026-09-15 14:32:11
(12 hours ago)
Bad_requests
Bad Web Bot
🇩🇪
Petros Stefanakis
2026-09-15 14:15:40
(12 hours ago)
(wordpress,mod_security) Login failure/trigger from 104.196.199.233 (US/United States/233.199.196.10 ...
show more
(wordpress,mod_security) Login failure/trigger from 104.196.199.233 (US/United States/233.199.196.104.bc.googleusercontent.com)
show less
SQL Injection
Brute-Force
🇳🇱
Site.eu
2026-09-15 14:14:22
(12 hours ago)
Repeated wp-login/xmlrpc attempts
Brute-Force
SSH
🇩🇪
grassau.com
2026-09-15 14:10:03
(12 hours ago)
(wordpress) Failed wordpress login from 104.196.199.233 (US/United States/South Carolina/North Charl ...
show more
(wordpress) Failed wordpress login from 104.196.199.233 (US/United States/South Carolina/North Charleston/233.199.196.104.bc.googleusercontent.com)
show less
Brute-Force
🇩🇪
neckaralb-admin.de
2026-09-15 14:09:17
(12 hours ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇫🇷
dynamix
2026-09-15 14:08:53
(12 hours ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-09-15 14:08:39
(12 hours ago)
[cb-15al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpr ...
show more
[cb-15al] WordPress login brute-force: 4 suspicious requests detected by fail2ban jail apache-wordpress. Example: 104.196.199.233 - - [15/Sep/2026:16:08:27 +0200] "POST //xmlrpc.php HTTP/2.0" 403 55 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
104.196.199.233 - - [15/Sep/2026:16:08:27 +0200] "POST //xmlrpc.php HTTP/2.0" 403 32 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
104.196.199.233 - - [15/Sep/2026:16:08:28 +0200] "POST //xmlrpc.php HTTP/2.0" 403 55 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36"
104.196.199.233 - - [15/Sep/2026:16:08:28 +0200] "POST //xmlrpc.php HTTP/2.0" 403 32 "-" "Mozil
...
show less
Brute-Force
Web App Attack
🇩🇪
maxpower
2026-09-15 14:08:36
(12 hours ago)
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 104.196.199.233 (US/United States/233.199.196. ...
show more
(nginx_hardened) REGOLA 3 - Nginx Hardening Triggered 104.196.199.233 (US/United States/233.199.196.104.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 104.196.199.233 - - [15/Sep/2026:16:08:26 +0200] "GET //xmlrpc.php?rsd HTTP/2.0" 403 129 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" "104.196.199.233" host=elektra.ovh
104.196.199.233 - - [15/Sep/2026:16:08:30 +0200] "GET //?author=1 HTTP/2.0" 403 129 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36" "104.196.199.233" host=elektra.ovh
2026/09/15 16:08:30 [error] 1347303#1347303: *1014443 access forbidden by rule, client: 104.196.199.233, server: elektra.ovh, request: "GET //?author=2 HTTP/2.0", host: "elektra.ovh"
show less
Port Scan
🇺🇸
TPI-Abuse
2026-09-15 14:07:16
(12 hours ago)
(mod_security) mod_security (id:225170) triggered by 104.196.199.233 (233.199.196.104.bc.googleuserc ...
show more
(mod_security) mod_security (id:225170) triggered by 104.196.199.233 (233.199.196.104.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 10:07:08.044036 2026] [security2:error] [pid 3720:tid 3720] [client 104.196.199.233:60903] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.mchen-arch.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.mchen-arch.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aqlRDPFgKaukhEUAuMtyfwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-09-15 14:05:05
(12 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
agenciahypelab.com.br
2026-09-15 14:04:37
(12 hours ago)
WordPress login brute-force detectado e bloqueado pelo CSF/LFD. Trigger: LF_TRIGGER
Brute-Force
SSH
🇩🇪
FeG Deutschland
2026-09-15 14:03:54
(12 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇫🇮
as211431.net
2026-09-15 13:42:03
(13 hours ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 (GET method)
Endpoint: /
UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
lcpacs
2026-09-15 13:39:06
(13 hours ago)
Auto-flagged by honeypot: tripped / — client-supplied proxy headers (x-forwarded-proto:http) — not U ...
show more
Auto-flagged by honeypot: tripped / — client-supplied proxy headers (x-forwarded-proto:http) — not US+en-US (country: US, accept-language: none)
show less
Bad Web Bot
Web App Attack