🇩🇪
kranem
2026-02-25 06:02:26
(3 months ago)
Triggered Cloudflare WAF from US.
Action taken: BLOCK
ASN: 200373 (DREI-K-TECH-GMBH)
Protocol: HTTP/ ...
show more
Triggered Cloudflare WAF from US.
Action taken: BLOCK
ASN: 200373 (DREI-K-TECH-GMBH)
Protocol: HTTP/2 (GET method)
Endpoint: /auth/login
Timestamp: 2026-02-25T04:53:17Z
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.207 Safari/537.36
show less
Bad Web Bot
🇵🇱
sefinek.net
2026-01-01 10:13:13
(5 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /genshin-stella-mod
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2025-11-24 09:37:47
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.8 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.8 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 04:37:35.217644 2025] [security2:error] [pid 31001:tid 31001] [client 104.207.32.8:54623] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.caremedicalbillinginc.com"] [uri "/.svn/wc.db"] [unique_id "aSQnX9TXabGwzi7r7ov1EwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 07:45:20
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.8 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.8 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:45:13.474771 2025] [security2:error] [pid 13545:tid 13545] [client 104.207.32.8:58229] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aufflammen.com"] [uri "/.env"] [unique_id "aSQNCaZFpsumJ0z0MawLhAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 07:14:39
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.8 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.8 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:14:33.698963 2025] [security2:error] [pid 968:tid 968] [client 104.207.32.8:54523] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.thn.bz"] [uri "/.env"] [unique_id "aSQF2ZYGcNiffjQ1T11ijAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
ParaBug
2025-11-24 06:57:33
(6 months ago)
104.207.32.8 - - [24/Nov/2025:07:57:32 +0100] "GET /.aws/credentials HTTP/1.1" 301 480 "-" "Mozilla/ ...
show more
104.207.32.8 - - [24/Nov/2025:07:57:32 +0100] "GET /.aws/credentials HTTP/1.1" 301 480 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0"
...
show less
Phishing
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 06:43:54
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.8 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.8 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 01:43:42.605302 2025] [security2:error] [pid 12103:tid 12148] [client 104.207.32.8:16449] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.telesmt.com"] [uri "/.svn/wc.db"] [unique_id "aSP-nud3pxroRSWDTtpV5QAAAM8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 05:23:06
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.8 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.8 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:22:58.861523 2025] [security2:error] [pid 24200:tid 24200] [client 104.207.32.8:53675] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.creativeinteriors.co.com"] [uri "/.git/HEAD"] [unique_id "aSPrsrbqQ45wkkw_MLUB9gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 04:58:08
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.8 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.8 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:58:00.573184 2025] [security2:error] [pid 26596:tid 26596] [client 104.207.32.8:53143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.warshaw1.com"] [uri "/.env"] [unique_id "aSPl2Pgv-HIXxfM7A7rldgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 02:57:14
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.32.8 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.32.8 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 21:57:06.694685 2025] [security2:error] [pid 4711:tid 4711] [client 104.207.32.8:29909] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.cypraea.info"] [uri "/.env"] [unique_id "aSPJgvkwLu-cp9WY_kIAvQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-17 20:58:33
(6 months ago)
Attempted brute force login to web vpn 12 time(s); last attempt for 2025.11.17 is noted in report ti ...
show more
Attempted brute force login to web vpn 12 time(s); last attempt for 2025.11.17 is noted in report timestamp
show less
Hacking
Brute-Force
🇺🇸
techboy117
2025-11-14 00:21:07
(6 months ago)
Blocking due to password spraying.
Brute-Force
2025-11-13 22:24:32
(6 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
2025-11-12 07:27:10
(6 months ago)
Attempted brute force login to web vpn 3 time(s); last attempt for 2025.11.12 is noted in report tim ...
show more
Attempted brute force login to web vpn 3 time(s); last attempt for 2025.11.12 is noted in report timestamp
show less
Hacking
Brute-Force
2025-10-18 04:04:08
(7 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack