🇺🇸
nowyouknow
2026-05-08 08:48:16
(4 weeks ago)
Malicious Traffic/Form Submission
Phishing
Web Spam
🇩🇪
Packets-Decreaser.NET
2025-12-29 14:01:55
(5 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇵🇱
sefinek.net
2025-12-17 01:59:48
(5 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /genshin-stella-mod
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2025-12-02 20:56:08
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.40.89 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.40.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 15:56:03.980212 2025] [security2:error] [pid 20337:tid 20337] [client 104.207.40.89:51077] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "uphillfarmvt.com"] [uri "/.svn/wc.db"] [unique_id "aS9SYxVeYBqItdqkG-Z4iQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-12-02 12:31:21
(6 months ago)
botnet
DDoS Attack
🇺🇸
TPI-Abuse
2025-12-02 07:54:26
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.40.89 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.40.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 02:54:23.075447 2025] [security2:error] [pid 24628:tid 24628] [client 104.207.40.89:52909] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stevedemers.com"] [uri "/.git/HEAD"] [unique_id "aS6bLxo1O2MuLtOItw1hLQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-02 06:08:38
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.40.89 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.40.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 01:08:32.282963 2025] [security2:error] [pid 19743:tid 19743] [client 104.207.40.89:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "southernbroadcast.com"] [uri "/.git/HEAD"] [unique_id "aS6CYDfZG7L3kTCs7XhqHgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-02 05:33:00
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.40.89 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.40.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 00:32:53.463123 2025] [security2:error] [pid 14203:tid 14203] [client 104.207.40.89:18387] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "francoiseroy.com"] [uri "/.svn/wc.db"] [unique_id "aS56BVGCdhixUTy7WUaGvwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-12-02 01:07:49
(6 months ago)
Malicious activity detected
Hacking
Web App Attack
🇩🇪
iNetWorker
2025-11-24 11:03:44
(6 months ago)
trolling for resource vulnerabilities
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 05:35:43
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.40.89 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.40.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:35:35.923961 2025] [security2:error] [pid 3965136:tid 3965157] [client 104.207.40.89:27887] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.otemaetk.com"] [uri "/.env"] [unique_id "aSPupzGAQlEvBxWyTv_NlgAAAZM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 05:05:44
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 104.207.40.89 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 104.207.40.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 00:05:39.834499 2025] [security2:error] [pid 26544:tid 26544] [client 104.207.40.89:26191] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.imageries.quickasawink.org|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.imageries.quickasawink.org"] [uri "/.svn/wc.db"] [unique_id "aSPno4fhdoDOeekY2P4XIAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-13 20:44:16
(6 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇺🇸
nowyouknow
2025-11-06 06:45:34
(6 months ago)
(From [email protected] ) Boost up crystalchiro.com seo ranking with trusted seo services!
...
show more
(From [email protected] ) Boost up crystalchiro.com seo ranking with trusted seo services!
BonusBacklinks.com - we provide daily backlinks and drive website clicks to your site EVERY DAY:
+ Get 85% OFF
+ Quality daily backlinks
+ Organic website traffic
+ Price as low as $1
+ Bonus discount codes
http://tiny.cc/BonusBacklinks-85Save
BonusBacklinks.com - daily seo backlinks and website clicks to increase your site every day
show less
Phishing
Web Spam
🇺🇸
TPI-Abuse
2025-10-30 12:06:06
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 104.207.40.89 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 104.207.40.89 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 30 08:05:59.984249 2025] [security2:error] [pid 4086:tid 4086] [client 104.207.40.89:42549] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ozkanturker.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ozkanturker.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aQNUp0_oD7iUgpfLXM-R-gAAAAE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack