🇩🇪
Carsten
2026-10-09 12:13:18
(2 days ago)
Bad web bot [Mozilla/5.0 (compatible; Dataprovider.com)]
Bad Web Bot
🇵🇱
Budyn
2026-10-02 17:17:54
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: shop.dont-eat-the-pudding.top | URI: /backup.sql | UA: Mozilla/5.0 (compatible; Dataprovider.com) | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 08:37:57
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 149.56.160.189 (crawl-149-56-160-189.dataprovid ...
show more
(mod_security) mod_security (id:210730) triggered by 149.56.160.189 (crawl-149-56-160-189.dataproviderbot.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 04:37:53.772738 2026] [security2:error] [pid 3994:tid 3994] [client 149.56.160.189:53711] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||glassclublake.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "glassclublake.com"] [uri "/[email protected] "] [unique_id "ar9tYakXC97xHHzAzpT_bAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-09-29 16:39:17
(1 week ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇦🇺
Bay13
2026-09-21 18:43:28
(2 weeks ago)
CrowdSec:custom/http-probing-multivhost
Web App Attack
🇹🇷
neron
2026-08-15 23:06:48
(1 month ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-08-09 18:29:21
(2 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-07-31 09:06:18
(2 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-07-29 12:19:39
(2 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-07-26 22:19:38
(2 months ago)
CrowdSec blocked: http:exploit detected via OPNsense firewall
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 19:22:36
(4 months ago)
(mod_security) mod_security (id:243420) triggered by 149.56.160.189 (crawl-149-56-160-189.dataprovid ...
show more
(mod_security) mod_security (id:243420) triggered by 149.56.160.189 (crawl-149-56-160-189.dataproviderbot.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 15:22:32.381444 2026] [security2:error] [pid 15570:tid 15570] [client 149.56.160.189:57807] ModSecurity: Access denied with code 403 (phase 3). Match of "validateByteRange 0-31" against "REQUEST_HEADERS:Accept-Encoding" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6640"] [id "243420"] [rev "4"] [msg "COMODO WAF: Information disclosure vulnerability in Eclipse Jetty before 9.2.9.v20150224 (CVE-2015-2080)||www.fitzcosound.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.fitzcosound.com"] [uri "/lrates.html"] [unique_id "ag4J-NxIFXGPQmoZQymx7QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-02 15:22:06
(5 months ago)
(mod_security) mod_security (id:243420) triggered by 149.56.160.189 (crawl-149-56-160-189.dataprovid ...
show more
(mod_security) mod_security (id:243420) triggered by 149.56.160.189 (crawl-149-56-160-189.dataproviderbot.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 02 11:21:58.556613 2026] [security2:error] [pid 23704:tid 23704] [client 149.56.160.189:57507] ModSecurity: Access denied with code 403 (phase 3). Match of "validateByteRange 0-31" against "REQUEST_HEADERS:Accept-Encoding" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "6640"] [id "243420"] [rev "4"] [msg "COMODO WAF: Information disclosure vulnerability in Eclipse Jetty before 9.2.9.v20150224 (CVE-2015-2080)||fiestadj.com.mx|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "fiestadj.com.mx"] [uri "/"] [unique_id "afYWlvdrYOS3smioij9UVAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
as211431.net
2026-04-29 08:43:10
(5 months ago)
Triggered Cloudflare WAF (firewallCustom) from CA.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 ...
show more
Triggered Cloudflare WAF (firewallCustom) from CA.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 (GET method)
Endpoint: /
UA: Mozilla/5.0 (Linux; Android 10; SM-G981B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.162 Mobile Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇨🇭
backslash
2026-04-26 14:48:03
(5 months ago)
block ruleset 3D3AFA921A373ECE19B6BA285C2D722163304638
Bad Web Bot
🇩🇰
RhQM
2026-04-24 23:43:15
(5 months ago)
Bad Web Bot
Exploited Host
Web App Attack
