🇪🇸
pipeline.es
2026-11-12 10:08:42
UTC ·
(1 day ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Wed Oct 28 12:15:15.386168 2026] [:error] [pid 4115372] [client 151.115.58.149:46892] [client 151.115.58.149] WAF: Access denied with code 403 (phase 2). Operator GT mat ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Wed Oct 28 12:15:15.386168 2026] [:error] [pid 4115372] [client 151.115.58.149:46892] [client 151.115.58.149] WAF: Access denied with code 403 (phase 2). Operator GT matched 0 at TX:php_injection_score. [file \"/etc/httpd/conf.d/zz-WAF-php2shell.conf\"] [line \"17\"] [id \"9261008\"] [msg \"php2shell: inyeccion PHP (CRS 933) en bloqueo\"] [tag \"php2shell\"] [hostname \"poloniatour.es\"] [uri \"/ | ASN: Scaleway S.a.s. | Country: PL
show less
Web App Attack
🇫🇷
mrcrassi
2026-11-12 04:30:58
UTC ·
(1 day ago)
Triggered Cloudflare WAF (firewallManaged) from PL.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /
UA: Python/3.10 aiohttp/3.14.5
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
Bad Web Bot
🇳🇱
tr1n
2026-11-12 04:08:11
UTC ·
(1 day ago)
Triggered Cloudflare WAF (firewallCustom) from PL.
Action: BLOCK | ASN: 12876 (Scaleway SAS) | Protocol: HTTP/1.1 (POST) | Endpoint: / | Timestamp: 2026-11-12T04:08:11Z | UA: Python/3.10 aiohttp/3.14.5
Bad Web Bot
🇬🇧
andypiper
2026-11-12 02:00:33
UTC ·
(1 day ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇺🇦
URAN Publishing Service
2026-11-12 01:15:46
UTC ·
(1 day ago)
[12/Nov/2026:03:15:46 +0200] -- 151.115.58.149 Ban reason: User-Agent Python/
Bad Web Bot
Web App Attack
🇳🇱
pixelXp
2026-11-11 21:57:09
UTC ·
(2 days ago)
Reason:15 (Hacking), Via: bomenrooien.com/, Message: Blocked UA: 'python/'. [POST] Gevaarlijk woord 'eval' in Value in '0' [+35] #IN_KEYWORD{word=eval,part=value,field=0}; Code injectie (PHP statement) in Value in ' ...
show more
Reason:15 (Hacking), Via: bomenrooien.com/, Message: Blocked UA: 'python/'. [POST] Gevaarlijk woord 'eval' in Value in '0' [+35] #IN_KEYWORD{word=eval,part=value,field=0}; Code injectie (PHP statement) in Value in '0' [+35] #IN_CODE_PHP{part=value,field=0}; Combinatiebonus [+10] #COMBO
show less
Hacking
🇬🇧
consul.to
2026-11-11 12:56:02
UTC ·
(2 days ago)
Web attack/malicious scanning detected
Web App Attack
🇪🇸
pipeline.es
2026-11-11 08:29:55
UTC ·
(2 days ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Wed Oct 28 12:15:15.386168 2026] [:error] [pid 4115372] [client 151.115.58.149:46892] [client 151.115.58.149] WAF: Access denied with code 403 (phase 2). Operator GT mat ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Wed Oct 28 12:15:15.386168 2026] [:error] [pid 4115372] [client 151.115.58.149:46892] [client 151.115.58.149] WAF: Access denied with code 403 (phase 2). Operator GT matched 0 at TX:php_injection_score. [file \"/etc/httpd/conf.d/zz-WAF-php2shell.conf\"] [line \"17\"] [id \"9261008\"] [msg \"php2shell: inyeccion PHP (CRS 933) en bloqueo\"] [tag \"php2shell\"] [hostname \"poloniatour.es\"] [uri \"/ | ASN: Scaleway S.a.s. | Country: PL
show less
Web App Attack
🇩🇪
FeG Deutschland
2026-11-10 20:00:47
UTC ·
(3 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇫🇷
Stara
2026-11-10 17:01:54
UTC ·
(3 days ago)
Excessive requests and user agent spoofing, forum attackers, cms spammers, bad bots and python probe scripts
Bad Web Bot
Web Spam
🇬🇧
consul.to
2026-11-10 09:52:28
UTC ·
(3 days ago)
Web attack/malicious scanning detected
Web App Attack
🇪🇸
IT Infraestructura
2026-11-10 08:31:00
UTC ·
(3 days ago)
Multiple Cross Site Scripting and Illegal Resource Access Requests blocked
Bad Web Bot
Web App Attack
🇫🇮
oh.mg
2026-11-10 05:52:49
UTC ·
(3 days ago)
[Tue Nov 10 06:52:49.265437 2026] [security2:error] [pid 4113447:tid 4113460] [client 151.115.58.149:0] [client 151.115.58.149] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/us ...
show more
[Tue Nov 10 06:52:49.265437 2026] [security2:error] [pid 4113447:tid 4113460] [client 151.115.58.149:0] [client 151.115.58.149] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 60)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "eu.mmn.ca"] [uri "/"] [unique_id "avKxMcKNHMGpK9uA0E8crAAAAAs"]
[Tue Nov 10 06:52:49.468011 2026] [security2:error] [pid 4113447:tid 4113455] [client 151.115.58.149:0] [client 151.115.58.149] ModSecurity: Access denied with code 400 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "93"] [id "200003"] [msg "Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM 0, IQ 0, IP 0, IH 0, FL 0"] [hostname "e
...
show less
Web App Attack
Bad Web Bot
🇩🇪
4server
2026-11-09 23:30:58
UTC ·
(4 days ago)
[TueNov1000:30:54.8846952026][security2:error][pid1973430:tid1973485][client151.115.58.149:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\|wget\|python\|nikto\|sqlmap\|acunetix\|fimap\|dirbuster\|cmsmap\)\"atREQUEST_HEADE ...
show more
[TueNov1000:30:54.8846952026][security2:error][pid1973430:tid1973485][client151.115.58.149:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\|wget\|python\|nikto\|sqlmap\|acunetix\|fimap\|dirbuster\|cmsmap\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"217\"][id\"990210\"][msg\"Suspicioususer-agentblocked\"][hostname\"traslochiamo.ch.136-243-54-122.cpanel.site\"][uri\"/\"][unique_id\"avJXrjK2y6prK7W2gX2uRgAAAEk\"]
show less
Port Scan
Brute-Force
Web App Attack
🇩🇪
Admins@FBN
2026-11-09 13:44:42
UTC ·
(4 days ago)
FW-PortScan: Traffic Blocked srcport=52204 dstport=443
Port Scan
