|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 154.94.14.239 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 154.94.14.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 01 20:44:13.979376 2025] [security2:error] [pid 9114:tid 9114] [client 154.94.14.239:39961] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||saratogaequity.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "saratogaequity.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aN3K3cm9q-eLxDzvi7PC1gAAACg"], referer: https://www.google.com
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇩🇪
Vegascosmetics
|
|
Kingcopy(AI-IDS):IP is Probing for Wordpress vulnerabilities WTF:Banned
|
Hacking
Bad Web Bot
Web App Attack
|
|
|
🇬🇧
D3monite
|
|
Attempted Brute Force (cpaneld)
|
Brute-Force
|
|
|
🇩🇪
london2038.com
|
|
Connection atttempts against closed TCP ports
Sep 3 07:29:03 BLOCK SRC=154.94.14.239 LEN=60 TOS=0x0 ...
show more
Connection atttempts against closed TCP ports
Sep 3 07:29:03 BLOCK SRC=154.94.14.239 LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=31164 DF PROTO=TCP SPT=50881 DPT=22 WINDOW=64240 RES=0x00 SYN
Sep 3 07:29:04 BLOCK SRC=154.94.14.239 LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=31165 DF PROTO=TCP SPT=50881 DPT=22 WINDOW=64240 RES=0x00 SYN
Sep 3 07:29:05 BLOCK SRC=154.94.14.239 LEN=60 TOS=0x00 PREC=0x00 TTL=55 ID=31166 DF PROTO=TCP SPT=50881 DPT=22 WINDOW=64240 RES=0x00 SYN
show less
|
Port Scan
|
|
|
🇧🇪
voormedia
|
|
Accessed trap at '/xmlrpc.php'
|
Web App Attack
|
|
|
Anonymous
|
|
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
|
Brute-Force
SSH
|
|
|
Anonymous
|
|
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
|
Brute-Force
SSH
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 154.94.14.239 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 154.94.14.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 14 07:11:24.014180 2025] [security2:error] [pid 13787:tid 13787] [client 154.94.14.239:38015] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||toptek.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "toptek.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aJ3EXH6e57WMXZNfzVRP2gAAAAI"], referer: https://www.google.com
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
Anonymous
|
|
wordpress-trap
|
Web App Attack
|
|
|
🇫🇷
Netrix
|
|
L7 Flood botnet hosted by 3xK Tech
|
DDoS Attack
Web Spam
SSH
|
|
|
🇵🇱
sefinek.net
|
|
Triggered Cloudflare WAF (firewallCustom) from ES.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from ES.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /genshin-stella-mod
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Vivaldi/5.3.2679.68
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
|
Bad Web Bot
|
|
|
🇦🇺
MAGIC
|
|
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
|
DDoS Attack
Bad Web Bot
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 154.94.14.239 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 154.94.14.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Apr 10 15:13:57.044059 2025] [security2:error] [pid 13339:tid 13339] [client 154.94.14.239:9615] [client 154.94.14.239] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||cityindustries.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "cityindustries.com"] [uri "/wp-json/wp/v2/users"] [unique_id "Z_gYddkJ0eYc51s0BX27igAAAAs"], referer: https://www.google.com
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 154.94.14.239 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 154.94.14.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 04 19:16:58.829664 2025] [security2:error] [pid 4987:tid 4987] [client 154.94.14.239:12307] [client 154.94.14.239] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||jolankagroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "jolankagroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "Z_BoanhsJ5SP_CBOqajzvQAAAAY"], referer: https://www.google.com
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
Anonymous
|
|
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
|
Brute-Force
SSH
|
|