🇺🇸
TPI-Abuse
2025-09-30 00:20:08
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 154.94.15.16 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 154.94.15.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 29 20:20:04.960248 2025] [security2:error] [pid 23003:tid 23003] [client 154.94.15.16:57335] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||kiubo.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "kiubo.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aNsiNDUkirwm8fzIO7tI2gAAAA8"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-09-24 15:07:26
(8 months ago)
wordpress-trap
Web App Attack
🇨🇭
backslash
2025-09-24 14:40:19
(8 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇵🇱
sefinek.net
2025-09-23 03:03:16
(9 months ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /genshin-stella-mod
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 YaBrowser/22.7.0 Yowser/2.5 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2025-09-21 01:42:10
(9 months ago)
wordpress-trap
Web App Attack
🇺🇸
aks4226
2025-09-04 18:02:23
(9 months ago)
Attacking common web applications. (n01)
Web App Attack
🇺🇸
TPI-Abuse
2025-09-02 11:04:38
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 154.94.15.16 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 154.94.15.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 02 07:04:32.873188 2025] [security2:error] [pid 25355:tid 25355] [client 154.94.15.16:21139] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||salsberggroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "salsberggroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aLbPQFYM3tLKMw6j5c7tFgAAAAo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-08-31 10:54:20
(9 months ago)
[redacted] 154.94.15.16 - - [31/Aug/2025:12:53:44 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Ap ...
show more
[redacted] 154.94.15.16 - - [31/Aug/2025:12:53:44 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.28)"
[redacted] 154.94.15.16 - - [31/Aug/2025:12:53:46 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.28)"
[redacted] 154.94.15.16 - - [31/Aug/2025:12:53:49 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.28)"
[redacted] 154.94.15.16 - - [31/Aug/2025:12:54:12 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.28)"
[redacted] 154.94.15.16 - - [31/Aug/2025:12:54:19 +0200] "POST /xmlrpc.php HTTP/1.1" 405 428 "-" "Apache-HttpClient/4.5.13 (Java/11.0.28)"
...
show less
Hacking
Web App Attack
🇩🇪
bitpanda
2025-08-31 00:00:59
(9 months ago)
Malicious activity detected by Imunify360
Brute-Force
SSH
🇩🇪
bitpanda
2025-08-30 00:00:53
(9 months ago)
Malicious activity detected by Imunify360
Brute-Force
SSH
🇩🇪
bitpanda
2025-08-28 01:00:41
(9 months ago)
Malicious activity detected by Imunify360
Brute-Force
SSH
🇩🇪
bitpanda
2025-08-27 00:00:57
(9 months ago)
Malicious activity detected by Imunify360
Brute-Force
SSH
🇩🇪
bitpanda
2025-08-26 00:00:48
(9 months ago)
Malicious activity detected by Imunify360
Brute-Force
SSH
🇩🇪
bitpanda
2025-08-25 00:00:39
(9 months ago)
Malicious activity detected by Imunify360
Brute-Force
SSH
🇺🇸
TPI-Abuse
2025-08-16 16:17:41
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 154.94.15.16 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 154.94.15.16 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 16 12:17:34.946699 2025] [security2:error] [pid 24169:tid 24169] [client 154.94.15.16:28683] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.saadeh.ws|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.saadeh.ws"] [uri "/wp-json/wp/v2/users"] [unique_id "aKCvHvgdR-SKbNqIKcWNmAAAAAs"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack