|
Anonymous
|
|
[Firewall Canary] Temporary ban due to firewall rule match [URI:*/wp-login.php]
|
Bad Web Bot
Web App Attack
|
|
Anonymous
|
|
Bot / scanning and/or hacking attempts: POST /wp-login.php HTTP/1.1
|
Hacking
Web App Attack
|
|
🇧🇪
cmbplf
|
|
1.809 requests with url.path //xmlrpc.php
|
Brute-Force
Bad Web Bot
|
|
🇫🇷
conseilgouz
|
|
joe-Joomla Admin : try to force the door...
|
Hacking
|
|
🇫🇷
Tilellit.PRO
|
|
Fail2Ban banned 155.2.217.14 for security violations in jail wp-armour. Log: 2026/05/13 00:18:31 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 155.2.217.14 | Target: wplogin" , client: 155.2.217.14, server: [REDACTED], request: "P ...
show more
Fail2Ban banned 155.2.217.14 for security violations in jail wp-armour. Log: 2026/05/13 00:18:31 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 155.2.217.14 | Target: wplogin" , client: 155.2.217.14, server: [REDACTED], request: "POST /wp-login.php/wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED]
...
show less
|
Web Spam
|
|
🇫🇷
mrcrassi
|
|
Triggered Cloudflare WAF (firewallCustom) from HU.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/129.0.0.0 Safari/537.36
This report was generated ...
show more
Triggered Cloudflare WAF (firewallCustom) from HU.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/129.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
|
Bad Web Bot
|
|
Anonymous
|
|
Malicious activity detected
|
Hacking
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 155.2.217.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 15 10:45:29.735955 2026] [security2:error] [pid 11839:tid 11839] [client 155.2.217.14:0] ModSecu ...
show more
(mod_security) mod_security (id:210730) triggered by 155.2.217.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 15 10:45:29.735955 2026] [security2:error] [pid 11839:tid 11839] [client 155.2.217.14:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ccamp.dev|F|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ccamp.dev"] [uri "/bak/wallet.dat"] [unique_id "abbGCcsiWktUtHIxUzoSQwAAABA"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 155.2.217.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 09 12:33:24.871614 2026] [security2:error] [pid 21763:tid 21763] [client 155.2.217.14:46739] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 155.2.217.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 09 12:33:24.871614 2026] [security2:error] [pid 21763:tid 21763] [client 155.2.217.14:46739] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||matteozacchino.dev|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "matteozacchino.dev"] [uri "/www.sql"] [unique_id "aa72VL3wIp2pvlo3Z84poQAAAAE"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
Penny Packer
|
|
Fail2Ban apache-tripwires
|
Web App Attack
|
|
Anonymous
|
|
Blocked: Reason='Suspicious traffic score=60 (review-based detection)'; Requests=15
|
Hacking
|
|
🇺🇸
myagent.site
|
|
Blocking for trying to access an exploit file: //xmlrpc.php?rsd
|
Hacking
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 155.2.217.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 03 13:55:03.590255 2026] [security2:error] [pid 13754:tid 13754] [client 155.2.217.14:26069] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 155.2.217.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 03 13:55:03.590255 2026] [security2:error] [pid 13754:tid 13754] [client 155.2.217.14:26069] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.enriquelaw.com"] [uri "/old/sftp-config.json"] [unique_id "aacuhxM4vPKeCHlDF0sybgAAAB4"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇵🇾
armandosaucedo.me
|
|
155.2.217.14 - - [03/Mar/2026:00:23:51 +0000] "GET /old/archive.zip HTTP/1.1" 404 196 "-" "-"
|
Web App Attack
|
|
🇯🇵
Valhalla
|
|
/back/backup.sql
|
Hacking
Web App Attack
|
