🇺🇸
RLDD
2025-10-07 13:52:51
(8 months ago)
WP probing -nov
Web App Attack
🇺🇸
TPI-Abuse
2025-09-30 07:51:10
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 156.228.106.252 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.228.106.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 03:51:02.494055 2025] [security2:error] [pid 12236:tid 12249] [client 156.228.106.252:16883] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gtci.us|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gtci.us"] [uri "/wp-json/wp/v2/users"] [unique_id "aNuL5vkzWmIBxJxkq2BdYQAAAUk"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-30 06:24:37
(8 months ago)
(mod_security) mod_security (id:225170) triggered by 156.228.106.252 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.228.106.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 02:24:31.636273 2025] [security2:error] [pid 2488:tid 2488] [client 156.228.106.252:54643] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||koeckeritz.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "koeckeritz.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aNt3n16cabSXnfAqeLynvwAAABE"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-07 02:21:11
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 156.228.106.252 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 156.228.106.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 06 22:21:08.847395 2025] [security2:error] [pid 27336:tid 27336] [client 156.228.106.252:20279] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.general.graphics|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.general.graphics"] [uri "/s3cmd.ini"] [unique_id "aLzsFKNhyS1OvPK9DeYMOgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-06 11:38:45
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 156.228.106.252 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 156.228.106.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 06 07:38:42.046468 2025] [security2:error] [pid 31303:tid 31303] [client 156.228.106.252:60869] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.hakkawok.com"] [uri "/config.php%7C/.env%7Csettings.py"] [unique_id "aLwdQj1GfQc-0IBPEOoNYwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-06 11:15:56
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 156.228.106.252 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 156.228.106.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 06 07:15:48.285397 2025] [security2:error] [pid 1824118:tid 1824161] [client 156.228.106.252:22077] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.dreammile.info.ahsdistance.org|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.dreammile.info.ahsdistance.org"] [uri "/s3cmd.ini"] [unique_id "aLwX5BTfJz-xGH6LdmyQEAAAAMY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
10dencehispahard SL
2025-08-11 06:22:58
(10 months ago)
WP probing for vulnerabilities
Hacking
Exploited Host
🇺🇸
TPI-Abuse
2025-07-24 18:51:32
(11 months ago)
(mod_security) mod_security (id:225170) triggered by 156.228.106.252 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.228.106.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 24 14:51:24.681894 2025] [security2:error] [pid 15621:tid 15632] [client 156.228.106.252:23435] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||gfx-technology.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "gfx-technology.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aIKArJjFhirXJ6Zdz6bdGgAAAQg"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-07-08 13:45:23
(11 months ago)
(mod_security) mod_security (id:225170) triggered by 156.228.106.252 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.228.106.252 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 08 09:45:15.889319 2025] [security2:error] [pid 31763:tid 31763] [client 156.228.106.252:47997] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||rogerg.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "rogerg.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aG0g67Y9Z2wGf0Q6Va-XlwAAAAo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
MAGIC
2025-07-07 01:11:07
(11 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇪🇸
10dencehispahard SL
2025-06-25 08:01:03
(1 year ago)
WP probing for vulnerabilities
Hacking
Exploited Host
🇵🇱
sefinek.net
2025-06-09 01:39:39
(1 year ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Vivaldi/5.3.2679.68
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇹🇭
Sawasdee
2025-05-07 09:10:35
(1 year ago)
Port Scan
...
Port Scan
2025-04-15 12:48:23
(1 year ago)
Attempted brute force login to web vpn 7 time(s); last attempt for 2025.04.15 is noted in report tim ...
show more
Attempted brute force login to web vpn 7 time(s); last attempt for 2025.04.15 is noted in report timestamp
show less
Hacking
Brute-Force
2025-04-13 11:24:16
(1 year ago)
Attempted brute force login to web vpn 4 time(s); last attempt for 2025.04.13 is noted in report tim ...
show more
Attempted brute force login to web vpn 4 time(s); last attempt for 2025.04.13 is noted in report timestamp
show less
Hacking
Brute-Force