🇺🇸
TPI-Abuse
2025-08-30 20:16:52
(9 months ago)
(mod_security) mod_security (id:210730) triggered by 156.228.174.165 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210730) triggered by 156.228.174.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 30 16:16:48.118231 2025] [security2:error] [pid 15117:tid 15117] [client 156.228.174.165:35189] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.dlfrost.dewsales.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.dlfrost.dewsales.com"] [uri "/s3cmd.ini"] [unique_id "aLNcMAIyXh5pfWwG1ZVT_QAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-08-28 16:31:39
(9 months ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇵🇱
sefinek.net
2025-06-28 16:17:47
(11 months ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 YaBrowser/22.7.0 Yowser/2.5 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
nowyouknow
2025-03-05 03:05:29
(1 year ago)
(From [email protected] ) Hello,
I’m reaching out to inform you that our investor is ...
show more
(From [email protected] ) Hello,
I’m reaching out to inform you that our investor is looking to invest in any private businesses with strong ideas, offering a 4.5% annual interest rate for 1 to 20 years, with no costs involved.
If this interests you, I’d be happy to discuss further.
Best regards,
Kyle Houts
Vice President
show less
Phishing
Web Spam
🇺🇸
Anonymous
2025-02-28 16:00:00
(1 year ago)
Brute force attack detected from 156.228.174.165
DDoS Attack
Brute-Force
Web App Attack
🇺🇸
Anonymous
2025-02-28 16:00:00
(1 year ago)
Brute force attack detected from 156.228.174.165
DDoS Attack
Brute-Force
Web App Attack
🇺🇸
Anonymous
2025-02-28 16:00:00
(1 year ago)
Brute force attack detected from 156.228.174.165
DDoS Attack
Brute-Force
Web App Attack
🇺🇸
Anonymous
2025-02-28 16:00:00
(1 year ago)
Brute force attack detected from 156.228.174.165
DDoS Attack
Brute-Force
Web App Attack
🇺🇸
Anonymous
2025-02-28 16:00:00
(1 year ago)
Brute force attack detected from 156.228.174.165
DDoS Attack
Brute-Force
Web App Attack
2024-11-26 04:38:26
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2024-11-25 23:45:09
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 156.228.174.165 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.228.174.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 25 18:45:02.720115 2024] [security2:error] [pid 368080:tid 368080] [client 156.228.174.165:15281] [client 156.228.174.165] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||astrology7.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "astrology7.com"] [uri "/wp-json/wp/v2/users"] [unique_id "Z0UL_vsDCvgo0zjk-LwIywAAAAM"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-11-22 15:56:04
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2024-11-21 17:44:12
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 156.228.174.165 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:225170) triggered by 156.228.174.165 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 21 12:44:04.720401 2024] [security2:error] [pid 1433865:tid 1433865] [client 156.228.174.165:22239] [client 156.228.174.165] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||andrsn.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "andrsn.com"] [uri "/wp-json/wp/v2/users"] [unique_id "Zz9xZMABHL2zde3uCcHKYAAAAAg"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-11-18 20:10:53
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2024-11-17 08:58:16
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH