🇫🇮
as211431.net
2026-08-28 14:23:09
(2 days ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET metho ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /wp-includes/wlwmanifest.xml
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇳🇿
Antinson
2026-08-28 14:02:02
(2 days ago)
Scraping with a high error ratio and request rate
Bad Web Bot
🇺🇸
WizardsToolkit
2026-08-28 13:55:10
(2 days ago)
tried to access forbidden files; attempted to access /wp-includes/wlwmanifest.xml
Web App Attack
🇺🇸
Starburst SysOp Team
2026-08-28 13:12:23
(2 days ago)
Malware host detected by rbl.malware.expert. RBL lookup of 156.102.26.159.rbl.malware.expert succeed ...
show more
Malware host detected by rbl.malware.expert. RBL lookup of 156.102.26.159.rbl.malware.expert succeeded at REMOTE_ADDR. (400010-mnz6-1)
show less
Hacking
🇫🇷
N3ilawx
2026-08-28 13:08:03
(2 days ago)
Fail2Ban detect something wrong with this ip 159.26.102.156 - GET - 404 - [28/Aug/2026:15:07:57 +020 ...
show more
Fail2Ban detect something wrong with this ip 159.26.102.156 - GET - 404 - [28/Aug/2026:15:07:57 +0200]
159.26.102.156 - GET - 404 - [28/Aug/2026:15:07:57 +0200]
159.26.102.156 - GET - 404 - [28/Aug/2026:15:07:59 +0200]
159.26.102.156 - GET - 404 - [28/Aug/2026:15:07:59 +0200]
159.26.102.156 - GET - 404 - [28/Aug/2026:15:08:00 +0200]
159.26.102.156 - GET - 404 - [28/Aug/2026:15:08:00 +0200]
159.26.102.156 - GET - 404 - [28/Aug/2026:15:08:01 +0200]
159.26.102.156 - GET - 404 - [28/Aug/2026:15:08:01 +0200]
159.26.102.156 - GET - 404 - [28/Aug/2026:15:08:02 +0200]
159.26.102.156 - GET - 404 - [28/Aug/2026:15:08:02 +0200]
...
show less
Brute-Force
Web App Attack
🇸🇬
Cloudkul Cloudkul
2026-08-28 12:30:28
(2 days ago)
Attempted Brute Force on our application
Brute-Force
Web App Attack
🇳🇱
tr1n
2026-08-28 11:43:13
(2 days ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action: MANAGED_CHALLENGE | ASN: 208172 (Proton A ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action: MANAGED_CHALLENGE | ASN: 208172 (Proton AG) | Protocol: HTTP/1.1 (GET) | Endpoint: //sito/wp-includes/wlwmanifest.xml | Timestamp: 2026-08-28T11:43:13Z | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/78.0.3904.108 Safari/537.36
show less
Bad Web Bot
🇮🇹
mgarofano80
2026-08-28 11:19:07
(2 days ago)
Brute-Force
Web App Attack
🇩🇪
macrob
2026-08-28 10:38:30
(2 days ago)
2026/08/28 10:38:28 [error] 3466076#3466076: *529755060 access forbidden by rule, client: 159.26.102 ...
show more
2026/08/28 10:38:28 [error] 3466076#3466076: *529755060 access forbidden by rule, client: 159.26.102.156, server: ca5h.win, request: "GET //wp-includes/wlwmanifest.xml HTTP/1.1", host: "ca5h.win"
2026/08/28 10:38:28 [error] 3466076#3466076: *529755073 access forbidden by rule, client: 159.26.102.156, server: ca5h.win, request: "GET //xmlrpc.php?rsd HTTP/1.1", host: "ca5h.win"
2026/08/28 10:38:29 [error] 3466072#3466072: *529755098 access forbidden by rule, client: 159.26.102.156, server: ca5h.win, request: "GET //blog/wp-includes/wlwmanifest.xml HTTP/1.1", host: "ca5h.win"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 10:26:54
(2 days ago)
(mod_security) mod_security (id:225170) triggered by 159.26.102.156 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 159.26.102.156 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 06:26:47.724819 2026] [security2:error] [pid 19862:tid 19862] [client 159.26.102.156:0] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ipv6.rodrigoaldecoa.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ipv6.rodrigoaldecoa.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "apFiZ950hsEBIoUBG0aSQAAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ipblock.com
2026-08-28 07:07:00
(2 days ago)
IPBlock protected site ID [2711-bg].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
🇩🇪
Viveronese
2026-08-28 06:10:43
(2 days ago)
HTTP vulnerability scanning
Web App Attack
🇫🇷
dynamix
2026-08-28 02:55:51
(2 days ago)
WordPress XMLRPC Brute Force Attack
Brute-Force
Web App Attack
🇩🇪
conseilgouz
2026-08-28 02:09:43
(2 days ago)
mae-7 : Trying access unauthorized files/dir=>//wp-includes/wlwmanifest.xml
Hacking
🇺🇸
masterguru
2026-08-28 01:51:26
(2 days ago)
WordPress: User enumeration. Pattern match "(author\\\\= (88030-147)
Hacking
