🇧🇪
madeit
2026-09-24 05:45:49
(3 days ago)
Web App Attack
2026-09-17 18:50:05
(1 week ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇧🇪
madeit
2026-09-14 13:34:22
(1 week ago)
Web App Attack
🇧🇪
madeit
2026-08-13 21:27:08
(1 month ago)
Web App Attack
🇺🇸
mawan
2026-08-03 13:23:42
(1 month ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
🇺🇸
TPI-Abuse
2026-07-31 08:02:22
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 172.70.50.88 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.50.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 31 04:02:16.059953 2026] [security2:error] [pid 2967392:tid 2967392] [client 172.70.50.88:13457] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.von-s.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.von-s.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "amxWiOTHXIIbICHF-6vXJAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-16 19:20:50
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 172.70.50.88 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.50.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 15:20:44.623159 2026] [security2:error] [pid 31979:tid 31979] [client 172.70.50.88:10395] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.desertvacationvillas.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.desertvacationvillas.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "alkvDG2nsjz05-y5ayC0KwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-26 00:30:34
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 172.70.50.88 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.50.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 25 20:30:28.953425 2026] [security2:error] [pid 23515:tid 23515] [client 172.70.50.88:13165] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.steveleeds.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.steveleeds.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "aj3IJKmLOKWdBBGffOr8rQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-06-22 22:00:23
(3 months ago)
Auto-ban: >3000 req/min op 2026-06-22
Web App Attack
SSH
Hacking
🇺🇸
mnsf
2026-06-09 12:05:38
(3 months ago)
Abuse Detected (2)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 10:21:21
(3 months ago)
(mod_security) mod_security (id:210730) triggered by 172.70.50.88 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 172.70.50.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 06:21:17.436904 2026] [security2:error] [pid 11539:tid 11539] [client 172.70.50.88:10146] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||autodiscover.desertvacationvillas.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "autodiscover.desertvacationvillas.com"] [uri "/autodiscover/autodiscover.json/v1.0/[email protected] "] [unique_id "ah1dHf-OGovot30yp7XQ6wAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇾
lns.bz
2026-05-14 05:13:43
(4 months ago)
Too many 404 requests [BY]
Web App Attack
🇺🇸
TPI-Abuse
2026-05-12 03:09:19
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.50.88 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.50.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 23:09:14.776721 2026] [security2:error] [pid 31861:tid 31873] [client 172.70.50.88:11939] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chaoticperception.com"] [uri "/sftp-config.json"] [unique_id "agKZ2nJXPHgQAHL4wHN8DAAAAEo"], referer: https://www.google.com/search?q=chaoticperception.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
pinguin
2026-05-08 04:56:07
(4 months ago)
Triggered Cloudflare WAF (firewallManaged) from CA.
Action taken: LOG
Protocol: HTTP/2 (GET method)
...
show more
Triggered Cloudflare WAF (firewallManaged) from CA.
Action taken: LOG
Protocol: HTTP/2 (GET method)
Endpoint: /
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-04-06 23:27:40
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.50.88 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.50.88 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 19:26:52.146649 2026] [security2:error] [pid 543166:tid 543166] [client 172.70.50.88:13486] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jennyfiore.com"] [uri "/.env.development"] [unique_id "adRBPHuNSmcBo3BBAgchsAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
