🇩🇪
mygcode.de
2026-09-01 11:51:21
(1 day ago)
Scanning for Exploits
Bad Web Bot
🇪🇸
masterguru
2026-09-01 09:50:30
(1 day ago)
BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:user-agent. (110 ...
show more
BAD BOT - Detected and Blocked.. Matched phrase "go-http-client" at REQUEST_HEADERS:user-agent. (1100000-122)
show less
Bad Web Bot
🇨🇭
backslash
2026-09-01 09:48:00
(1 day ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇮🇹
VHosting
2026-09-01 07:35:03
(1 day ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
mnsf
2026-09-01 07:05:47
(1 day ago)
Too many Status 40X (11)
Brute-Force
Web App Attack
2026-09-01 06:01:02
(1 day ago)
...
Web App Attack
🇫🇷
matthieul.dev
2026-07-13 18:10:21
(1 month ago)
Blocked by os-abuseipdb; 17 hits, proto=tcp,udp, ports=3642
Port Scan
Brute-Force
🇮🇱
Dolphi
2026-07-05 23:50:04
(1 month ago)
POST //xmlrpc.php
Brute-Force
Web App Attack
🇯🇵
SentinalX by uzumaru
2026-06-05 07:55:47
(2 months ago)
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ...
show more
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: api.cyberghostvpn.com:443
show less
Open Proxy
Port Scan
🇯🇵
demonsword
2026-05-30 09:46:38
(3 months ago)
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ...
show more
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: api.deezer.com:443
show less
Open Proxy
Port Scan
🇯🇵
Valhalla
2026-03-12 02:17:23
(5 months ago)
/bak/public_html.tar.gz
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-03-11 08:17:55
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 178.175.129.10 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 178.175.129.10 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 11 04:17:46.157299 2026] [security2:error] [pid 12302:tid 12302] [client 178.175.129.10:42365] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "uppermotradingco.com"] [uri "/old/sftp-config.json"] [unique_id "abElKmPfAwaI8ZfQpxZzqQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
pinguin
2026-03-09 17:36:07
(5 months ago)
Triggered Cloudflare WAF (firewallManaged) from MD.
Action taken: LOG
Protocol: HTTP/2 (HEAD method) ...
show more
Triggered Cloudflare WAF (firewallManaged) from MD.
Action taken: LOG
Protocol: HTTP/2 (HEAD method)
Endpoint: /old/directory.rar
UA: Empty string
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-03-02 22:06:48
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 178.175.129.10 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 178.175.129.10 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 02 17:06:44.583140 2026] [security2:error] [pid 28505:tid 28505] [client 178.175.129.10:54597] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bitcointoolfair.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bitcointoolfair.com"] [uri "/backups/sql.sql"] [unique_id "aaYJ9HQ1eiAwN3IDJ7EYEQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-02 21:47:15
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 178.175.129.10 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 178.175.129.10 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 02 16:47:08.515459 2026] [security2:error] [pid 9132:tid 9132] [client 178.175.129.10:25677] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||dudleyanddudley.com|F|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dudleyanddudley.com"] [uri "/back/wallet.dat"] [unique_id "aaYFXFI0ETyLp8_EHkwHhgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack