🇸🇪
OnTheEdge
2026-09-14 13:02:13
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇸🇪
OnTheEdge
2026-09-14 13:02:13
(1 month ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇨🇿
Countryman
2026-09-12 00:10:01
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇩🇪
stinpriza
2026-09-03 13:08:59
(1 month ago)
Web App Attack
Web App Attack
🇫🇷
mrcrassi
2026-08-25 12:45:02
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/2 (POST method ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-07-14 07:56:14
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.216.80 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.216.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 03:56:06.418374 2026] [security2:error] [pid 20203:tid 20203] [client 185.61.216.80:50569] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||wiknwax.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "wiknwax.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alXrlqClNVpPiur_AXh-JAAAAAA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
ptlab
2026-06-25 12:47:01
(3 months ago)
Detected wp_login attack from WP-host.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-15 23:11:18
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.216.80 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.216.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 15 19:11:11.680280 2026] [security2:error] [pid 6515:tid 6515] [client 185.61.216.80:30513] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||imagea.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "imagea.net"] [uri "/wp-json/wp/v2/users"] [unique_id "ajCGj7SCXSp1DzqCA3YKewAAAAA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-06-11 01:20:50
(4 months ago)
Web password guessing
Brute-Force
🇺🇸
TPI-Abuse
2026-06-01 18:19:27
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.216.80 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.216.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 14:19:22.971826 2026] [security2:error] [pid 24132:tid 24132] [client 185.61.216.80:10217] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||pinballhistory.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "pinballhistory.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ah3NKhCfxwata22XjblSdAAAACg"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 14:19:04
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.216.80 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.216.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 10:18:56.416595 2026] [security2:error] [pid 16308:tid 16308] [client 185.61.216.80:64057] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fitzmail.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fitzmail.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahRaUMXWc0EeR5P2LYxETQAAAAk"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-05-22 14:59:24
(4 months ago)
Web password guessing
Brute-Force
🇺🇸
TPI-Abuse
2026-05-22 12:27:37
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.216.80 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.216.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 22 08:27:31.890872 2026] [security2:error] [pid 9908:tid 9908] [client 185.61.216.80:38037] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||wiknwax.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "wiknwax.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ahBLs2M3xKIjjJmsEWO6SwAAABA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nationaleventpros.com
2026-05-20 04:11:33
(4 months ago)
WordPress login attempt
Brute-Force
🇺🇸
TPI-Abuse
2026-05-18 12:20:22
(4 months ago)
(mod_security) mod_security (id:225170) triggered by 185.61.216.80 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 185.61.216.80 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 08:20:18.549841 2026] [security2:error] [pid 10487:tid 10487] [client 185.61.216.80:44527] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||arriagarealestate.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "arriagarealestate.com"] [uri "/wp-json/wp/v2/users"] [unique_id "agsEAgtBga93Nr9Sl8Ip1wAAAA4"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
