🇺🇸
threatintelligence_bvc
2026-05-22 22:13:01
(3 weeks ago)
Brute-Force
🇳🇱
Site.eu
2025-10-17 02:27:51
(8 months ago)
Excessive 404/403 errors
Brute-Force
🇵🇱
sefinek.net
2025-10-17 02:05:52
(8 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (HEAD meth ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (HEAD method)
Endpoint: /
UA: python-requests/2.32.4
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
LRob.fr
2025-10-17 01:49:50
(8 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2025-10-17 01:25:03
(8 months ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
2025-10-17 00:53:56
(8 months ago)
(wordpress) Failed wordpress login from 191.96.227.200 (US/United States/New York/New York/-/[redact ...
show more
(wordpress) Failed wordpress login from 191.96.227.200 (US/United States/New York/New York/-/[redacted])
show less
Brute-Force
🇺🇸
TPI-Abuse
2025-10-16 17:58:07
(8 months ago)
(mod_security) mod_security (id:240335) triggered by 191.96.227.200 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 191.96.227.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 16 13:57:56.398735 2025] [security2:error] [pid 11902:tid 11902] [client 191.96.227.200:64596] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 191.96.227.200 (+1 hits since last alert)|smilingorc.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "smilingorc.com"] [uri "/xmlrpc.php"] [unique_id "aPEyJEZVcd3PStrKyQeURQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2025-10-16 16:28:07
(8 months ago)
6.499 requests with url.path */xmlrpc.php
Brute-Force
Bad Web Bot
🇩🇪
konseptit
2025-10-16 14:50:46
(8 months ago)
(wordpress) Failed wordpress login from 191.96.227.200 (US/United States/-)
Brute-Force
🇺🇸
TPI-Abuse
2025-10-16 12:53:31
(8 months ago)
(mod_security) mod_security (id:240335) triggered by 191.96.227.200 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:240335) triggered by 191.96.227.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 16 08:53:17.051374 2025] [security2:error] [pid 25131:tid 25131] [client 191.96.227.200:51974] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 191.96.227.200 (+1 hits since last alert)|letmespeakpodcast.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "letmespeakpodcast.com"] [uri "/xmlrpc.php"] [unique_id "aPDqvWSZv4eZkrMdPog_0AAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-06-19 06:30:15
(1 year ago)
Unauthorized connection attempt detected in the last 24 hours
Hacking
2025-05-28 20:40:12
(1 year ago)
(wordpress) Failed wordpress login from 191.96.227.200 (US/United States/-)
Brute-Force
🇩🇪
stalker.to
2025-05-22 06:06:49
(1 year ago)
Datacenter Proxy
Web Spam
🇩🇪
Vegascosmetics
2025-04-30 21:50:48
(1 year ago)
Kingcopy(AI-IDS):IP is Probing for Wordpress vulnerabilities WTF:Banned
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-04-30 08:01:24
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 191.96.227.200 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 191.96.227.200 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 30 03:58:22.805827 2025] [security2:error] [pid 790:tid 790] [client 191.96.227.200:21874] [client 191.96.227.200] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||daylightingit.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "daylightingit.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "aBHYHmqqStbvOGyCrHGGlQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack