🇩🇪
expandmade.com
2025-10-27 15:58:00
(11 months ago)
trolling for installation vulnerabilities [27/Oct/2025:15:58:00 "GET /es/about-us/www.---/es/"]
Web App Attack
2025-10-24 03:17:42
(11 months ago)
Excessive crawling/scraping
Hacking
Brute-Force
🇬🇧
Globe2
2025-10-19 20:58:13
(11 months ago)
Multiple ModSec Blocks
Web App Attack
🇺🇸
TPI-Abuse
2025-10-18 22:31:57
(11 months ago)
(mod_security) mod_security (id:225170) triggered by 20.171.207.137 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 20.171.207.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 18 18:31:50.814768 2025] [security2:error] [pid 3938:tid 3938] [client 20.171.207.137:42392] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.birdlovesfish.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.birdlovesfish.com"] [uri "/wp-json/wp/v2/users/2"] [unique_id "aPQVVhwFQZpwg5_ve929kgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Globe2
2025-10-17 01:19:07
(11 months ago)
Multiple ModSec Blocks
Web App Attack
🇺🇸
TPI-Abuse
2025-10-16 12:12:11
(11 months ago)
(mod_security) mod_security (id:225170) triggered by 20.171.207.137 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 20.171.207.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 16 08:12:08.092015 2025] [security2:error] [pid 26246:tid 26246] [client 20.171.207.137:58218] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.twinls.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.twinls.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aPDhGK91E-O7MiGhdBph5gAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-15 18:31:31
(11 months ago)
(mod_security) mod_security (id:225170) triggered by 20.171.207.137 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 20.171.207.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 15 14:31:28.955373 2025] [security2:error] [pid 20191:tid 20191] [client 20.171.207.137:40374] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.mosheimlib.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.mosheimlib.org"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aO_ogJMCZza1V--xICz9HgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-10-11 03:34:28
(1 year ago)
Excessive crawling/scraping
Hacking
Brute-Force
🇺🇸
TPI-Abuse
2025-10-09 14:02:03
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 20.171.207.137 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 20.171.207.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 09 10:01:55.600478 2025] [security2:error] [pid 19895:tid 19895] [client 20.171.207.137:50982] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.nancyscafeandcatering.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.nancyscafeandcatering.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aOfAUwQrl4ljvsS4d-c9RAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
pinguin
2025-10-07 17:45:33
(1 year ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/2 (GET method) ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; GPTBot/1.2; +https://openai.com/gptbot)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2025-10-07 05:29:53
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 20.171.207.137 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 20.171.207.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 07 01:29:46.706604 2025] [security2:error] [pid 12649:tid 12649] [client 20.171.207.137:40066] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.naturalacu.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.naturalacu.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aOSlSgHRh05p5fZZeEDyRAAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-07 03:36:51
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 20.171.207.137 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 20.171.207.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 06 23:36:47.328966 2025] [security2:error] [pid 1475:tid 1475] [client 20.171.207.137:46478] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||chrisbilder.com|F|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "chrisbilder.com"] [uri "/boot/data_sets/mammals.dat"] [unique_id "aOSKzysfLRH3y6vhCvg4nAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Globe2
2025-10-07 03:00:21
(1 year ago)
[07/Oct/2025:04:00:01 +0100] hzsjkARrs6lZKduINUztnouI 20.171.207.137 38930 91.212.212.13 443
[07/Oct ...
show more
[07/Oct/2025:04:00:01 +0100] hzsjkARrs6lZKduINUztnouI 20.171.207.137 38930 91.212.212.13 443
[07/Oct/2025:04:00:17 +0100] HEfsVxGPYQ4xP56Jv8mPtCMC 20.171.207.137 38930 91.212.212.13 443
[07/Oct/2025:04:00:18 +0100] 9rlsFp896cmEP0MOPisTOQGX 20.171.207.137 38930 91.212.212.13 443
...
show less
Web App Attack
🇩🇪
neckaralb-admin.de
2025-10-05 17:45:40
(1 year ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2025-10-04 12:48:16
(1 year ago)
(mod_security) mod_security (id:225170) triggered by 20.171.207.137 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:225170) triggered by 20.171.207.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 04 08:48:12.076504 2025] [security2:error] [pid 20816:tid 20816] [client 20.171.207.137:33504] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||wildlandconservancy.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "wildlandconservancy.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aOEXjM84wfYdZO9a8venfQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack