🇩🇪
LRob.fr
2026-04-05 14:15:12
(2 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
2026-03-31 20:48:20
(2 months ago)
Forum/form spam
Web Spam
🇩🇪
F242
2026-01-30 05:10:53
(4 months ago)
Wordpress Login or XMLRPC abuse
Web App Attack
2025-12-07 07:03:18
(6 months ago)
botnet
DDoS Attack
🇩🇪
Packets-Decreaser.NET
2025-11-30 13:10:04
(6 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
TPI-Abuse
2025-11-25 04:15:58
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.164.236 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.164.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:15:52.061603 2025] [security2:error] [pid 9548:tid 9548] [client 209.50.164.236:10963] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "earthwormensemble.doublenaughtspycar.com"] [uri "/.env"] [unique_id "aSUteOhWrTPdWaZe4wpGnAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 03:51:38
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.164.236 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.164.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:51:27.430126 2025] [security2:error] [pid 7226:tid 7226] [client 209.50.164.236:37841] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.pendergrassfamily.com"] [uri "/.svn/wc.db"] [unique_id "aSUnv-ZuZbPvOc7V_DBVLAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 02:25:34
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.164.236 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.164.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:25:28.484703 2025] [security2:error] [pid 1647139:tid 1647157] [client 209.50.164.236:11115] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.sallykimmel.com"] [uri "/.svn/wc.db"] [unique_id "aSUTmJ5eMzOQPKYL6rL_OAAAAEY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 01:21:30
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.164.236 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.164.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 20:21:24.998736 2025] [security2:error] [pid 610252:tid 610252] [client 209.50.164.236:31497] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.arroceraomoa.com"] [uri "/.env"] [unique_id "aSUElOvO3AQ9jDvAG2qs8QAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Admins@FBN
2025-11-25 00:28:52
(6 months ago)
FW-PortScan: Traffic Blocked srcport=17167 dstport=80
Port Scan
🇺🇸
TPI-Abuse
2025-11-25 00:15:05
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.164.236 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.164.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 19:14:59.976648 2025] [security2:error] [pid 3071:tid 3071] [client 209.50.164.236:42441] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.savingspools.savingshvac.com"] [uri "/.git/HEAD"] [unique_id "aST1A2vQPnv_cwHhSsOWRAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
sefinek.net
2025-11-21 09:51:53
(6 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 12_5) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Edg/114.0.1264.71
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2025-11-14 04:32:31
(6 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇨🇦
wil.com
2025-10-29 07:12:53
(7 months ago)
GlobalProtect login attempts with user ddagentuser.
VPN IP
Brute-Force
2025-10-18 10:24:37
(7 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.10.18 is noted in report tim ...
show more
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.10.18 is noted in report timestamp
show less
Hacking
Brute-Force