🇩🇪
F242
2026-01-30 05:42:04
(5 months ago)
Wordpress Login or XMLRPC abuse
Web App Attack
🇺🇸
myagent.site
2026-01-15 08:39:42
(6 months ago)
Blocking for trying to access an exploit file: /.env
Hacking
🇩🇪
Packets-Decreaser.NET
2025-12-29 14:01:43
(6 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇫🇷
mrcrassi
2025-12-24 05:05:47
(6 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST meth ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2025-12-09 21:22:30
(7 months ago)
botnet
DDoS Attack
🇺🇸
TPI-Abuse
2025-12-02 19:44:40
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.169.137 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.169.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 14:44:35.563391 2025] [security2:error] [pid 15248:tid 15248] [client 209.50.169.137:20351] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "campnecon.com"] [uri "/.git/HEAD"] [unique_id "aS9Bo_nNVhbcqxUZ8MBeAgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-02 12:14:31
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.169.137 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.169.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 07:14:27.942682 2025] [security2:error] [pid 27695:tid 27695] [client 209.50.169.137:59865] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "independentmusicconference.com"] [uri "/.git/HEAD"] [unique_id "aS7YI0bA8V6UXX8DXDoe2gAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Phenix Info
2025-12-02 05:02:20
(7 months ago)
SmallGuard.fr/Prestashop Forbidden Ext.
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 05:57:38
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.169.137 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.169.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:57:34.979682 2025] [security2:error] [pid 15586:tid 15586] [client 209.50.169.137:9457] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.jonnyonthespot.biz"] [uri "/.git/HEAD"] [unique_id "aSVFTh64EwCxkzaGeXnpAAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 03:25:26
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.169.137 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.169.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:25:22.723953 2025] [security2:error] [pid 16359:tid 16359] [client 209.50.169.137:40493] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.harveyyachtsales.com"] [uri "/.env"] [unique_id "aSUhojY8phny6rFUXoagoQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 01:54:40
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.169.137 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.169.137 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 20:54:37.357158 2025] [security2:error] [pid 11536:tid 11536] [client 209.50.169.137:24973] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.bookingsouthafrica.com"] [uri "/.git/HEAD"] [unique_id "aSUMXbvwVQulNZcYKxGW6wAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-14 12:18:59
(8 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇫🇮
Shaik Sai Meera
2025-11-12 09:40:14
(8 months ago)
IM360 WAF: Infectors: Suspicious access attempt (webshell)
FTP Brute-Force
Open Proxy
Brute-Force
2025-11-02 15:09:33
(8 months ago)
This IP was involved in an brute force and password spray attack on 2025/11/02 07:28:21
Port Scan
Brute-Force
Exploited Host
Web App Attack
2025-10-16 17:42:09
(9 months ago)
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.10.16 is noted in report tim ...
show more
Attempted brute force login to web vpn 1 time(s); last attempt for 2025.10.16 is noted in report timestamp
show less
Hacking
Brute-Force