🇮🇩
zam
2026-11-11 21:12:39
UTC ·
(1 day ago)
212.119.47.30 - - [11/Nov/2026:21:12:37 +0000] 0 ms "POST /xmlrpc.php HTTP/1.1" 403 239
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 19:17:37
UTC ·
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 212.119.47.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:17:31.042225 2026] [security2:error] [pid 26657:tid 26666] [client 212.119.47.30:63497] M ...
show more
(mod_security) mod_security (id:210350) triggered by 212.119.47.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:17:31.042225 2026] [security2:error] [pid 26657:tid 26666] [client 212.119.47.30:63497] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.fishrapper.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fishrapper.com"] [uri "/ice-fishing-report-minnesota-february-2021.html"] [unique_id "avDKy8phWvVUVhZX2wr8wQAAAEY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 20:53:07
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 212.119.47.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:53:03.453502 2026] [security2:error] [pid 5791:tid 5791] [client 212.119.47.30:62545] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 212.119.47.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:53:03.453502 2026] [security2:error] [pid 5791:tid 5791] [client 212.119.47.30:62545] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.corinthianscruise.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.corinthianscruise.org"] [uri "/Content/Day3.html"] [unique_id "atkmL4RiWKgrcxYWb7oStwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
mrcrassi
2026-06-24 18:32:44
UTC ·
(4 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
T ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇷
Tilellit.PRO
2026-05-06 21:24:35
UTC ·
(6 months ago)
Fail2Ban banned 212.119.47.30 for security violations in jail wp-armour. Log: 2026/05/06 21:24:34 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 212.119.47.30 | Target: wplogin" , client: 212.119.47.30, server: [REDACTED], request: ...
show more
Fail2Ban banned 212.119.47.30 for security violations in jail wp-armour. Log: 2026/05/06 21:24:34 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 212.119.47.30 | Target: wplogin" , client: 212.119.47.30, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php"
...
show less
Web Spam
🇺🇸
TPI-Abuse
2026-04-11 05:58:52
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 212.119.47.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 01:58:45.441282 2026] [security2:error] [pid 3740413:tid 3740439] [client 212.119.47.30:5612 ...
show more
(mod_security) mod_security (id:225170) triggered by 212.119.47.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 11 01:58:45.441282 2026] [security2:error] [pid 3740413:tid 3740439] [client 212.119.47.30:56127] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||andeanbouquet.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "andeanbouquet.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adnjFewrD4A1kkwfNfZEnQAAAJg"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-10 22:34:11
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 212.119.47.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 10 18:34:08.579164 2026] [security2:error] [pid 732060:tid 732060] [client 212.119.47.30:37551] ...
show more
(mod_security) mod_security (id:225170) triggered by 212.119.47.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 10 18:34:08.579164 2026] [security2:error] [pid 732060:tid 732060] [client 212.119.47.30:37551] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||walkerweb.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "walkerweb.net"] [uri "/wp-json/wp/v2/users"] [unique_id "adl64EzkFMo3yuK14slT4gAAAAc"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Packets-Decreaser.NET
2025-12-10 14:34:53
UTC ·
(11 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇵🇱
TI
2023-11-01 00:02:01
UTC ·
(3 years ago)
Scrapping website, using diffrent useragents, not wait for response, #botnet20231026
DDoS Attack
Bad Web Bot
🇯🇵
HeliJP
2022-09-29 11:22:48
UTC ·
(4 years ago)
2022-09-29 11:28:03 - Recognized attacks\bad behavior from IP address 212.119.47.30 on port 443\80 (37 daily hits): Remote Command Execution: Windows Command Injection, Remote Command Execution: Wildcard bypass technique attempt, PHP Injection Attack ...
show more
2022-09-29 11:28:03 - Recognized attacks\bad behavior from IP address 212.119.47.30 on port 443\80 (37 daily hits): Remote Command Execution: Windows Command Injection, Remote Command Execution: Wildcard bypass technique attempt, PHP Injection Attack: High-Risk PHP Function Call Found, SQL Injection Attack Detected via libinjection, SQL Injection Attack: SQL Operator Detected, SQL Injection Attack: SQL Tautology Detected, SQL Injection Attack, Detects MySQL comments, conditions and ch(a)r injections, Detects chained SQL injection attempts 2/2, Detects basic SQL injection based on keyword alter or union, Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12), SQL Comment Sequence Detected
show less
Hacking
SQL Injection
Web App Attack
2022-08-06 16:20:18
UTC ·
(4 years ago)
Web App Attack
🇳🇱
Roderic
2022-08-01 17:03:57
UTC ·
(4 years ago)
(apache-bow-document) Failed apache-bow-scanners trigger with match [redacted] from 212.119.47.30 (IL/Israel/-)
Hacking
