🇱🇻
garmtech.com
2026-06-10 07:51:49
(5 days ago)
IM360 WAF: Authentication Bypass in Really Simple Security 9.0.0-9.1.1.1 Plugin for WordPress (CVE-2 ...
show more
IM360 WAF: Authentication Bypass in Really Simple Security 9.0.0-9.1.1.1 Plugin for WordPress (CVE-2024-10924)
show less
Web App Attack
🇺🇸
mnsf
2026-06-10 00:10:21
(5 days ago)
Scanning/Probing (24)
Brute-Force
Web App Attack
🇬🇧
Smish
2026-02-12 07:38:01
(4 months ago)
HONEYPOT HIT --> Fail2ban time=1770881879 log=2026-02-12T07:37:59+00:00 ip=216.26.225.251 host=as210 ...
show more
HONEYPOT HIT --> Fail2ban time=1770881879 log=2026-02-12T07:37:59+00:00 ip=216.26.225.251 host=as210667.net method=GET uri="/.env.local" status=404 ua="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" ref="-" rid=a1046cebacf587fd3a6f5cded9348a61
show less
Web App Attack
🇳🇱
ReporTR
2026-02-10 09:39:39
(4 months ago)
Repeated malicious activity detected by Fail2Ban jail 'plesk-modsecurity'. TCP connection completed. ...
show more
Repeated malicious activity detected by Fail2Ban jail 'plesk-modsecurity'. TCP connection completed. IP banned.
show less
Hacking
Web App Attack
🇳🇱
i-turnradio.nl
2025-12-28 13:05:22
(5 months ago)
2025-12-28 @ 14:05:22 (CET) ~ Blocked based on risk assessment and prior abuse reports
Web App Attack
🇮🇹
VHosting
2025-12-24 08:00:18
(5 months ago)
Detected attack and reported by a human
DDoS Attack
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
🇺🇸
TPI-Abuse
2025-11-25 04:08:36
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.225.251 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.225.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 23:08:25.473649 2025] [security2:error] [pid 27338:tid 27338] [client 216.26.225.251:50001] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.writeitright.biz"] [uri "/.env"] [unique_id "aSUruUsiQHP9Vat2QUR2ZAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 03:08:49
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.225.251 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.225.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 22:08:42.545098 2025] [security2:error] [pid 714636:tid 714636] [client 216.26.225.251:46727] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.diveron.com"] [uri "/.svn/wc.db"] [unique_id "aSUduhyiPQkLbblWvHnldgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 02:08:17
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.225.251 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.225.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 21:08:09.927704 2025] [security2:error] [pid 27561:tid 27561] [client 216.26.225.251:52807] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.clearlightcarwash.com"] [uri "/.svn/wc.db"] [unique_id "aSUPifsuQf0WgwVVhhjCLQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 01:09:35
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.225.251 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.225.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 20:09:32.111386 2025] [security2:error] [pid 16839:tid 16839] [client 216.26.225.251:57827] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.maeghanan.com"] [uri "/.env"] [unique_id "aSUBzCk26OexogRQ5ybgIAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 00:54:25
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.225.251 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.225.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 19:52:35.067867 2025] [security2:error] [pid 10747:tid 10747] [client 216.26.225.251:47477] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.claytonsinn.com"] [uri "/.env"] [unique_id "aST90zBexNbYvPZEOuduewAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 00:15:23
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.225.251 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.225.251 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 19:15:15.116045 2025] [security2:error] [pid 19967:tid 19967] [client 216.26.225.251:56861] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.frankcgill.com"] [uri "/.git/HEAD"] [unique_id "aST1EwzfQBk7GSxdhQicBwAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
10dencehispahard SL
2025-11-19 07:50:57
(6 months ago)
WP probing for vulnerabilities
Hacking
Exploited Host
2025-11-14 09:44:47
(7 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇵🇱
sefinek.net
2025-11-08 11:34:51
(7 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (Windows NT 10.0; WOW64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 OPR/89.0.4447.51
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot