🇧🇪
Saec
2026-07-18 15:56:21
(14 hours ago)
Jarvis auto-ban: CF honeypot path /wp-login.php (1× on saec.me)
Port Scan
Web App Attack
🇫🇷
ELYAZ
2026-07-01 04:26:31
(2 weeks ago)
(y4) Failed scan -byebye- from 216.26.233.221 (US/United States/-): (CF_ENABLE)
Hacking
🇫🇷
pm33
2026-06-27 17:53:45
(3 weeks ago)
Wordpress login attempts
Brute-Force
🇫🇷
ELYAZ
2026-06-18 19:36:30
(1 month ago)
(y4) Failed scan -byebye- from 216.26.233.221 (US/United States/-): (CF_ENABLE)
Hacking
🇫🇷
mrcrassi
2026-06-17 16:05:54
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from CA.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST meth ...
show more
Triggered Cloudflare WAF (firewallCustom) from CA.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
xmission.com
2026-06-16 20:45:09
(1 month ago)
216.26.233.221 - - [16/Jun/2026:14:45:08 -0600] "POST /xmlrpc.php HTTP/1.1" 200 413 "-" "Mozilla/5.0 ...
show more
216.26.233.221 - - [16/Jun/2026:14:45:08 -0600] "POST /xmlrpc.php HTTP/1.1" 200 413 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.2 Safari/605.1.15"
...
show less
Web App Attack
🇫🇷
ELYAZ
2026-06-13 20:22:11
(1 month ago)
(y4) Failed scan -byebye- from 216.26.233.221 (US/United States/-): (CF_ENABLE)
Hacking
🇺🇸
dtorrer
2026-06-11 22:19:33
(1 month ago)
Brute-force general attack.
Brute-Force
🇩🇪
FeG Deutschland
2026-06-11 07:02:45
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇦🇺
HJ5Ss4Ju
2026-06-10 03:10:14
(1 month ago)
Blocked by Wordfence (SID 6)
Web App Attack
2026-01-05 12:18:39
(6 months ago)
[04/Jan/2026:00:48:03 -0500] "GET /remote/login HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) ...
show more
[04/Jan/2026:00:48:03 -0500] "GET /remote/login HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36"
show less
Hacking
🇺🇸
TPI-Abuse
2025-11-26 18:55:17
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.233.221 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.233.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 13:55:11.441325 2025] [security2:error] [pid 27464:tid 27464] [client 216.26.233.221:12765] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.lollytalk.com"] [uri "/.env"] [unique_id "aSdND_1HbR-bsRNrFZxxJgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇱🇻
garmtech.com
2025-11-26 17:45:54
(7 months ago)
Attempted access to sensitive endpoint (/.env) detected. Automated scan or unauthorized probing.
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 16:51:41
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.233.221 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.233.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 11:51:37.833646 2025] [security2:error] [pid 5289:tid 5289] [client 216.26.233.221:32007] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.zenmonkeyproject.com"] [uri "/.env"] [unique_id "aScwGe0Jhs9mj1ED9jryrAAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 07:39:39
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.233.221 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.233.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 02:39:33.996392 2025] [security2:error] [pid 27053:tid 27053] [client 216.26.233.221:53403] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.blackriverarc.org"] [uri "/.git/HEAD"] [unique_id "aSVdNVK5vGodHXFsU4iu1gAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack