2026-06-24 03:09:50
(12 hours ago)
RdpGuard detected brute-force attempt on RD-WEB
Brute-Force
🇪🇸
librebit
2026-06-24 02:05:18
(13 hours ago)
Brute force
Brute-Force
🇧🇪
cmbplf
2026-05-24 19:35:45
(4 weeks ago)
5.689 requests with url.path */xmlrpc.php
5.689 requests with url.path //xmlrpc.php
Brute-Force
Bad Web Bot
🇨🇭
4server
2026-05-22 19:55:34
(1 month ago)
[FriMay2221:55:28.4956272026][security2:error][pid2611640:tid2611674][client216.26.234.0:0]ModSecuri ...
show more
[FriMay2221:55:28.4956272026][security2:error][pid2611640:tid2611674][client216.26.234.0:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"benvenutialfood.biz\"][uri\"/wp-login.php\"][unique_id\"ahC0sPG182jK7L0DD4W6zQAAAE4\"]\,referer:https://benvenutialfood.biz/wp-login.php
show less
Hacking
Web App Attack
🇵🇱
sefinek.net
2026-02-10 18:17:57
(4 months ago)
Triggered Cloudflare WAF (firewallCustom) from CA.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from CA.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /genshin-stella-mod
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 OPR/89.0.4447.51
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇲🇹
Malta
2026-01-01 14:17:18
(5 months ago)
216.26.234.0 - - [01/Jan/2026:15:17:18 +0100] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT ...
show more
216.26.234.0 - - [01/Jan/2026:15:17:18 +0100] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.6367.207 Safari/537.36"
show less
VPN IP
Hacking
Web App Attack
2025-12-22 15:58:23
(6 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 11:26:31
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 06:26:23.605699 2025] [security2:error] [pid 24481:tid 24481] [client 216.26.234.0:14861] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.keithbowles.com"] [uri "/.git/HEAD"] [unique_id "aSbj3zfRf6btf1-ZNBv_9AAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 09:27:00
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 04:26:52.476006 2025] [security2:error] [pid 2641575:tid 2641575] [client 216.26.234.0:11143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.susansimmons.net"] [uri "/.svn/wc.db"] [unique_id "aSbH3BOb50Uw6z3gXOgg6wAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 06:16:15
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 01:16:11.186043 2025] [security2:error] [pid 8085:tid 8085] [client 216.26.234.0:57377] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.icsubb.com"] [uri "/.svn/wc.db"] [unique_id "aSabK3gEXPcNye0NIDxVowAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 01:10:42
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 20:10:35.983378 2025] [security2:error] [pid 13870:tid 13870] [client 216.26.234.0:15313] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.alianzallc.com"] [uri "/.env"] [unique_id "aSZTi72upfxhfvefFbepBgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 00:54:27
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 19:54:19.546792 2025] [security2:error] [pid 1647140:tid 1647190] [client 216.26.234.0:34305] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.certifiedfinancialanalyst.org"] [uri "/.env"] [unique_id "aST-O8WdNO_bFaD03Zb-qQAAAMw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 09:31:10
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 04:30:59.583410 2025] [security2:error] [pid 4204:tid 4204] [client 216.26.234.0:33917] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.dorciedesigns.com"] [uri "/.env"] [unique_id "aSQl02207LOKJAnlKeNcfAAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 09:01:49
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 04:01:39.364359 2025] [security2:error] [pid 19099:tid 19099] [client 216.26.234.0:21529] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.qed-consulting.co"] [uri "/.env"] [unique_id "aSQe8_ZarCvUMXB8L1faNQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 07:47:37
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.234.0 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:47:32.111364 2025] [security2:error] [pid 2134:tid 2134] [client 216.26.234.0:39291] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.whitmarshinc.com"] [uri "/.svn/wc.db"] [unique_id "aSQNlPbUe1D72VangIki_gAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack