🇫🇷
Sklurk
2026-07-31 02:39:28
(1 day ago)
Web App Attack
Web App Attack
🇺🇸
cwytech
2026-07-30 16:12:12
(1 day ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wp-us-login-only-high.
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-07-30 02:10:07
(2 days ago)
Web App Attack
Web App Attack
2026-07-29 07:00:00
(3 days ago)
Apache probe; attempts=20; exact paths: /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-01-08 11:01:41
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 08 06:01:32.277267 2026] [security2:error] [pid 9335:tid 9335] [client 216.26.244.159:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "barryherbach.com"] [uri "/.env"] [unique_id "aV-OjMc_CG4O6YUOKrqI-AAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 05:34:21
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 00:34:15.024473 2025] [security2:error] [pid 26065:tid 26065] [client 216.26.244.159:21769] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "baselinesc.com"] [uri "/.env"] [unique_id "aVIS13yHz3rQYQnLbvG1rgAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 09:43:04
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 04:42:57.381362 2025] [security2:error] [pid 23431:tid 23431] [client 216.26.244.159:32207] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.dadlounge.com"] [uri "/.git/HEAD"] [unique_id "aSQooX508C9uCC3igWJbgAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 06:42:33
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 01:42:20.004738 2025] [security2:error] [pid 13943:tid 14021] [client 216.26.244.159:14527] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.adultbaja.com"] [uri "/.env"] [unique_id "aSP-TOpgfj-qx9CvqmQ6bwAAAgI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 06:19:03
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 01:18:57.497763 2025] [security2:error] [pid 23848:tid 23848] [client 216.26.244.159:48919] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kaleidoscopeglassworks.kaleidoscope-glass.com"] [uri "/.svn/wc.db"] [unique_id "aSP40VZfDg93c5fz8BmqagAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 04:05:06
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:04:54.180676 2025] [security2:error] [pid 27771:tid 27771] [client 216.26.244.159:30017] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.ikutabukkyokai.com"] [uri "/.env"] [unique_id "aSPZZlrnOYfx-MA4leiPlQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 03:31:41
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 22:31:31.985600 2025] [security2:error] [pid 22794:tid 22794] [client 216.26.244.159:36271] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.eran.construction"] [uri "/.git/HEAD"] [unique_id "aSPRk598cxS_SGQ83LD3zgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 02:03:43
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 216.26.244.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 21:03:35.769343 2025] [security2:error] [pid 9693:tid 9693] [client 216.26.244.159:44105] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.powerfulpals.com"] [uri "/.svn/wc.db"] [unique_id "aSO899jkjqnjcuLBrvGwygAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
applemooz
2025-11-01 12:03:39
(8 months ago)
WordPress XMLRPC Brute Force Attacks
...
Brute-Force
Web App Attack
🇵🇱
sefinek.net
2025-09-29 16:24:01
(10 months ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (X11; Linux i686; rv:114.0) Gecko/20100101 Firefox/114.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot