🇫🇷
claude CALVET
2026-11-08 18:54:53
UTC ·
(8 hours ago)
gew-Joomla User : try to access forms...
Hacking
🇩🇪
mrsummerville
2026-11-07 20:17:51
UTC ·
(1 day ago)
Bad bot detected by WordPress firewall: requested a hidden link disallowed in robots.txt.
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-06 23:46:33
UTC ·
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 2a01:ecc0:480:d6::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:46:29.571319 2026] [security2:error] [pid 26770:tid 26770] [client 2a01:ecc0: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a01:ecc0:480:d6::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:46:29.571319 2026] [security2:error] [pid 26770:tid 26770] [client 2a01:ecc0:480:d6::2:33688] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||keystroke.info|F|2"] [data ".php.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "keystroke.info"] [uri "/LocalSettings.php.backup"] [unique_id "au5m1QT2ZTCvkKy_3YKpoQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇹
René Hickersberger
2026-10-30 20:29:06
UTC ·
(1 week ago)
malicious bot detected: violations="hit-honeypot"; user_agent="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36"
Web App Attack
🇩🇪
HandyTreff.de
2026-10-23 03:44:35
UTC ·
(2 weeks ago)
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -47.719 (Bad < -10 / Very Bad < -20 / Extreme < -35) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Sa
Web App Attack
Bad Web Bot
🇵🇱
Budyn
2026-10-18 23:14:21
UTC ·
(3 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: astropot.store | URI: /wp-admin/ | UA: Mozilla/5.0 (Windows N ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: astropot.store | URI: /wp-admin/ | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 21:16:57
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2a01:ecc0:480:d6::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 17:16:53.139850 2026] [security2:error] [pid 16556:tid 16556] [client 2a01:ecc0: ...
show more
(mod_security) mod_security (id:210492) triggered by 2a01:ecc0:480:d6::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 17:16:53.139850 2026] [security2:error] [pid 16556:tid 16556] [client 2a01:ecc0:480:d6::2:60490] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "archief.org"] [uri "/bak.htaccess"] [unique_id "atKURR3tlyUs4VLMXcxd2AAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
conseilgouz
2026-10-10 19:40:17
UTC ·
(4 weeks ago)
vew-(visforms) : try to access forms...
Hacking
🇵🇱
Budyn
2026-10-08 21:40:37
UTC ·
(1 month ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.space | URI: /wp-admin/ | UA: Mozilla/5.0 (Windows N ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.space | URI: /wp-admin/ | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-06 00:57:56
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2a01:ecc0:480:d6::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 20:57:50.522110 2026] [security2:error] [pid 13850:tid 13850] [client 2a01:ecc0: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a01:ecc0:480:d6::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 05 20:57:50.522110 2026] [security2:error] [pid 13850:tid 13850] [client 2a01:ecc0:480:d6::2:47482] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||keystroke.info|F|2"] [data ".php.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "keystroke.info"] [uri "/LocalSettings.php.backup"] [unique_id "asRHjsKFag0Kn8i7IgatOQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-02 07:41:48
UTC ·
(1 month ago)
Web page flood (L7) | path: /, /pneus-first-stop/, /geometrie-parallelisme/ (+11 more) | 2026-10-02 07:41 UTC
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-02 05:10:22
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2a01:ecc0:480:d6::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 01:10:14.472762 2026] [security2:error] [pid 25095:tid 25095] [client 2a01:ecc0: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a01:ecc0:480:d6::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 02 01:10:14.472762 2026] [security2:error] [pid 25095:tid 25095] [client 2a01:ecc0:480:d6::2:32884] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||pointandshootfilm.com|F|2"] [data ".facebook.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "pointandshootfilm.com"] [uri "/www.facebook.com"] [unique_id "ar88tti3PyOARBGJflJWhwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-29 00:34:22
UTC ·
(1 month ago)
Not following 301 redirects — wasted requests | method: GET | path: / | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 | 2026-09-29 00:34 UTC
Bad Web Bot
🇫🇮
as211431.net
2026-09-27 06:22:17
UTC ·
(1 month ago)
Triggered Cloudflare WAF (linkMaze) from DE.
Action taken: LINK_MAZE_VISITED
Protocol: HTTP/2 (GET method)
Endpoint: /cdn-cgi/content
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
...
show more
Triggered Cloudflare WAF (linkMaze) from DE.
Action taken: LINK_MAZE_VISITED
Protocol: HTTP/2 (GET method)
Endpoint: /cdn-cgi/content
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-26 04:26:55
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 2a01:ecc0:480:d6::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 00:26:49.026585 2026] [security2:error] [pid 31676:tid 31676] [client 2a01:ecc0: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a01:ecc0:480:d6::2 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 26 00:26:49.026585 2026] [security2:error] [pid 31676:tid 31676] [client 2a01:ecc0:480:d6::2:35338] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aavondalervstorage.com|F|2"] [data ".aavondalepetboarding.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aavondalervstorage.com"] [uri "/www.aavondalepetboarding.com"] [unique_id "ardJiTtEykHEH_EMYz6CowAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
