🇦🇺
aranguren.org
2026-11-14 11:59:09
UTC ·
(29 seconds ago)
3.208.10.80 - - [14/Nov/2026:22:59:08 +1100] "POST / HTTP/1.1" 404 1138 "https://private.aranguren.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
3.208.10.80 - - [14/Nov/2026:22 ...
show more
3.208.10.80 - - [14/Nov/2026:22:59:08 +1100] "POST / HTTP/1.1" 404 1138 "https://private.aranguren.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
3.208.10.80 - - [14/Nov/2026:22:59:08 +1100] "POST / HTTP/1.1" 404 1138 "https://private.aranguren.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36"
3.208.10.80 - - [14/Nov/2026:22:59:08 +1100] "POST / HTTP/1.1" 404 1138 "https://private.aranguren.org/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
🇩🇪
sdos.es
2026-11-14 11:46:42
UTC ·
(12 minutes ago)
"Remote Command Execution: Unix Command Injection - Matched Data: {timeout found within ARGS:$ACTION_uQPDr8:1: {\x22\x5cu005f\x5cu0072\x5cu0065\x5cu0073\x5cu0070\x5cu006f\x5cu006e\x5cu0073\x5cu0065\x22:{\x22\x5cu005f\x5cu0070\x5cu0072\x5cu0065\x5cu00 ...
show more
"Remote Command Execution: Unix Command Injection - Matched Data: {timeout found within ARGS:$ACTION_uQPDr8:1: {\x22\x5cu005f\x5cu0072\x5cu0065\x5cu0073\x5cu0070\x5cu006f\x5cu006e\x5cu0073\x5cu0065\x22:{\x22\x5cu005f\x5cu0070\x5cu0072\x5cu0065\x5cu0066\x5cu0069\x5cu0078\x22:\x22var ypfql=arguments['\x5c\x5cx31'"
show less
Web App Attack
🇳🇱
sembeek
2026-11-14 11:25:33
UTC ·
(34 minutes ago)
requests blocked by a web application firewall: 9 attempts within 10 minutes, seen by Cloudflare WAF (reported by RemotePower)
Web App Attack
🇳🇱
Eric
2026-11-14 11:16:03
UTC ·
(43 minutes ago)
[Sat Nov 14 11:16:03.291744 2026] [security2:error] [pid 2257705:tid 2257705] [client 3.208.10.80:49180] [client 3.208.10.80] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity ...
show more
[Sat Nov 14 11:16:03.291744 2026] [security2:error] [pid 2257705:tid 2257705] [client 3.208.10.80:49180] [client 3.208.10.80] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 40)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "fambus.nl"] [uri "/"] [unique_id "avhC81yBbhNYALAlVNgIewAAAA0"], referer: https://fambus.nl/
[Sat Nov 14 11:16:03.424620 2026] [security2:error] [pid 2257705:tid 2257705] [client 3.208.10.80:49180] [client 3.208.10.80] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Sc
...
show less
Hacking
Web App Attack
🇫🇷
mrcrassi
2026-11-14 10:51:20
UTC ·
(1 hour ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
This report was ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
FeG Deutschland
2026-11-14 10:37:12
UTC ·
(1 hour ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 24
Exploited Host
Web App Attack
2026-11-14 10:36:47
UTC ·
(1 hour ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇨🇭
Ribeye375
2026-11-14 10:35:29
UTC ·
(1 hour ago)
HIPS nginx-access-errors - Block tcp/http,https
Brute-Force
2026-11-14 10:09:27
UTC ·
(1 hour ago)
[Sat Nov 14 04:44:49.797220 2026] [:error] [pid 3371965:tid 139920924264192] [client 3.208.10.80:49048] [client 3.208.10.80] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/opt/o ...
show more
[Sat Nov 14 04:44:49.797220 2026] [:error] [pid 3371965:tid 139920924264192] [client 3.208.10.80:49048] [client 3.208.10.80] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/opt/owasp-crs-4.26.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 45)"] [ver "OWASP_CRS/4.26.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "olimed.ims.forth.gr"] [uri "/"] [unique_id "avfLIYQBGBNtyfIXItL3mgAAAMI"], referer: https://olimed.ims.forth.gr/
[Sat Nov 14 04:44:49.910579 2026] [:error] [pid 3371912:tid 139920429541120] [client 3.208.10.80:49064] [client 3.208.10.80] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/opt/owasp-crs-4.26.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 45)"] [ver "OWASP_CRS/
...
show less
Hacking
Web App Attack
🇹🇭
MWA SOC
2026-11-14 10:00:31
UTC ·
(1 hour ago)
Hacking
🇵🇱
Roper123
2026-11-14 09:49:39
UTC ·
(2 hours ago)
Web app exploits
Web App Attack
🇨🇭
dalslab ltd
2026-11-14 09:11:23
UTC ·
(2 hours ago)
[14/Nov/2026:09:53:41 +0100] - 404 404 - POST https hoarder.dalslab.com "/" [Client 3.208.10.80] [Length 24] [Gzip -] [Sent-to 10.1.1.49] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36 ...
show more
[14/Nov/2026:09:53:41 +0100] - 404 404 - POST https hoarder.dalslab.com "/" [Client 3.208.10.80] [Length 24] [Gzip -] [Sent-to 10.1.1.49] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36" "https://hoarder.dalslab.com/"
[14/Nov/2026:09:53:46 +0100] - 404 404 - POST https hoarder.dalslab.com "/" [Client 3.208.10.80] [Length 24] [Gzip -] [Sent-to 10.1.1.49] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" "https://hoarder.dalslab.com/"
[14/Nov/2026:10:11:19 +0100] - 404 404 - POST https tracking.dalslab.com "/" [Client 3.208.10.80] [Length 24] [Gzip -] [Sent-to ] "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36" "https://tracking.dalslab.com/"
[14/Nov/2026:10:11:22 +0100] - 404 404 - POST https tracking.dalslab.com "/" [Client 3.208.10.80] [Length 24] [Gzip -] [Sent-to ] "Mozilla/5.0 (Windows NT 10.
...
show less
Web Spam
Brute-Force
Bad Web Bot
Web App Attack
🇳🇴
Abuse Buster
2026-11-14 09:10:55
UTC ·
(2 hours ago)
3.208.10.80 - - [14/Nov/2026:10:10:52 +0100] "POST / HTTP/1.1" 404 850 "https://git.wingthor.net/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36"
3.208.10.80 - - [14/Nov/2026:10 ...
show more
3.208.10.80 - - [14/Nov/2026:10:10:52 +0100] "POST / HTTP/1.1" 404 850 "https://git.wingthor.net/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36"
3.208.10.80 - - [14/Nov/2026:10:10:53 +0100] "POST / HTTP/1.1" 400 11 "https://git.wingthor.net/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
3.208.10.80 - - [14/Nov/2026:10:10:53 +0100] "POST / HTTP/1.1" 404 850 "https://git.wingthor.net/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇩🇪
Grossmann-Gruppe
2026-11-14 09:00:48
UTC ·
(2 hours ago)
Plesk Fail2Ban: plesk-modsecurity
Hacking
Brute-Force
🇩🇰
ScamAware
2026-11-14 08:48:24
UTC ·
(3 hours ago)
Detected by Cloudflare Security Events via WordPress automation. Detection: bad_bot_scanner (Bad bot / scanner behavior). Hits from same IP in last 60 minutes: 11. Unique request paths counted internally: 1. Cloudflare action: managed_challenge. Clou ...
show more
Detected by Cloudflare Security Events via WordPress automation. Detection: bad_bot_scanner (Bad bot / scanner behavior). Hits from same IP in last 60 minutes: 11. Unique request paths counted internally: 1. Cloudflare action: managed_challenge. Cloudflare source: botFight.
show less
Bad Web Bot
