🇬🇧
poundawebsiteltd
2026-04-13 18:15:39
(1 month ago)
Web App Attack (ModSecurity Block). Evidence: [REDACTED_DOMAIN]:443 35.184.120.90 - - [13/Apr/2026:1 ...
show more
Web App Attack (ModSecurity Block). Evidence: [REDACTED_DOMAIN]:443 35.184.120.90 - - [13/Apr/2026:19:15:36 +0100] POST / HTTP/1.1 403 2835 https://[REDACTED_DOMAIN]/ Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
show less
Web App Attack
🇺🇸
Vano Ganzzz
2026-04-11 16:35:58
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
ASN: 396982 (GOOGLE-CLOUD-PLA ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
ASN: 396982 (GOOGLE-CLOUD-PLATFORM - Google LLC)
Protocol: HTTP/1.1 (POST method)
Endpoint: /
Timestamp: 2026-04-11T16:35:58Z
Ray ID: 9eab6852cab2e25e
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:144.0) Gecko/20100101 Firefox/144.0
show less
Bad Web Bot
🇺🇸
Sylvyon
2026-04-11 05:07:26
(1 month ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/1.1 (POST) | Endp ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/1.1 (POST) | Endpoint: / | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
SYSMarshal
2026-04-11 03:04:59
(1 month ago)
SYSMarshal detection: Port Scanning, Web Application Attack, DDoS Attack, DNS Attack, Bad Bot [Port: ...
show more
SYSMarshal detection: Port Scanning, Web Application Attack, DDoS Attack, DNS Attack, Bad Bot [Port:443, Proto:TCP, EventID:5152]
show less
Port Scan
Web App Attack
Bad Web Bot
2026-04-11 01:59:12
(1 month ago)
Bot / seems abusive / Apache connections: 29
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇫🇮
oh.mg
2026-04-10 23:36:14
(1 month ago)
[Sat Apr 11 01:36:13.330635 2026] [security2:error] [pid 1312530:tid 1312586] [client 35.184.120.90: ...
show more
[Sat Apr 11 01:36:13.330635 2026] [security2:error] [pid 1312530:tid 1312586] [client 35.184.120.90:5224] [client 35.184.120.90] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 50)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "mmn.on.ca"] [uri "/"] [unique_id "admJbaCOPYokgkEwunwHngAAAIw"], referer: https://mmn.on.ca/
[Sat Apr 11 01:36:13.967483 2026] [security2:error] [pid 1312530:tid 1312590] [client 35.184.120.90:5238] [client 35.184.120.90] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 50)"] [ver "OWASP_CR
...
show less
Web App Attack
Bad Web Bot
🇫🇷
LRNP
2026-04-10 23:29:31
(1 month ago)
mc.lpoujol.fr:443 35.184.120.90 - - [10/Apr/2026:23:05:33 +0000] "POST / HTTP/1.1" 403 180 "https:// ...
show more
mc.lpoujol.fr:443 35.184.120.90 - - [10/Apr/2026:23:05:33 +0000] "POST / HTTP/1.1" 403 180 "https://mc.lpoujol.fr/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36"
mc.lpoujol.fr:443 35.184.120.90 - - [10/Apr/2026:23:05:34 +0000] "POST / HTTP/1.1" 403 180 "https://mc.lpoujol.fr/" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36"
mc.lpoujol.fr:443 35.184.120.90 - - [10/Apr/2026:23:05:35 +0000] "POST / HTTP/1.1" 403 118 "https://mc.lpoujol.fr/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:144.0) Gecko/20100101 Firefox/144.0"
mc.lpoujol.fr:443 35.184.120.90 - - [10/Apr/2026:23:05:36 +0000] "POST / HTTP/1.1" 403 180 "https://mc.lpoujol.fr/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36"
mc.lpoujol.fr:443 35.184.120.90 - - [10/Apr/2026:23:05:37 +0000] "POST / HTTP/1.1" 403 180 "https://mc.lpoujol.
...
show less
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-04-10 22:20:57
(1 month ago)
Remote Command Execution: Windows FOR/IF Command Found. Pattern match "\\\\b(?:if(?:/i)?(?: not)?(?: ...
show more
Remote Command Execution: Windows FOR/IF Command Found. Pattern match "\\\\b(?:if(?:/i)?(?: not)?(?: exist\\\\b| defined\\\\b| errorlevel\\\\b| cmdextversion\\\\b|(?: |\\\\().*(?:\\\\bgeq\\\\b|\\\\bequ\\\\b|\\\\bneq\\\\b|\\\\bleq\\\\b|\\\\bgtr\\\\b|\\\\blss\\\\b|==))|for(?:/ (932140-143)
show less
Hacking
🇨🇦
1gz
2026-04-10 20:51:19
(1 month ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST met ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇾
joelguerreroalvarado
2026-04-10 20:06:02
(1 month ago)
Automated report from IR Platform. IP detected performing cloudflare multi zone attack attacks. 3 ev ...
show more
Automated report from IR Platform. IP detected performing cloudflare multi zone attack attacks. 3 events detected in the last hour. Affected systems: funedu.ar, bodegagarzon.com, funeducando.ar
show less
Web App Attack
Bad Web Bot
2026-04-10 20:03:50
(1 month ago)
2026/04/10 20:03:47 [error] 542#542: *71951 [client 35.184.120.90] ModSecurity: Access denied with c ...
show more
2026/04/10 20:03:47 [error] 542#542: *71951 [client 35.184.120.90] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `11' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `50' ) [file "/etc/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 50)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.16.0"] [maturity "0"] [accuracy "0"] [tag "modsecurity"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "homesex.casa"] [uri "/"] [unique_id "177585142641.502343"] [ref ""], client: 35.184.120.90, server: homesex.casa, request: "POST / HTTP/1.1", host: "homesex.casa", referrer: "https://homesex.casa/"
2026/04/10 20:03:48 [error] 542#542: *71952 [client 35.184.120.90] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `11' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `45' ) [file "/etc/
...
show less
Hacking
Web App Attack
🇮🇹
Progetto1
2026-04-10 19:35:05
(1 month ago)
Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
MPL
2026-04-10 19:10:20
(1 month ago)
tcp/443 (6 or more attempts)
Port Scan
🇫🇷
masterguru
2026-04-10 18:38:51
(1 month ago)
Possible Unicode character bypass detected. Pattern match "(?i)\\\\x5cu (920540-195)
Hacking
2026-04-10 18:15:14
(1 month ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot