|
Anonymous
|
|
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Excessive Shopby Manufacturers Blocked: /communications/shopby/manufacturer-snom-netgear-bosch-dis-bxb-avaya-ruckus-fortinet-huawei-revolabs.html | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0 | (Magento Site)
show less
|
Hacking
Bad Web Bot
|
|
🇺🇸
鬼影233
|
|
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0
|
Bad Web Bot
|
|
🇺🇸
kosada.com
|
|
Web bot: denial-of-service flood
|
DDoS Attack
Bad Web Bot
|
|
🇺🇸
鬼影233
|
|
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36
|
Bad Web Bot
|
|
🇺🇸
integrantservices.com
|
|
(wordpress) Failed wordpress login from 41.10.88.36 (vc-vb-41-10-88-36.umts.vodacom.co.za)
|
Brute-Force
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 41.10.88.36 (vc-vb-41-10-88-36.umts.vodacom.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 11:33:15.838098 2026] [security2:error] [pid 4056871:tid 40 ...
show more
(mod_security) mod_security (id:225170) triggered by 41.10.88.36 (vc-vb-41-10-88-36.umts.vodacom.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 10 11:33:15.838098 2026] [security2:error] [pid 4056871:tid 4056871] [client 41.10.88.36:17829] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||dwightbrown.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "dwightbrown.com"] [uri "/wp-json/wp/v2/users"] [unique_id "annvO9JXYNEF9Nd5XA9MGwAAAAE"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
LRob
|
|
WordPress probing | req: /xmlrpc.php | UA: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/67.0.0.0 Safari/537.36
|
Brute-Force
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 41.10.88.36 (vc-vb-41-10-88-36.umts.vodacom.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 09 19:06:52.012863 2026] [security2:error] [pid 11235:tid 1123 ...
show more
(mod_security) mod_security (id:225170) triggered by 41.10.88.36 (vc-vb-41-10-88-36.umts.vodacom.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 09 19:06:52.012863 2026] [security2:error] [pid 11235:tid 11235] [client 41.10.88.36:18064] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||energycapitalinvestments.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "energycapitalinvestments.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ankIDKOyJNEIWW1oWfKWtwAAAAU"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇫🇷
ELYAZ
|
|
(wordpress) Failed wordpress login from 41.10.88.36 (-): (CF_ENABLE)
|
Brute-Force
|
|
🇫🇷
Little Iguana
|
|
Attempt to hack Wordpress Login, XMLRPC or other login
|
Hacking
|
|
🇺🇸
kosada.com
|
|
Web bot: DDoS
|
DDoS Attack
Bad Web Bot
|
|
🇫🇮
as211431.net
|
|
Triggered Cloudflare WAF (firewallCustom) from ZA.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (POST method)
Endpoint: /xmlrpc.php
UA: Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/86.0.0.0 Safari/537.36
This r ...
show more
Triggered Cloudflare WAF (firewallCustom) from ZA.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (POST method)
Endpoint: /xmlrpc.php
UA: Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/86.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
|
Bad Web Bot
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 41.10.88.36 (vc-vb-41-10-88-36.umts.vodacom.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 10:52:51.759039 2026] [security2:error] [pid 3149300:tid 31 ...
show more
(mod_security) mod_security (id:225170) triggered by 41.10.88.36 (vc-vb-41-10-88-36.umts.vodacom.co.za): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 10:52:51.759039 2026] [security2:error] [pid 3149300:tid 3149300] [client 41.10.88.36:35941] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||zost.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "zost.net"] [uri "/wp-json/wp/v2/users"] [unique_id "amDZQ2MJajGCZAr39gZdcAAAAC8"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇬🇧
AvonleaConsulting
|
|
Attempts to probe web pages for vulnerable PHP or other applications
|
Web App Attack
|
|
🇬🇧
AvonleaConsulting
|
|
Scanning unused Default website or suspicious access to valid sites from IP marked as abusive
|
Bad Web Bot
Web App Attack
|
