|
🇫🇷
SpaceHost-Server
|
|
|
Brute-Force
Web App Attack
|
|
|
Anonymous
|
|
Fail2Ban triggered
|
Web App Attack
|
|
|
🇫🇷
SpaceHost-Server
|
|
|
Brute-Force
Web App Attack
|
|
|
Anonymous
|
|
Fail2Ban triggered
|
Web App Attack
|
|
|
🇬🇧
pinguin
|
|
Triggered Cloudflare WAF (firewallManaged) from UA.
Action taken: LOG
Protocol: HTTP/2 (HEAD method) ...
show more
Triggered Cloudflare WAF (firewallManaged) from UA.
Action taken: LOG
Protocol: HTTP/2 (HEAD method)
Endpoint: /back/www.tar
UA: Empty string
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
|
Bad Web Bot
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 45.130.81.30 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 45.130.81.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 11 22:31:53.226595 2026] [security2:error] [pid 26752:tid 26752] [client 45.130.81.30:26401] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thegoldentether.com"] [uri "/sftp-config.json"] [unique_id "abIlmT3W4D9eOm2wZwFvYgAAACE"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 45.130.81.30 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 45.130.81.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 17 12:05:41.972721 2026] [security2:error] [pid 8914:tid 8914] [client 45.130.81.30:60761] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||headcount.dev|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "headcount.dev"] [uri "/backup/mysql.sql"] [unique_id "aZSf5YTdhyztrnzCgUkVgAAAAAE"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 45.130.81.30 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 45.130.81.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Feb 14 23:05:44.271932 2026] [security2:error] [pid 3632:tid 3632] [client 45.130.81.30:61335] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bitcointoolshop.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bitcointoolshop.com"] [uri "/old/dump.sql"] [unique_id "aZFGGKtegTJxwjuh___CcwAAAAI"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
island-freaks.com
|
|
Attack Type: WordPress Exploit Bot attempt on /bak/backup.gz | DNS 45.130.81.30 | Agent: none
|
Port Scan
Hacking
Bad Web Bot
Exploited Host
Web App Attack
|
|
|
🇺🇸
Penny Packer
|
|
Fail2Ban apache-tripwires
|
Web App Attack
|
|
|
🇳🇿
Tripwire
|
|
Scanning for backup files - /archive.zip
|
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 45.130.81.30 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 45.130.81.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Dec 14 12:50:02.642550 2025] [security2:error] [pid 14552:tid 14552] [client 45.130.81.30:61147] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jussetcotradinglimited.co"] [uri "/old/sftp-config.json"] [unique_id "aT74ymGtQJ8Tp9kWAKFhmwAAABc"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇯🇵
Valhalla
|
|
/backup/index.zip
|
Hacking
Web App Attack
|
|
|
🇺🇸
Penny Packer
|
|
Fail2Ban apache-tripwires
|
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 45.130.81.30 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 45.130.81.30 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Dec 04 16:30:05.450276 2025] [security2:error] [pid 23015:tid 23015] [client 45.130.81.30:29469] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||uppermotradingco.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "uppermotradingco.com"] [uri "/backup/mysql.sql"] [unique_id "aTH9XaGuAmFqBWqt7Wf3pAAAABA"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|