|
🇫🇷
mrcrassi
|
|
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/2 (POST method ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
|
Bad Web Bot
|
|
|
🇱🇻
garmtech.com
|
|
IM360 WAF: SQL Injection Attack: Common DB Names Detected
|
SQL Injection
|
|
|
🇧🇾
lns.bz
|
|
Banned for trying to access xmlrpc [BY]
|
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210350) triggered by 45.148.124.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 45.148.124.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 15 12:34:57.379598 2025] [security2:error] [pid 9314:tid 9331] [client 45.148.124.60:52649] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||keetons.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "keetons.net"] [uri "/"] [unique_id "aRi5wXEmg-WMcmu0Nkfy7gAAAMY"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
Anonymous
|
|
Forum/form spam
|
Web Spam
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:211120) triggered by 45.148.124.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:211120) triggered by 45.148.124.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 12 13:18:51.819047 2025] [security2:error] [pid 6298:tid 6298] [client 45.148.124.60:27341] [client 45.148.124.60] ModSecurity: Access denied with code 403 (phase 2). Match of "endsWith /modules/paypal/express_checkout/payment.php" against "REQUEST_FILENAME" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "29"] [id "211120"] [rev "12"] [msg "COMODO WAF: Remote File Inclusion Attack||airtechconsulting.com|F|2"] [data "Matched Data: http://adguard.digital/payload/index.php? found within REQUEST_FILENAME: /wp-content/plugins/all-in-one-seo-pack/classes/aiosp.class.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "airtechconsulting.com"] [uri "/wp-content/plugins/all-in-one-seo-pack/classes/aiosp.class.php"] [unique_id "Z9HB-6R5nC9u-_SEHiYmcAAAAAI"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:211120) triggered by 45.148.124.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:211120) triggered by 45.148.124.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 10 07:32:49.762792 2025] [security2:error] [pid 14873:tid 14890] [client 45.148.124.60:28389] [client 45.148.124.60] ModSecurity: Access denied with code 403 (phase 2). Match of "endsWith /modules/paypal/express_checkout/payment.php" against "REQUEST_FILENAME" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "29"] [id "211120"] [rev "12"] [msg "COMODO WAF: Remote File Inclusion Attack||aclarityforensics.com|F|2"] [data "Matched Data: http://adguard.digital/payload/index.php? found within REQUEST_FILENAME: /wp-content/plugins/w3-total-cache/lib/w3/pager.class.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aclarityforensics.com"] [uri "/wp-content/plugins/w3-total-cache/lib/W3/Pager.class.php"] [unique_id "Z87N4fxRMlztea1WRWVZ6wAAAE8"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:211120) triggered by 45.148.124.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:211120) triggered by 45.148.124.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Feb 26 09:17:01.682643 2025] [security2:error] [pid 16531:tid 16531] [client 45.148.124.60:23025] [client 45.148.124.60] ModSecurity: Access denied with code 403 (phase 2). Match of "endsWith /modules/paypal/express_checkout/payment.php" against "REQUEST_FILENAME" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "29"] [id "211120"] [rev "12"] [msg "COMODO WAF: Remote File Inclusion Attack||www.thewillsmith.com|F|2"] [data "Matched Data: http://adguard.digital/payload/index.php? found within REQUEST_FILENAME: /wp-content/plugins/canto/includes/lib/download.php"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.thewillsmith.com"] [uri "/wp-content/plugins/canto/includes/lib/download.php"] [unique_id "Z78iXV-yk9dEimVvRNfTPQAAAA8"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇲🇾
Rizzy
|
|
Multiple WAF Violations
|
Brute-Force
Web App Attack
|
|
|
🇺🇸
MrDD
|
|
Brute Force on Cisco Web VPN
|
Brute-Force
|
|
|
🇵🇱
TI
|
|
Scrapping website, using diffrent useragents, not wait for response, #botnet20231026
|
DDoS Attack
Bad Web Bot
|
|