🇺🇸
mnsf
2026-06-01 22:06:15
(3 days ago)
Scanning/Probing (34)
Brute-Force
Web App Attack
🇩🇪
FeG Deutschland
2026-06-01 11:41:02
(4 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 27
Exploited Host
Web App Attack
🇫🇷
mrcrassi
2026-05-27 21:56:39
(1 week ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET meth ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /wp-config.php.bak
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-05-04 18:16:50
(1 month ago)
Forum/form spam
Web Spam
2026-04-06 19:08:37
(1 month ago)
Forum/form spam
Web Spam
🇺🇸
TPI-Abuse
2026-02-24 10:25:37
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 45.3.33.147 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:225170) triggered by 45.3.33.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 24 05:25:33.653285 2026] [security2:error] [pid 31850:tid 31850] [client 45.3.33.147:28331] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||salsberggroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "salsberggroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aZ18nS0IuTAyR_G4-hzmZgAAAAA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-02-18 22:16:54
(3 months ago)
Detected attack and reported by a human
Brute-Force
Web App Attack
SSH
DDoS Attack
Exploited Host
Bad Web Bot
🇮🇩
Burayot
2025-12-30 22:17:12
(5 months ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 45.3.33.147 (US/United States/-): 1 ...
show more
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 45.3.33.147 (US/United States/-): 1 in the last 3600 secs
show less
Web App Attack
🇫🇷
Jean Valjean
2025-12-30 18:45:14
(5 months ago)
Fail2ban Caboom : xmlrpc.php Abuse
SQL Injection
Web App Attack
🇺🇸
TPI-Abuse
2025-12-30 10:59:30
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.33.147 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.33.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 30 05:59:22.376884 2025] [security2:error] [pid 22191:tid 22191] [client 45.3.33.147:53955] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.aliciagrant.com"] [uri "/.env"] [unique_id "aVOwik1Vv7PN0yxYrRK8tgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-12-30 06:06:02
(5 months ago)
Trying to access config files
Web App Attack
🇺🇸
TPI-Abuse
2025-12-29 06:24:58
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 45.3.33.147 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.3.33.147 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 01:24:45.285613 2025] [security2:error] [pid 1281972:tid 1281972] [client 45.3.33.147:29137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mirandateamevents.com"] [uri "/.git/HEAD"] [unique_id "aVIerU4oa2uC7OOLN5MkoAAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-12-29 05:06:05
(5 months ago)
Trying to access config files
Web App Attack
2025-12-20 20:00:15
(5 months ago)
Botnet activity detected: Horizontal with multiple indicators, Coordinated non-service scan, Wide ho ...
show more
Botnet activity detected: Horizontal with multiple indicators, Coordinated non-service scan, Wide horizontal scanner, Horizontal scan with SYN retry, Slow horizontal with regular pattern, Horizontal scanner on non-service ports, Coordinated attack participant, Multiple non-service patterns, Multiple scan indicators, Confirmed scanner identified (+2 more). Total 168 blocks.
show less
DDoS Attack
Port Scan
Hacking
2025-12-19 14:42:42
(5 months ago)
botnet
DDoS Attack