🇺🇸
TPI-Abuse
2026-06-13 22:41:05
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 47.79.199.54 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 47.79.199.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jun 13 18:40:58.646799 2026] [security2:error] [pid 4787:tid 4787] [client 47.79.199.54:28552] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.civilwarzone.com|F|2"] [data ".dll"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.civilwarzone.com"] [uri "/~site/Scripts_ExternalRedirect/ExternalRedirect.dll"] [unique_id "ai3cesqi3v8MBIzI5fqzvwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
MusicLibrary
2026-05-14 13:34:20
(1 month ago)
Apache HTTP Authentication failed (Brute Force)
Brute-Force
Web App Attack
🇫🇷
Sklurk
2026-05-05 06:32:44
(1 month ago)
Web App Attack
Web App Attack
🇺🇸
gui-ying233
2026-04-29 02:07:27
(1 month ago)
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/53 ...
show more
Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-04-06 06:06:08
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 47.79.199.54 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 47.79.199.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 06 02:06:02.041018 2026] [security2:error] [pid 5374:tid 5391] [client 47.79.199.54:25854] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||aafm.us|F|2"] [data ".prodemyasia.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "aafm.us"] [uri "/www.prodemyasia.com"] [unique_id "adNNSq2x_Bcy-K5pZy7CqAAAAA8"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-04 03:55:54
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 47.79.199.54 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 47.79.199.54 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 03 23:55:49.051697 2026] [security2:error] [pid 9798:tid 9798] [client 47.79.199.54:44652] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.beirutbazar.com|F|2"] [data ".beirutbazar.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.beirutbazar.com"] [uri "/tags/dinnerware/www.beirutbazar.com"] [unique_id "adCLxRiA6ByEpthDmJuuNAAAAAI"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
ersei.net
2026-01-15 20:11:43
(5 months ago)
Nonstop scanning with no cooldown or respect for 429.
Bad Web Bot
🇮🇹
VHosting
2026-01-08 11:36:17
(5 months ago)
Detected attack and reported by a human
DDoS Attack
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
🇺🇸
kosada.com
2026-01-05 07:05:20
(5 months ago)
Web bot: DDoS
DDoS Attack
Bad Web Bot
🇺🇸
kosada.com
2025-12-26 17:05:50
(5 months ago)
Web bot: DDoS
DDoS Attack
Bad Web Bot
🇺🇸
ersei.net
2025-12-14 07:23:19
(6 months ago)
Nonstop scanning with no cooldown or respect for 429.
Bad Web Bot
🇨🇦
1gz
2025-12-13 01:32:45
(6 months ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET metho ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/aksident-rrugor
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/132.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2025-12-09 17:04:22
(6 months ago)
Web attack
Bad Web Bot
Web App Attack
🇺🇸
ersei.net
2025-12-07 21:41:44
(6 months ago)
Nonstop scanning with no cooldown or respect for 429.
Bad Web Bot
🇦🇺
MAGIC
2025-12-07 02:08:43
(6 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot