🇺🇸
kosada.com
2026-06-02 22:55:35
(3 days ago)
Web password guessing
Brute-Force
🇧🇪
cmbplf
2026-05-03 22:35:28
(1 month ago)
1.817 requests with url.path //xmlrpc.php
Brute-Force
Bad Web Bot
🇦🇺
RedBear IT
2026-03-26 10:00:37
(2 months ago)
"DDoS against public endpoint"
DDoS Attack
🇫🇷
mrcrassi
2025-12-17 23:01:32
(5 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST meth ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
Packets-Decreaser.NET
2025-11-30 13:09:55
(6 months ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
🇺🇸
TPI-Abuse
2025-11-27 21:49:04
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.5.8 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.5.8 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 16:48:59.501375 2025] [security2:error] [pid 12413:tid 12413] [client 65.111.5.8:46497] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gasoilliquidsdaily.com"] [uri "/.svn/wc.db"] [unique_id "aSjHS6ZDheBCyAYALesrHwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 07:14:47
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.5.8 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.5.8 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:14:32.064210 2025] [security2:error] [pid 968:tid 968] [client 65.111.5.8:38467] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.whswarrior.com"] [uri "/.env"] [unique_id "aSQF2JYGcNiffjQ1T11iiwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 06:02:38
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.5.8 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.5.8 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 01:02:28.368003 2025] [security2:error] [pid 495:tid 495] [client 65.111.5.8:45039] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.debhill.com"] [uri "/.svn/wc.db"] [unique_id "aSP09O2nom3KRAupJFsBrAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-24 04:50:27
(6 months ago)
65.111.5.8 - - [24/Nov/2025:04:50:26 +0000] "GET /.env HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows N ...
show more
65.111.5.8 - - [24/Nov/2025:04:50:26 +0000] "GET /.env HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 04:07:27
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 65.111.5.8 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 65.111.5.8 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 23 23:07:20.803929 2025] [security2:error] [pid 18325:tid 18340] [client 65.111.5.8:25487] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.3sacloud.potashbarn.com"] [uri "/.svn/wc.db"] [unique_id "aSPZ-LibCkDUtlE56PAYbQAAAE0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-14 09:17:51
(6 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇨🇦
wil.com
2025-10-18 04:01:26
(7 months ago)
GlobalProtect login attempts with user bpargas.
VPN IP
Brute-Force
2025-10-17 21:02:33
(7 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
2025-10-17 06:17:07
(7 months ago)
Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.17 is noted in report tim ...
show more
Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.17 is noted in report timestamp
show less
Hacking
Brute-Force
2025-10-13 21:30:13
(7 months ago)
Dictionary attack on Palo Alto GlobalProtect VPN portal (port 443) detected via repeated login failu ...
show more
Dictionary attack on Palo Alto GlobalProtect VPN portal (port 443) detected via repeated login failures with varying usernames.
show less
Brute-Force