🇩🇪
FeG Deutschland
2026-10-12 08:52:33
(6 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇩🇪
FeG Deutschland
2026-10-09 18:09:55
(2 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇩🇪
FeG Deutschland
2026-10-08 03:17:03
(4 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇵🇱
Budyn
2026-10-06 16:18:52
(5 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Web Spam (Form Abuse). Unsolicite ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Web Spam (Form Abuse). Unsolicited bulk message (Form Spam) captured. Evidence:
HOST: goblinpot.tech | URI: /contact.php | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 | BODY: name=Emily+Johnson&company_website=&email=kfoster987%40yahoo.com&message=I+would+like+more+information.+Please+contact+me+by+email+%E2%80%94+enterprise+digital+solutions.
--- SPAM DATA ---
(From: [email protected] )
I would like more information. Please contact me by email — enterprise digital solutions.
show less
Web Spam
Web App Attack
🇧🇪
voormedia
2026-09-29 14:33:48
(1 week ago)
Accessed trap at '/wp-login.php'
Web App Attack
🇩🇪
todix
2026-09-29 13:25:53
(1 week ago)
Web App Attack Exploid from 66.56.86.241
Web App Attack
🇫🇷
AGEPCom
2026-09-05 00:39:57
(1 month ago)
Smart-Ban: IP bannie via score AbuseIPDB
Brute-Force
Web App Attack
🇬🇧
poundawebsiteltd
2026-03-14 22:57:01
(6 months ago)
Web App Attack (ModSecurity Block). Evidence: beanietools.dev:80 66.56.86.241 - - [14/Mar/2026:22:56 ...
show more
Web App Attack (ModSecurity Block). Evidence: beanietools.dev:80 66.56.86.241 - - [14/Mar/2026:22:56:59 +0000] HEAD /backup/backup.sql HTTP/1.1 403 124 - -
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-03-12 17:07:19
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 66.56.86.241 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 66.56.86.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 12 13:07:13.507416 2026] [security2:error] [pid 5948:tid 5948] [client 66.56.86.241:50163] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.crypto-stamps.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.crypto-stamps.com"] [uri "/www.sql"] [unique_id "abLywRCbBxgBeY0dcIi7UQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Penny Packer
2026-02-28 11:55:35
(7 months ago)
Fail2Ban apache-tripwires
Web App Attack
🇺🇸
TPI-Abuse
2026-02-24 08:40:25
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 66.56.86.241 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 66.56.86.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 24 03:40:18.830545 2026] [security2:error] [pid 26847:tid 26847] [client 66.56.86.241:48513] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||sailingcharterburma.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "sailingcharterburma.com"] [uri "/backups/www.sql"] [unique_id "aZ1j8j-8ocjrA7HiV4busAAAACA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
bescared
2026-02-14 19:28:59
(7 months ago)
F2B - Malicious activity detected. URL Probing.
Hacking
Bad Web Bot
Web App Attack
🇬🇧
pinguin
2026-02-14 01:15:22
(7 months ago)
Triggered Cloudflare WAF (firewallManaged) from SK.
Action taken: LOG
Protocol: HTTP/2 (HEAD method) ...
show more
Triggered Cloudflare WAF (firewallManaged) from SK.
Action taken: LOG
Protocol: HTTP/2 (HEAD method)
Endpoint: /back/index.zip
UA: Empty string
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-02-13 05:11:45
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 66.56.86.241 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 66.56.86.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Feb 13 00:11:41.905819 2026] [security2:error] [pid 27774:tid 27774] [client 66.56.86.241:63019] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||powderriverinc.com|F|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "powderriverinc.com"] [uri "/backups/wallet.dat"] [unique_id "aY6yjVYeB620s0h-irGG4gAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-12 15:16:31
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 66.56.86.241 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 66.56.86.241 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 12 10:16:24.846930 2026] [security2:error] [pid 10596:tid 10596] [client 66.56.86.241:33137] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||jussetcotradinglimited.co|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "jussetcotradinglimited.co"] [uri "/backups/www.sql"] [unique_id "aY3uyJ051NQxdzD35GyragAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
