🇵🇱
sefinek.net
2026-04-09 09:31:45
(2 months ago)
Triggered Cloudflare WAF (firewallCustom) from NL.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (G ...
show more
Triggered Cloudflare WAF (firewallCustom) from NL.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (GET) | Endpoint: //vendor/phpunit/phpunit/phpunit.xsd | UA: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇬🇧
Aetherweb Ark
2026-04-09 08:40:43
(2 months ago)
(mod_security) mod_security (id:949110) triggered by 74.234.248.60 (-): N in the last X secs
Web App Attack
🇺🇸
Starburst SysOp Team
2026-04-09 03:17:47
(2 months ago)
(mod_security-custom) mod_security (id:210730) triggered by 74.234.248.60 (NL/The Netherlands/North ...
show more
(mod_security-custom) mod_security (id:210730) triggered by 74.234.248.60 (NL/The Netherlands/North Holland/Amsterdam/-/[AS8075 MICROSOFT-CORP-MSN-AS-BLOCK]): 1 in the last 3600 secs (0-srv1)
show less
Hacking
🇺🇸
TPI-Abuse
2026-04-09 01:21:03
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 74.234.248.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 74.234.248.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 21:20:57.315020 2026] [security2:error] [pid 4144568:tid 4144568] [client 74.234.248.60:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||chaitanyaconsult.in|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "chaitanyaconsult.in"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "adb--cRmYZnA0VTnPWM9JQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-09 00:10:38
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 74.234.248.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 74.234.248.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 20:10:30.624051 2026] [security2:error] [pid 2865168:tid 2865168] [client 74.234.248.60:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||southernbroadcast.com|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "southernbroadcast.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "adbudtkiJVumCyaPFYMgQwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-08 23:52:25
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 74.234.248.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 74.234.248.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 19:52:18.811680 2026] [security2:error] [pid 2820205:tid 2820205] [client 74.234.248.60:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mail-pmg.com|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail-pmg.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "adbqMk-b8Bx2cA1JFvOoVQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
as211431.net
2026-04-08 23:22:39
(2 months ago)
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: //vendor/phpunit/phpunit/phpunit.xsd
UA: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇸🇪
EmK530
2026-04-08 18:04:48
(2 months ago)
URL flagged by RegEx: /vendor/phpunit/phpunit/phpunit.xsd
Web App Attack
🇳🇱
dinaco
2026-04-08 14:17:28
(2 months ago)
74.234.248.60 - - [08/Apr/2026:14:17:27 +0000] "GET //vendor/phpunit/phpunit/phpunit.xsd HTTP/1.1" 5 ...
show more
74.234.248.60 - - [08/Apr/2026:14:17:27 +0000] "GET //vendor/phpunit/phpunit/phpunit.xsd HTTP/1.1" 502 52 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0"
...
show less
Hacking
Web App Attack
🇨🇦
Anytech
2026-04-08 09:08:55
(2 months ago)
Blocked by Conn-Monitor: Web scanning activity
Hacking
Web App Attack
🇧🇪
taivas.nl
2026-04-08 08:32:10
(2 months ago)
Site scraper
Web App Attack
🇺🇸
TPI-Abuse
2026-04-08 07:50:37
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 74.234.248.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 74.234.248.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 03:50:31.973446 2026] [security2:error] [pid 1987400:tid 1987400] [client 74.234.248.60:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||uwsvita.org|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "uwsvita.org"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "adYIx1ld4r9Qv-F3MhHy6AAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-08 06:41:32
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 74.234.248.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 74.234.248.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 02:41:28.608913 2026] [security2:error] [pid 2236129:tid 2236129] [client 74.234.248.60:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||eddysgroup.com|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "eddysgroup.com"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "adX4mOx_quFxve5SEGDviwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-08 06:16:35
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 74.234.248.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 74.234.248.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 02:16:31.153377 2026] [security2:error] [pid 1932821:tid 1932821] [client 74.234.248.60:58770] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||scc1.us|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "scc1.us"] [uri "/scc1/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "adXyv2NZUHCQE-zBHRTcFAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-08 05:48:31
(2 months ago)
(mod_security) mod_security (id:210730) triggered by 74.234.248.60 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 74.234.248.60 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 08 01:48:24.196230 2026] [security2:error] [pid 1895084:tid 1895084] [client 74.234.248.60:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ruralcommunitycare.org|F|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ruralcommunitycare.org"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "adXsKDkjkm9qyKrOi6TEzQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack