🇮🇳
evicky2002
2026-04-29 18:28:29
(1 month ago)
Confirmed malicious by STILWaters CTI (score=100)
Hacking
Brute-Force
SSH
🇫🇮
nNordic
2026-04-26 09:27:02
(1 month ago)
Connection attempt blocked by IDS/IPS from 91.215.85.43/32
Hacking
🇩🇪
Holger
2026-03-30 10:57:45
(2 months ago)
WordPress WebAttack
Brute-Force
Web App Attack
🇪🇸
Gem
2026-03-27 23:27:08
(2 months ago)
Unauthorized web scan.
Web App Attack
🇩🇪
Holger
2026-03-27 10:21:52
(2 months ago)
WordPress WebAttack
Brute-Force
Web App Attack
🇺🇸
Epimetheus
2026-03-27 10:00:34
(2 months ago)
Zombie network / Bot scanner detected:
[GET] //static.cloudflareinsights.com/beacon.min.js
[GET] // ...
show more
Zombie network / Bot scanner detected:
[GET] //static.cloudflareinsights.com/beacon.min.js
[GET] //static.cloudflareinsights.com/beacon.min.js
[GET] //static.cloudflareinsights.com/beacon.min.js
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Safari/537.36
show less
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
Starburst SysOp Team
2026-03-27 08:08:24
(2 months ago)
(mod_security-custom) mod_security (id:210831) triggered by 91.215.85.43 (RU/Russia/Moscow/Moscow/-/ ...
show more
(mod_security-custom) mod_security (id:210831) triggered by 91.215.85.43 (RU/Russia/Moscow/Moscow/-/[AS200593 PROSPERO-AS]): 1 in the last 3600 secs (0-srv1)
show less
Hacking
🇷🇺
Mga Admin
2026-03-27 08:04:46
(2 months ago)
91.215.85.43 - - [27/Mar/2026:15:04:44 +0700] "GET //cdn.clustrmaps.com/map_v2.js HTTP/1.1" 404 196 ...
show more
91.215.85.43 - - [27/Mar/2026:15:04:44 +0700] "GET //cdn.clustrmaps.com/map_v2.js HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Linux; Android 8.1.0; Redmi 6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/71.0.3578.99 Mobile Safari/537.36"
...
show less
Web App Attack
2026-03-27 07:33:49
(2 months ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇷🇸
Smel
2026-03-27 06:52:06
(2 months ago)
HTTP/80/443/8080 Unauthorized Probe, Hack -
Hacking
Web App Attack
🇳🇴
tmiland
2026-03-27 06:51:22
(2 months ago)
(wordpress_xmlrpc) WordPress XMLPRC Attack 91.215.85.43 (RU/Russia/-): 3 in the last 3600 secs
Brute-Force
Blog Spam
Web App Attack
🇨🇦
1gz
2026-03-27 06:24:29
(2 months ago)
Triggered Cloudflare WAF (firewallCustom) from RU.
Action taken: CHALLENGE
Protocol: HTTP/1.1 (GET m ...
show more
Triggered Cloudflare WAF (firewallCustom) from RU.
Action taken: CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: //static.cloudflareinsights.com/beacon.min.js
UA: Mozilla/5.0 (Windows NT 5.2; rv:10.0.1) Gecko/20100101 Firefox/10.0.1 SeaMonkey/2.7.1
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-03-27 06:19:51
(2 months ago)
(mod_security) mod_security (id:210831) triggered by 91.215.85.43 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210831) triggered by 91.215.85.43 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 27 02:19:44.486100 2026] [security2:error] [pid 10517:tid 10517] [client 91.215.85.43:0] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||mail.pixacast.com|F|4"] [data "Web Downloader"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "mail.pixacast.com"] [uri "/www.pixacast.com/xmlrpc.php"] [unique_id "acYhgJdM9XJB_fwWTQSHkQAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
David Koswari
2026-03-27 06:01:00
(2 months ago)
REQ_BLOCKED_ACL
DDoS Attack
FTP Brute-Force
Ping of Death
Port Scan
Hacking
SQL Injection
Spoofing
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
SSH
IoT Targeted
🇭🇺
kranem
2026-03-27 06:00:23
(2 months ago)
Triggered Cloudflare WAF from RU.
Action taken: BLOCK
ASN: 200593 (PROSPERO-AS)
Protocol: HTTP/1.1 ( ...
show more
Triggered Cloudflare WAF from RU.
Action taken: BLOCK
ASN: 200593 (PROSPERO-AS)
Protocol: HTTP/1.1 (GET method)
Endpoint: //static.cloudflareinsights.com/beacon.min.js
Timestamp: 2026-03-27T05:24:37Z
User-Agent: Mozilla/5.0 (Linux; Android 7.1.2; Pixel Build/NHG47N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.83 Mobile Safari/537.36
show less
Bad Web Bot