🇬🇧
pinguin
2025-10-27 13:03:38
(7 months ago)
Triggered Cloudflare WAF (firewallManaged) from NL.
Action taken: LOG
Protocol: HTTP/2 (HEAD method) ...
show more
Triggered Cloudflare WAF (firewallManaged) from NL.
Action taken: LOG
Protocol: HTTP/2 (HEAD method)
Endpoint: /bak/www.rar
UA: Empty string
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇯🇵
Valhalla
2025-10-24 22:44:40
(7 months ago)
/restore/public_html.tar
Hacking
Web App Attack
🇺🇸
Penny Packer
2025-10-24 22:31:23
(7 months ago)
Fail2Ban apache-tripwires
Web App Attack
🇺🇸
TPI-Abuse
2025-10-20 16:09:13
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.185 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 20 12:09:06.391868 2025] [security2:error] [pid 27498:tid 28050] [client 98.159.226.185:63919] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||magazineofwallstreet.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "magazineofwallstreet.com"] [uri "/back/dump.sql"] [unique_id "aPZeojXCRQ_yK2vrkYAGgQAAAMo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
Block Rockin' Beats
2025-10-20 11:41:43
(7 months ago)
Scanning forum with forged referal
Hacking
Web App Attack
🇱🇻
garmtech.com
2025-10-19 16:17:09
(7 months ago)
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 19-17.98.159.226.185.web-spamm ...
show more
IM360 WAF: Block IP which is in the web-spammers RBL MV:RBL lookup of 19-17.98.159.226.185.web-spammers.v2.rbl.imunify.com._v4 succeeded.
show less
Web App Attack
🇦🇺
oncord
2025-10-18 17:31:49
(7 months ago)
Form spam
Web Spam
🇺🇸
dtorrer
2025-10-18 17:05:42
(7 months ago)
Client attempted to submit spam on a website post.
Blog Spam
🇺🇸
TPI-Abuse
2025-10-09 17:53:46
(7 months ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.185 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 09 13:53:36.920764 2025] [security2:error] [pid 1141:tid 1141] [client 98.159.226.185:28183] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.crypto-stamps.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.crypto-stamps.com"] [uri "/backup/dump.sql"] [unique_id "aOf2oGgK9NWdUnB5JKC7RwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
Valhalla
2025-10-07 20:28:46
(8 months ago)
/backup/backup.sql.tar
Hacking
Web App Attack
🇺🇸
Penny Packer
2025-10-01 16:06:44
(8 months ago)
Fail2Ban apache-tripwires
Web App Attack
🇺🇸
TPI-Abuse
2025-09-30 23:24:18
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.185 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 19:24:10.332704 2025] [security2:error] [pid 30237:tid 30237] [client 98.159.226.185:63879] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||headcount.dev|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "headcount.dev"] [uri "/back/mysql.sql"] [unique_id "aNxmmtea5dwQdCp9jE78qQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-30 10:50:27
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.185 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 30 06:50:18.868142 2025] [security2:error] [pid 12930:tid 12930] [client 98.159.226.185:34447] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||firejasstrio.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "firejasstrio.com"] [uri "/restore/dump.sql"] [unique_id "aNu16pZuHLljKN9W5j_cbAAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-28 00:42:20
(8 months ago)
(mod_security) mod_security (id:210492) triggered by 98.159.226.185 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 98.159.226.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 27 20:42:15.481042 2025] [security2:error] [pid 13524:tid 13524] [client 98.159.226.185:45577] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "oliverhardy.com"] [uri "/bak/sftp-config.json"] [unique_id "aNiEZ_rOghGjeoA7Qk-0RgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-27 04:34:17
(8 months ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.185 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.185 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 27 00:34:09.084859 2025] [security2:error] [pid 25232:tid 25232] [client 98.159.226.185:33849] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||krupaandsons.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "krupaandsons.com"] [uri "/backups/www.sql"] [unique_id "aNdpQZWgq1A9ZYjR4S2yfgAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack