2025-10-30 06:48:14
(11 months ago)
IM360 WAF: Laravel .env file access
Web App Attack
🇬🇧
pinguin
2025-10-27 13:03:38
(11 months ago)
Triggered Cloudflare WAF (firewallManaged) from NL.
Action taken: LOG
Protocol: HTTP/1.1 (HEAD metho ...
show more
Triggered Cloudflare WAF (firewallManaged) from NL.
Action taken: LOG
Protocol: HTTP/1.1 (HEAD method)
Endpoint: /restore/backup.tar
UA: Empty string
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇯🇵
Valhalla
2025-10-24 22:44:50
(11 months ago)
/back/config.json
Hacking
Web App Attack
🇺🇸
Samekhi
2025-10-24 17:10:12
(1 year ago)
Comment Spammer.
Web Spam
Blog Spam
🇺🇸
TPI-Abuse
2025-10-23 22:28:40
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.190 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 23 18:28:35.225205 2025] [security2:error] [pid 9177:tid 9195] [client 98.159.226.190:26193] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||nobletitles.org|F|2"] [data ".dat"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "nobletitles.org"] [uri "/old/wallet.dat"] [unique_id "aPqsE1x_Wc5wgaNMcm7LfAAAAUY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
Block Rockin' Beats
2025-10-20 11:51:18
(1 year ago)
Scanning forum with forged referal
Hacking
Web App Attack
🇺🇸
cyfordtechnologies.com
2025-10-18 16:47:48
(1 year ago)
Rate limit exceeded : Reported by Cyford API
DDoS Attack
🇦🇺
oncord
2025-10-18 16:25:48
(1 year ago)
Form spam
Web Spam
🇺🇸
TPI-Abuse
2025-10-12 19:25:57
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.190 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 12 15:25:50.710967 2025] [security2:error] [pid 31582:tid 31582] [client 98.159.226.190:62799] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mapleleaf-marketing.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mapleleaf-marketing.com"] [uri "/mysql.sql"] [unique_id "aOwAvk5SWQO73p-Q28qXcgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-11 06:50:04
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.190 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 11 02:49:54.552467 2025] [security2:error] [pid 6961:tid 6961] [client 98.159.226.190:39369] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||usbea.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "usbea.com"] [uri "/backup/dump.sql"] [unique_id "aOn-EuYf_ubVVsT-8mBU4wAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-10 08:47:13
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.190 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 10 04:47:06.271792 2025] [security2:error] [pid 8341:tid 8341] [client 98.159.226.190:49165] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mrepoch.art|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mrepoch.art"] [uri "/bak/www.sql"] [unique_id "aOjICpgBgj1Wmp6YRTyM1QAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-09 17:53:45
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.190 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 09 13:53:37.297302 2025] [security2:error] [pid 4641:tid 4641] [client 98.159.226.190:36595] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.crypto-stamps.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.crypto-stamps.com"] [uri "/old/mysql.sql"] [unique_id "aOf2oRSro2FMjIUHRP5aFgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
Valhalla
2025-10-07 20:28:52
(1 year ago)
/back/Archive.zip
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-10-01 15:34:26
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 98.159.226.190 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 98.159.226.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 01 11:34:21.841276 2025] [security2:error] [pid 10959:tid 10959] [client 98.159.226.190:50043] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "otrantocapital.com"] [uri "/sftp-config.json"] [unique_id "aN1J_Y-vfDLAGyC5w-UrEAAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-01 04:24:06
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 98.159.226.190 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 98.159.226.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 01 00:24:00.550674 2025] [security2:error] [pid 12164:tid 12164] [client 98.159.226.190:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kryptonome.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kryptonome.com"] [uri "/backups/backup.sql"] [unique_id "aNys4NCMlNY82gurSt-uFQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack