🇫🇮
kumiko
2026-11-02 04:36:48
UTC ·
(1 week ago)
[2026-11-02 06:36:48] Known bad bot [Mozilla/5.0 (Linux; U; Android 8.0.0; zh-cn; MIX 2 Build/OPR1.170623.027) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.132 MQQBrowser/8.7 Mobile Safari/537.36]
Bad Web Bot
Web App Attack
🇫🇷
ecodehost.com
2026-11-01 23:47:04
UTC ·
(1 week ago)
Domain : secertarim.com.tr
Rule : Method-Head
2026-11-01 23:45:42 10.100.1.20 HEAD / - 80 - 119.91.58.74 HTTP/1.1 Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4X Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.132 ...
show more
Domain : secertarim.com.tr
Rule : Method-Head
2026-11-01 23:45:42 10.100.1.20 HEAD / - 80 - 119.91.58.74 HTTP/1.1 Mozilla/5.0 (Linux; Android 7.0; Redmi Note 4X Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.132 MQQBrowser/6.2 TBS/044207 Mobile Safari/537.36 MicroMessenger/6.7.2.1340(0x26070239) NetType/WIFI Language/zh_CN https://m.baidu.com/s?word=www.vzth.cn www.secertarim.com.tr 301 0 0 174 433 274 - -
show less
Port Scan
🇵🇱
sefinek.net
2026-11-01 22:17:57
UTC ·
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from CN.
Action: BLOCK | Protocol: HTTP/1.1 (HEAD) | Endpoint: / | UA: Mozilla/5.0 (Linux; Android 6.0; HUAWEI NXT-AL10 Build/HUAWEINXT-AL10) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/35.0.191 ...
show more
Triggered Cloudflare WAF (firewallCustom) from CN.
Action: BLOCK | Protocol: HTTP/1.1 (HEAD) | Endpoint: / | UA: Mozilla/5.0 (Linux; Android 6.0; HUAWEI NXT-AL10 Build/HUAWEINXT-AL10) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/35.0.1916.138 Mobile Safari/537.36 T7/7.4 baiduboxapp/8.4 (Baidu; P1 6.0) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
Mr-Money
2026-11-01 14:09:24
UTC ·
(1 week ago)
scenario: crowdsecurity/http-bad-user-agent - events: 2 - Mozilla/5.0 (Linux; Android 5.1.1; OPPO A33 Build/LMY47V) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/35.0.1916.138 Mobile Safari/537.36 T7/7.4 baiduboxapp/8.2.5 (Baidu; P1 5.1.1 ...
show more
scenario: crowdsecurity/http-bad-user-agent - events: 2 - Mozilla/5.0 (Linux; Android 5.1.1; OPPO A33 Build/LMY47V) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/35.0.1916.138 Mobile Safari/537.36 T7/7.4 baiduboxapp/8.2.5 (Baidu; P1 5.1.1)
show less
Web App Attack
Bad Web Bot
🇫🇷
security.rdmc.fr
2026-11-01 13:36:36
UTC ·
(1 week ago)
Activity from blacklisted IP
Hacking
🇺🇸
SX Communications
2026-11-01 11:16:32
UTC ·
(1 week ago)
HTTP application-layer DoS / botnet traffic from 119.91.58.74: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇫🇮
kumiko
2026-10-31 22:06:11
UTC ·
(1 week ago)
[2026-10-31 23:23:00] Persistent attack/probing over several days.
Port Scan
Brute-Force
Bad Web Bot
🇫🇮
kumiko
2026-10-31 21:02:58
UTC ·
(1 week ago)
[2026-10-31 23:02:57] Known bad bot [Mozilla/5.0 (Linux; Android 8.0; STF-AL00 Build/HUAWEISTF-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.132 MQQBrowser/6.2 TBS/044306 Mobile Safari/537.36 MicroMessenger/6.7.3.1360( ...
show more
[2026-10-31 23:02:57] Known bad bot [Mozilla/5.0 (Linux; Android 8.0; STF-AL00 Build/HUAWEISTF-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.132 MQQBrowser/6.2 TBS/044306 Mobile Safari/537.36 MicroMessenger/6.7.3.1360(0x26070336) NetType/WIFI Language/zh_CN Process/tools]
show less
Bad Web Bot
Web App Attack
🇫🇷
security.rdmc.fr
2026-10-31 11:02:11
UTC ·
(1 week ago)
Activity from blacklisted IP
Hacking
🇺🇸
cwytech
2026-10-31 10:05:48
UTC ·
(1 week ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/wordpress-geofence-sus.
Bad Web Bot
Web App Attack
🇺🇸
1gz
2026-10-31 05:35:05
UTC ·
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from CN.
Action taken: BLOCK
Protocol: HTTP/1.1 (HEAD method)
Endpoint: /
UA: Mozilla/5.0 (Linux; Android 10; HMA-AL00 Build/HUAWEIHMA-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0. ...
show more
Triggered Cloudflare WAF (firewallCustom) from CN.
Action taken: BLOCK
Protocol: HTTP/1.1 (HEAD method)
Endpoint: /
UA: Mozilla/5.0 (Linux; Android 10; HMA-AL00 Build/HUAWEIHMA-AL00; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/6.2 TBS/045118 Mobile Safari/537.36 MMWEBID/2568 MicroMessenger/7.0.11.1600(0x27000B32) Process/tools NetType/WIFI Language/zh_CN ABI/arm64
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-31 04:01:46
UTC ·
(1 week ago)
(mod_security) mod_security (id:210831) triggered by 119.91.58.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 00:01:41.997406 2026] [security2:error] [pid 32702:tid 32702] [client 119.91.58.74:60022] Mod ...
show more
(mod_security) mod_security (id:210831) triggered by 119.91.58.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 00:01:41.997406 2026] [security2:error] [pid 32702:tid 32702] [client 119.91.58.74:60022] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.folkdancers.org|F|4"] [data "User-Agent"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.folkdancers.org"] [uri "/"] [unique_id "auVoJUkSfLd45LpcelafXgAAAAM"], referer: https://m.baidu.com/s?word=www.vzth.cn
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-10-31 02:04:55
UTC ·
(1 week ago)
HTTP application-layer DoS / botnet traffic from 119.91.58.74: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇵🇱
sefinek.net
2026-10-31 01:25:56
UTC ·
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from CN.
Action: BLOCK | Protocol: HTTP/1.1 (HEAD) | Endpoint: / | UA: Mozilla/5.0 (Linux; Android 8.1.0; PBCM10 Build/OPM1.171019.011; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359. ...
show more
Triggered Cloudflare WAF (firewallCustom) from CN.
Action: BLOCK | Protocol: HTTP/1.1 (HEAD) | Endpoint: / | UA: Mozilla/5.0 (Linux; Android 8.1.0; PBCM10 Build/OPM1.171019.011; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/6.2 TBS/044904 Mobile Safari/537.36 V1_AND_SQ_8.1.8_1276_YYB_D QQ/8.1.8.4260 NetType/4G WebP/0.3.0 Pixel/1080 StatusBarHeight/80 SimpleUISwitch/0 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
1gz
2026-10-31 01:00:47
UTC ·
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from CN.
Action taken: BLOCK
Protocol: HTTP/1.1 (HEAD method)
Endpoint: /
UA: Mozilla/5.0 (Linux; U; Android 9; zh-cn; MI CC 9 Build/PKQ1.181121.001) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/ ...
show more
Triggered Cloudflare WAF (firewallCustom) from CN.
Action taken: BLOCK
Protocol: HTTP/1.1 (HEAD method)
Endpoint: /
UA: Mozilla/5.0 (Linux; U; Android 9; zh-cn; MI CC 9 Build/PKQ1.181121.001) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/66.0.3359.126 MQQBrowser/9.8 Mobile Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
