2026-09-15 20:16:00
(1 month ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: IT, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-09-15 18:06:42
(1 month ago)
[ti-01ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 34.17.171.249 - - [12/Sep/2026:13:45:22 +0200] "GET /.git/config HTTP/1.1" 404 198327 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, lik ...
show more
[ti-01ov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 34.17.171.249 - - [12/Sep/2026:13:45:22 +0200] "GET /.git/config HTTP/1.1" 404 198327 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
netclix.gr
2026-09-15 03:55:02
(1 month ago)
(mod_security) mod_security triggered on hostname [redacted] 34.17.171.249 (IT/Italy/249.171.17.34.bc.googleusercontent.com): (CF_ENABLE)
SQL Injection
2026-09-14 20:15:30
(1 month ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: IT, Attack patterns: WordPress scanning, Backup file probing, Cloud secrets probing
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 19:45:08
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.17.171.249 (249.171.17.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 15:44:58.605687 2026] [security2:error] [pid 27435:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.17.171.249 (249.171.17.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 15:44:58.605687 2026] [security2:error] [pid 27435:tid 27435] [client 34.17.171.249:54132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "easternimport.com"] [uri "/.git/config"] [unique_id "aqhOujTjlFDXjIdyBnONcwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 17:15:25
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.17.171.249 (249.171.17.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 13:15:20.091211 2026] [security2:error] [pid 3056115:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 34.17.171.249 (249.171.17.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 13:15:20.091211 2026] [security2:error] [pid 3056115:tid 3056115] [client 34.17.171.249:60968] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eastbrooktech.com"] [uri "/.git/config"] [unique_id "aqgrqAg6K1LTLH832L8GOgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-09-14 16:20:15
(1 month ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-09-12 19:52:13
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.17.171.249 (249.171.17.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 15:52:09.967255 2026] [security2:error] [pid 1430:tid 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.17.171.249 (249.171.17.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 15:52:09.967255 2026] [security2:error] [pid 1430:tid 1430] [client 34.17.171.249:35980] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crazypencil.com"] [uri "/.git/config"] [unique_id "aqWtaQVDxxJNPHCE8Mn48AAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 19:06:16
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 34.17.171.249 (249.171.17.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 15:06:09.350028 2026] [security2:error] [pid 9017:tid 9 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.17.171.249 (249.171.17.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 15:06:09.350028 2026] [security2:error] [pid 9017:tid 9017] [client 34.17.171.249:52896] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "crazycoin.net"] [uri "/.git/config"] [unique_id "aqWioeTaYnuQxFas1S4NdgAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-09-12 16:45:03
(1 month ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇫🇷
mrcrassi
2026-09-12 15:53:09
(1 month ago)
Triggered Cloudflare WAF (firewallManaged) from IT.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
This repor ...
show more
Triggered Cloudflare WAF (firewallManaged) from IT.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇧🇪
cmbplf
2026-09-12 14:44:41
(1 month ago)
8.556 requests with url.path *.env
1.429 requests with url.path *phpinfo.php
229 requests with url.path *credentials.json
Brute-Force
Bad Web Bot
🇩🇪
4server
2026-09-12 14:22:48
(1 month ago)
[SatSep1216:22:43.9725072026][security2:error][pid3307780:tid3307798][client34.17.171.249:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\} ...
show more
[SatSep1216:22:43.9725072026][security2:error][pid3307780:tid3307798][client34.17.171.249:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"craniosacraltherapy.ch\"][uri\"/cgi-sys/suspendedpage.cgi\"][unique_id\"aqVgM-3L1GpW7FhJLzd2Q
show less
Port Scan
Brute-Force
Web App Attack
🇧🇷
Halux
2026-09-12 14:10:14
(1 month ago)
34.17.171.249 Probing protected path or service
Web App Attack
2026-09-12 13:28:37
(1 month ago)
Web probing (512 hits in 24h) on default-vhost: sensitive-path scans and/or 404 bursts. Reported by CRMON.
Web App Attack
