🇺🇸
CBJ
2026-08-25 13:34:35
(3 hours ago)
fail2ban: apache-filepath-recon
...
Web App Attack
🇫🇷
Little Iguana
2026-08-25 06:44:29
(10 hours ago)
Attempt to hack Wordpress Login, XMLRPC or other login
Hacking
🇧🇾
lns.bz
2026-08-25 03:55:11
(13 hours ago)
.env scanning [BY]
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 03:08:48
(14 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.131.163.128 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 104.131.163.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 23:08:44.822302 2026] [security2:error] [pid 7473:tid 7473] [client 104.131.163.128:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aslanhan.com"] [uri "/.env"] [unique_id "ao0HPJ4c9fcdoEh0CFtkDAAAADQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-24 23:44:07
(17 hours ago)
(mod_security) mod_security (id:949110) triggered by 104.131.163.128 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:949110) triggered by 104.131.163.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 19:44:00.815327 2026] [security2:error] [pid 28689:tid 28689] [client 104.131.163.128:38248] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "asegreen.com"] [uri "/.env"] [unique_id "aozXQKTWDLel-0xifrdIDwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
as211431.net
2026-08-24 21:53:38
(19 hours ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /_profiler/open
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-24 13:47:23
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 104.131.163.128 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 104.131.163.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 09:47:16.219156 2026] [security2:error] [pid 7871:tid 7871] [client 104.131.163.128:54586] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arklahomaflooring.com"] [uri "/.env"] [unique_id "aoxLZJEOqgNTWnHv0_ZeBgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
wordpresshosting.solutions
2026-08-24 13:33:54
(1 day ago)
Web app vulnerability scanning detected. Evidence: 104.131.163.128 - - [24/Aug/2026:13:33:52 +0000] ...
show more
Web app vulnerability scanning detected. Evidence: 104.131.163.128 - - [24/Aug/2026:13:33:52 +0000] "GET /.env HTTP/1.1" 404 6547 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
104.131.163.128 - - [24/Aug/2026:13:33:54 +0000] "GET /_profiler/phpinfo HTTP/1.1" 404 6547 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
show less
Web App Attack
🇷🇺
DZBOT
2026-08-24 10:50:20
(1 day ago)
DZBOT: Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-08-24 08:02:18
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 104.131.163.128 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 104.131.163.128 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 24 04:02:10.403445 2026] [security2:error] [pid 22791:tid 22791] [client 104.131.163.128:52798] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "arcdesign.me"] [uri "/.env"] [unique_id "aov6gi1yUzZKDi5ywufZ7gAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-08-24 07:39:07
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
2026-08-23 23:37:40
(1 day ago)
104.131.163.128 - - [23/Aug/2026:23:37:40 +0000] "GET /.env HTTP/1.1" 404 7901 "-" "Mozilla/5.0 (Win ...
show more
104.131.163.128 - - [23/Aug/2026:23:37:40 +0000] "GET /.env HTTP/1.1" 404 7901 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36"
...
show less
Brute-Force
Web App Attack
🇳🇱
homeshowdomain.nl
2026-08-23 21:59:53
(1 day ago)
Auto-ban: >3000 req/min op 2026-08-23
Web App Attack
SSH
Hacking
🇺🇸
LotPhantom
2026-08-23 21:48:16
(1 day ago)
2026/08/23 21:48:15 [error] 478389#478389: *35457 access forbidden by rule, client: 104.131.163.128, ...
show more
2026/08/23 21:48:15 [error] 478389#478389: *35457 access forbidden by rule, client: 104.131.163.128, server: api.bridginggaps.tech, request: "GET /.env HTTP/1.1", host: "api.bridginggaps.tech"
...
show less
Web App Attack
🇩🇪
FeG Deutschland
2026-08-23 15:08:35
(2 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack