🇩🇪
ManagedStack
2026-05-29 16:45:02
(1 week ago)
Probing access to unauthorized locations
Hacking
Exploited Host
Web App Attack
🇲🇾
Rizzy
2026-03-04 17:10:12
(3 months ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-02-09 19:30:30
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.37.122 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.37.122 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 14:30:23.428669 2026] [security2:error] [pid 5565:tid 5578] [client 104.207.37.122:21851] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gabegabel.com"] [uri "/frontend/.env"] [unique_id "aYo1zzlkrzGQpyYkm24VNgAAAQs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-09 18:57:58
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.37.122 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.37.122 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 13:57:51.884564 2026] [security2:error] [pid 15944:tid 15944] [client 104.207.37.122:12739] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fynyx.com"] [uri "/.env"] [unique_id "aYouL2U0IAno450bKGCZ4wAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-09 09:22:47
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.37.122 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.37.122 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Feb 09 04:22:37.417654 2026] [security2:error] [pid 19341:tid 19434] [client 104.207.37.122:35101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "g3-contracting.com"] [uri "/test/.git/config"] [unique_id "aYmnXUYsChRAU7ugYZ2u3AAAAQo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-09 02:10:25
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.37.122 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.37.122 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 08 21:10:19.486916 2026] [security2:error] [pid 21822:tid 21822] [client 104.207.37.122:44427] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ftwwx.com"] [uri "/.env.local"] [unique_id "aYlCC6njBt2BmPLuYMVJbgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-08 21:25:48
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 104.207.37.122 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.207.37.122 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 08 16:25:42.228870 2026] [security2:error] [pid 3785863:tid 3785863] [client 104.207.37.122:25843] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "furfriend-z.com"] [uri "/.env"] [unique_id "aYj_VtaXZHPIvyre5rO3wwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
HandyTreff.de
2026-01-06 05:34:48
(5 months ago)
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -30.706 (Bad < -10 / Very Bad < -20 ...
show more
Bot/Spam/Scrapper attack detected on www.handytreff.de - Score: -30.706 (Bad < -10 / Very Bad < -20 / Extreme < -35) | UA: Mozilla/5.0 (X11; Ubuntu; Linux i686; rv:114.0) Gecko/20100101 Firefox/114.0
show less
Bad Web Bot
Web App Attack
🇵🇱
sefinek.net
2025-12-22 21:25:34
(5 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /genshin-stella-mod
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 Vivaldi/5.3.2679.68
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2025-12-06 14:04:45
(6 months ago)
botnet
DDoS Attack
2025-12-02 11:49:02
(6 months ago)
botnet
DDoS Attack
2025-11-14 07:28:15
(6 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇨🇦
wil.com
2025-10-17 11:10:42
(7 months ago)
GlobalProtect login attempts with user edmontoya.
VPN IP
Brute-Force
2025-10-16 03:50:23
(7 months ago)
Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.16 is noted in report tim ...
show more
Attempted brute force login to web vpn 2 time(s); last attempt for 2025.10.16 is noted in report timestamp
show less
Hacking
Brute-Force
🇧🇷
hostseries
2025-10-12 05:13:10
(8 months ago)
Trigger: LF_DISTATTACK
Brute-Force