🇺🇸
X Y
2026-08-29 06:03:00
(1 month ago)
httpd-access.log.0:136.107.207.71 - - [28/Aug/2026:05:59:24 -0700] "GET /crusader-404-probe HTTP/1.1 ...
show more
httpd-access.log.0:136.107.207.71 - - [28/Aug/2026:05:59:24 -0700] "GET /crusader-404-probe HTTP/1.1" 404 - "-" "crusader-worker/1.0"
httpd-access.log.0:136.107.207.71 - - [28/Aug/2026:05:59:24 -0700] "GET /actuator/configprops HTTP/1.1" 404 - "-" "crusader-worker/1.0"
httpd-access.log.0:136.107.207.71 - - [28/Aug/2026:05:59:24 -0700] "GET /env HTTP/1.1" 404 - "-" "crusader-worker/1.0"
httpd-access.log.0:136.107.207.71 - - [28/Aug/2026:05:59:25 -0700] "GET /.env.prod HTTP/1.1" 429 267 "-" "crusader-worker/1.0"
httpd-access.log.0:136.107.207.71 - - [28/Aug/2026:05:59:25 -0700] "GET /.env.dev HTTP/1.1" 429 267 "-" "crusader-worker/1.0"
httpd-access.log.0:136.107.207.71 - - [28/Aug/2026:05:59:25 -0700] "GET /actuator/env HTTP/1.1" 429 267 "-" "crusader-worker/1.0"
show less
Bad Web Bot
Web App Attack
Hacking
🇳🇱
homeshowdomain.nl
2026-08-28 22:01:16
(1 month ago)
Auto-ban: >3000 req/min op 2026-08-28
Web App Attack
SSH
Hacking
🇵🇱
Budyn
2026-08-28 17:28:39
(1 month ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cdn.budyn.wtf | URI: /actuator/env | UA: crusader-worker/1.0 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
2026-08-28 16:31:33
(1 month ago)
Blocked by siteaihub.com: auto: matched exact:/.env
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-28 16:16:44
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.107.207.71 (71.207.107.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.107.207.71 (71.207.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 12:16:38.642374 2026] [security2:error] [pid 32235:tid 32235] [client 136.107.207.71:33486] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "casagrotto.com"] [uri "/.env.example"] [unique_id "apG0ZnyE-lxT1B42aORp3gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
IVski.com
2026-08-28 15:53:01
(1 month ago)
IVski WAF | Sensitive file probe - looking for exposed .env.prod
Hacking
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 15:15:55
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.107.207.71 (71.207.107.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.107.207.71 (71.207.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 11:15:48.536488 2026] [security2:error] [pid 6952:tid 6952] [client 136.107.207.71:41856] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thecorinthians.info.bahamascruisersguide.com"] [uri "/.env.local"] [unique_id "apGmJALz5RBxpXVqj7aMDAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
pinguin
2026-08-28 15:10:33
(1 month ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: LOG
Protocol: HTTP/1.1 (GET method ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: LOG
Protocol: HTTP/1.1 (GET method)
Endpoint: /wp-config.php.swp
UA: crusader-worker/1.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-28 14:43:12
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.107.207.71 (71.207.107.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.107.207.71 (71.207.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 10:43:06.000435 2026] [security2:error] [pid 393:tid 393] [client 136.107.207.71:51574] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nematoads.com"] [uri "/.env.example"] [unique_id "apGeetzIoTCgwlg2VP5mTwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-08-28 13:37:39
(1 month ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 136.107.207.71 (US/United States/71.2 ...
show more
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 136.107.207.71 (US/United States/71.207.107.136.bc.googleusercontent.com): 1 in the last 3600 secs (0-195)
show less
Hacking
🇬🇧
consul.to
2026-08-28 13:23:14
(1 month ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇷
masterguru
2026-08-28 13:17:32
(1 month ago)
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .b ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-193)
show less
Hacking
🇺🇸
mnsf
2026-08-28 13:06:24
(1 month ago)
Scanning/Probing (20)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 12:59:31
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.107.207.71 (71.207.107.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.107.207.71 (71.207.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 08:59:24.204802 2026] [security2:error] [pid 25667:tid 25667] [client 136.107.207.71:37352] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "losbarbarosdelnorte.com"] [uri "/wp-config.php~"] [unique_id "apGGLNuCa1mKjacRkc7E8QAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-28 12:38:58
(1 month ago)
(mod_security) mod_security (id:210492) triggered by 136.107.207.71 (71.207.107.136.bc.googleusercon ...
show more
(mod_security) mod_security (id:210492) triggered by 136.107.207.71 (71.207.107.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 08:38:50.888840 2026] [security2:error] [pid 7868:tid 7868] [client 136.107.207.71:36764] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "iacarbonell.com"] [uri "/.env"] [unique_id "apGBWiWD0UYA6y0MlvOPBwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
