🇦🇺
paulshipley.com.au
2026-10-10 07:36:49
(1 hour ago)
[Sat Oct 10 18:36:48.367329 2026] [security2:error] [pid 727200] [client 144.172.98.192:39502] [clie ...
show more
[Sat Oct 10 18:36:48.367329 2026] [security2:error] [pid 727200] [client 144.172.98.192:39502] [client 144.172.98.192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dlcarterauthor.com"] [uri "/.git/config"] [unique_id "asnrELalgF7cUe3imffzCQAAABI"]
...
show less
Web App Attack
🇺🇸
CollideTech
2026-10-10 07:35:48
(1 hour ago)
probing for vulnerabilities
Web App Attack
🇳🇱
debestelapp
2026-10-10 07:14:39
(1 hour ago)
Web App Attack
🇫🇮
as211431.net
2026-10-10 07:13:52
(2 hours ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET metho ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /.git/config
UA: Mozilla/5.0 (X11; Linux x86_64)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇦🇺
paulshipley.com.au
2026-10-10 07:07:59
(2 hours ago)
[Sat Oct 10 18:07:58.915125 2026] [security2:error] [pid 757069] [client 144.172.98.192:39782] [clie ...
show more
[Sat Oct 10 18:07:58.915125 2026] [security2:error] [pid 757069] [client 144.172.98.192:39782] [client 144.172.98.192] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dance4fitness.com.au"] [uri "/.git/config"] [unique_id "asnkTn58vEW1ohlROQ2U0gAAAA8"]
...
show less
Web App Attack
🇮🇹
sentinel1
2026-10-10 07:01:54
(2 hours ago)
Sentinel: [Credential scan] status=302 [GET] cyberchords.nexus-orbital.com/.git/config -> 302
Web App Attack
🇩🇪
ut-addicted.com
2026-10-10 06:57:57
(2 hours ago)
\[Sat Oct 10 08:57:55.934900 2026\] \[:error\] \[pid 17611:tid 140352472160000\] \[client 144.172.98 ...
show more
\[Sat Oct 10 08:57:55.934900 2026\] \[:error\] \[pid 17611:tid 140352472160000\] \[client 144.172.98.192:52082\] \[client 144.172.98.192\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 5\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "crx.it"\] \[uri "/.git/config"\] \[unique_id "asnh8zGVXk1ns04Dx4AHRwAAAM8"\]
show less
Brute-Force
Web App Attack
🇩🇪
Vegascosmetics
2026-10-10 06:28:16
(2 hours ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after sensitive config/credentials exposure ...
show more
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after sensitive config/credentials exposure probe. Evidence: AttackPattern: /\.git (Match: /.git)
show less
Hacking
Brute-Force
Web App Attack
🇩🇪
paissangroup
2026-10-10 06:18:14
(2 hours ago)
Multiple WAF Violations
Web App Attack
🇷🇴
iulianh
2026-10-10 06:11:55
(3 hours ago)
80,443
Brute-Force
SSH
🇫🇷
arsonist
2026-10-10 06:06:19
(3 hours ago)
[fail2ban]
2026-10-10T06:06:18.460526+00:00 arson caddy[1712]: {"level":"info","ts":1791612378.46050 ...
show more
[fail2ban]
2026-10-10T06:06:18.460526+00:00 arson caddy[1712]: {"level":"info","ts":1791612378.4605033,"logger":"http.log.access.default","msg":"handled request","request":{"remote_ip":"144.172.98.192","remote_port":"33970","client_ip":"144.172.98.192","proto":"HTTP/1.1","method":"GET","host":"cloud.aos.lol","uri":"/.git/config","headers":{"User-Agent":["Mozilla/5.0 (X11; Linux x86_64)"],"Accept-Encoding":["gzip"],"Connection":["close"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"","server_name":"cloud.aos.lol","ech":false}},"bytes_read":0,"user_id":"","duration":0.000055584,"size":7,"status":418,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Content-Type":["text/plain; charset=utf-8"]}}
...
show less
Bad Web Bot
🇬🇧
rakkor
2026-10-10 05:42:00
(3 hours ago)
2026/10/10 05:23:23 [error] 22266#22266: *10536832 open() "/usr/syno/synoman/.git/config" failed (2: ...
show more
2026/10/10 05:23:23 [error] 22266#22266: *10536832 open() "/usr/syno/synoman/.git/config" failed (2: No such file or directory), client: 144.172.98.192, server: audio.rakkor.uk, request: "GET /.git/config HTTP/1.1", host: "audio.rakkor.uk"
2026/10/10 06:41:58 [error] 22266#22266: *10539304 open() "/usr/syno/synoman/.git/config" failed (2: No such file or directory), client: 144.172.98.192, server: cam.rakkor.uk, request: "GET /.git/config HTTP/1.1", host: "cam.rakkor.uk"
...
show less
Brute-Force
Hacking
Web App Attack
🇳🇱
Alt255
2026-10-10 05:35:14
(3 hours ago)
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 144 ...
show more
[ti-14al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 144.172.98.192 - - \[10/Oct/2026:07:35:04 +0200\] "GET /.git/config HTTP/1.1" 404 5647 "-" "Mozilla/5.0 \(X11\; Linux x86_64\)"
...
show less
Bad Web Bot
Web App Attack
2026-10-10 05:33:29
(3 hours ago)
144.172.98.192 - - [10/Oct/2026:07:33:29 +0200] "GET /.git/config HTTP/1.1" 404 5423 "-" "Mozilla/5. ...
show more
144.172.98.192 - - [10/Oct/2026:07:33:29 +0200] "GET /.git/config HTTP/1.1" 404 5423 "-" "Mozilla/5.0 (X11; Linux x86_64)"
...
show less
Brute-Force
Web App Attack
🇪🇸
Francisco Vallejo
2026-10-10 05:23:32
(3 hours ago)
[Fri Oct 09 19:41:39.949429 2026] [authz_core:error] [pid 2785295:tid 133276912047808] [client 144.1 ...
show more
[Fri Oct 09 19:41:39.949429 2026] [authz_core:error] [pid 2785295:tid 133276912047808] [client 144.172.98.192:48752] AH01630: client denied by server configuration: proxy:https://localhost:3000/.git/config
[Fri Oct 09 20:11:26.772165 2026] [authz_core:error] [pid 2785295:tid 133276299675328] [client 144.172.98.192:57854] AH01630: client denied by server configuration: /mnt/backup-nas/HSK/Clases/HSK3/.git
[Sat Oct 10 00:16:05.800996 2026] [authz_core:error] [pid 3463519:tid 133277465704128] [client 144.172.98.192:42440] AH01630: client denied by server configuration: proxy:http://localhost:8096/.git/config
[Sat Oct 10 06:57:51.768780 2026] [authz_core:error] [pid 3463518:tid 133277859964608] [client 144.172.98.192:47752] AH01630: client denied by server configuration: /var/www/barluna/.git/config
[Sat Oct 10 07:23:31.807946 2026] [authz_core:error] [pid 3463518:tid 133277440526016] [client 144.172.98.192:37296] AH01630: client denied by server configuration: proxy:http://127.0.0.1:8444/
...
show less
Brute-Force
SSH
