🇬🇧
consul.to
2026-10-06 16:27:27
(3 weeks ago)
Web attack/malicious scanning detected
Web App Attack
2026-09-04 20:21:31
(1 month ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇮🇹
Progetto1
2026-09-04 19:10:02
(1 month ago)
Website Scanning / Scraping
Bad Web Bot
Exploited Host
Web App Attack
2026-09-04 18:50:00
(1 month ago)
Multiple Violations by Botnets
Port Scan
Web App Attack
🇫🇮
as211431.net
2026-09-04 11:36:47
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
This r ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
its101
2026-09-04 10:00:56
(1 month ago)
Detected by LockdownAccess security monitoring. Flags: Traffic from hosting provider: Datacamp Limited. Anonymous proxy/VPN detected: Datacamp Limited. GreyNoise: known mass internet scanner (unknown)
Port Scan
Web App Attack
Fraud Orders
🇫🇷
masterguru
2026-09-04 08:58:32
(1 month ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 147.90.209.120 (DE/Germany/-): 2 in the last 3600 secs (0-196)
Hacking
🇵🇱
sefinek.net
2026-09-04 08:37:12
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (GET) | Endpoint: / | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 • Genera ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action: MANAGED_CHALLENGE | Protocol: HTTP/1.1 (GET) | Endpoint: / | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-20 14:18:19
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 147.90.209.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 10:18:12.775800 2026] [security2:error] [pid 24562:tid 24562] [client 147.90.209.120:45027] ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.209.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 10:18:12.775800 2026] [security2:error] [pid 24562:tid 24562] [client 147.90.209.120:45027] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "armandselmwoodpark.com"] [uri "/.git/config"] [unique_id "aocMpOggbQtf7elh5pKwTgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-08-20 12:30:53
(2 months ago)
[20/Aug/2026:15:30:53 +0300] -- 147.90.209.120 Ban reason: User-Agent Go-http-client
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-20 12:30:06
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 147.90.209.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 08:29:58.871941 2026] [security2:error] [pid 31073:tid 31073] [client 147.90.209.120:41881] ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.209.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 08:29:58.871941 2026] [security2:error] [pid 31073:tid 31073] [client 147.90.209.120:41881] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.tijuana-bibles.com"] [uri "/.git/config"] [unique_id "aobzRtGaulbT6vK9GcDyeAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-08-20 11:35:02
(2 months ago)
suspicious request in access.log
Web App Attack
2026-08-20 11:17:59
(2 months ago)
[Firewall Canary] Temporary ban due to firewall rule match [URI:*/.git/*]
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-20 10:39:28
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 147.90.209.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 06:39:24.100769 2026] [security2:error] [pid 19878:tid 19878] [client 147.90.209.120:56185] ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.209.120 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 20 06:39:24.100769 2026] [security2:error] [pid 19878:tid 19878] [client 147.90.209.120:56185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.animatuevento.com.mx"] [uri "/.git/config"] [unique_id "aobZXMJt8twrgGZ32_WzUgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Baking333
2026-08-18 20:18:27
(2 months ago)
[redacted] 147.90.209.120 - - [18/Aug/2026:21:18:26 +0100] "GET /.git/config HTTP/1.1" 302 1492 0/68803 "-" "Go-http-client/1.1" [redacted] 147.90.209.120 - - [18/Aug/2026:21:18:26 +0100] "GET / HTTP/1.1" 200 10590 0/144854 "http://[redacted]/.git/co ...
show more
[redacted] 147.90.209.120 - - [18/Aug/2026:21:18:26 +0100] "GET /.git/config HTTP/1.1" 302 1492 0/68803 "-" "Go-http-client/1.1" [redacted] 147.90.209.120 - - [18/Aug/2026:21:18:26 +0100] "GET / HTTP/1.1" 200 10590 0/144854 "http://[redacted]/.git/config" "Go-http-client/1.1"
show less
Bad Web Bot
Web App Attack
