🇩🇪
Trueforce Threat Report
2026-05-20 22:21:16
UTC ·
(5 months ago)
Automated report, trolling for resource vulnerabilities
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 08:35:15
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:33:55.836217 2026] [security2:error] [pid 26422:tid 26422] [client 149.143.135.221:5948 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:33:55.836217 2026] [security2:error] [pid 26422:tid 26422] [client 149.143.135.221:59481] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "legalnexusbali.legalnexuslawfirm.com"] [uri "/.env.live"] [unique_id "agbac-v3Fh3o2O6QIsviqgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 08:06:48
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:06:38.218594 2026] [security2:error] [pid 7475:tid 7475] [client 149.143.135.221:46859] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 04:06:38.218594 2026] [security2:error] [pid 7475:tid 7475] [client 149.143.135.221:46859] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.uhfcfoundation.org.victorvictor.biz"] [uri "/.env.save"] [unique_id "agbUDj8nqFX4mdLtoPlnfAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 07:32:16
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 03:31:35.830787 2026] [security2:error] [pid 27672:tid 27672] [client 149.143.135.221:3774 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 03:31:35.830787 2026] [security2:error] [pid 27672:tid 27672] [client 149.143.135.221:37743] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.sympalais.com"] [uri "/.env.uat"] [unique_id "agbL11gqcJskmwYsm0e3vwAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 06:21:16
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:20:45.757534 2026] [security2:error] [pid 30618:tid 30618] [client 149.143.135.221:4663 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 02:20:45.757534 2026] [security2:error] [pid 30618:tid 30618] [client 149.143.135.221:46639] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.hg/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pleatpindrapes.sternscape.com"] [uri "/.hg/store"] [unique_id "aga7PV36_KL1HjRYnNofFQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-13 08:15:04
UTC ·
(5 months ago)
(caddyscan) Scanner path probe from 149.143.135.221 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.135.221 - - [13/May/2026:08:14:51 +0000] "HEAD /.env.production H ...
show more
(caddyscan) Scanner path probe from 149.143.135.221 (US/United States/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 0 149.143.135.221 - - [13/May/2026:08:14:51 +0000] "HEAD /.env.production HTTP/1.1"
[REDACTED] 200 0 149.143.135.221 - - [13/May/2026:08:14:51 +0000] "HEAD /.env HTTP/1.1"
[REDACTED] 200 0 149.143.135.221 - - [13/May/2026:08:14:51 +0000] "HEAD /.env.save HTTP/1.1"
[REDACTED] 200 2627 149.143.135.221 - - [13/May/2026:08:14:55 +0000] "GET /server-status HTTP/1.1"
[REDACTED] 200 2627 149.143.135.221 - - [13/May/2026:08:14:59 +0000] "GET /.env.development HTTP/1.1"
show less
Port Scan
🇺🇸
TPI-Abuse
2026-05-12 12:33:50
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 08:33:36.107557 2026] [security2:error] [pid 19272:tid 19272] [client 149.143.135.221:4302 ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 08:33:36.107557 2026] [security2:error] [pid 19272:tid 19272] [client 149.143.135.221:43029] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "termites.corepest.com"] [uri "/wp-config.php"] [unique_id "agMeIBXA_QlC2XiRVDARmQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-11 18:14:51
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 14:14:37.242603 2026] [security2:error] [pid 18169:tid 18169] [client 149.143.135.221:4493 ...
show more
(mod_security) mod_security (id:210730) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 11 14:14:37.242603 2026] [security2:error] [pid 18169:tid 18169] [client 149.143.135.221:44939] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.blockdredge.com|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.blockdredge.com"] [uri "/config/master.key"] [unique_id "agIcjci7S5ag5sXkZT0BSgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-09 01:36:29
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 21:36:14.418835 2026] [security2:error] [pid 9330:tid 9330] [client 149.143.135.221:47089] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 08 21:36:14.418835 2026] [security2:error] [pid 9330:tid 9330] [client 149.143.135.221:47089] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "amfa76.com"] [uri "/app/.env"] [unique_id "af6PjgJjxCfeVyAsDoUsiAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Skyrider
2026-05-08 16:57:26
UTC ·
(6 months ago)
crowdsecurity/http-probing
Hacking
🇫🇮
as211431.net
2026-05-08 06:07:47
UTC ·
(6 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (HEAD method)
Endpoint: /config.env
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
T ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (HEAD method)
Endpoint: /config.env
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
Charlesiv
2026-05-08 04:00:50
UTC ·
(6 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
ASN: 7029 (Windstream Communications LLC)
Protocol: HTTP/2 (HEAD method)
Endpoint: /.env.live
Timestamp: 2026-05-08T02:56:09Z
Ray ID: 9f85308a3c85c9b3
UA: Mozilla/5.0 (X11; Ubuntu ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
ASN: 7029 (Windstream Communications LLC)
Protocol: HTTP/2 (HEAD method)
Endpoint: /.env.live
Timestamp: 2026-05-08T02:56:09Z
Ray ID: 9f85308a3c85c9b3
UA: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:125.0) Gecko/20100101 Firefox/125.0
show less
Bad Web Bot
🇺🇸
RLDD
2026-05-07 21:11:07
UTC ·
(6 months ago)
WP probing for vulnerabilities -ove
Web App Attack
🇺🇸
TPI-Abuse
2026-05-06 20:02:51
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 16:02:36.928270 2026] [security2:error] [pid 4259:tid 4259] [client 149.143.135.221:59213] ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 06 16:02:36.928270 2026] [security2:error] [pid 4259:tid 4259] [client 149.143.135.221:59213] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rogerloft.com"] [uri "/.env.old"] [unique_id "afueXPZrAk63iKdB-aYLBwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-04 03:32:00
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 03 23:31:54.829339 2026] [security2:error] [pid 658:tid 658] [client 149.143.135.221:44037] M ...
show more
(mod_security) mod_security (id:210492) triggered by 149.143.135.221 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 03 23:31:54.829339 2026] [security2:error] [pid 658:tid 658] [client 149.143.135.221:44037] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.elsejewelry.fabulouswire.net"] [uri "/.env.live"] [unique_id "afgTKktdbThdt1EinckCZQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack