🇹🇷
rtbh.com.tr
2026-01-24 20:11:12
(6 months ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇫🇷
SpaceHost-Server
2026-01-16 23:35:50
(6 months ago)
Brute-Force
Web App Attack
🇫🇮
000rosiu
2026-01-16 17:17:23
(6 months ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
ASN: 14061 (DIGITALOCEAN-ASN) ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
ASN: 14061 (DIGITALOCEAN-ASN)
Protocol: HTTP/1.1 (GET method)
Endpoint: /sftp.json
Timestamp: 2026-01-16T17:15:47Z
Ray ID: 9bef41c80c1bfd61
UA: Go-http-client/1.1
Report generated by Cloudflare-WAF-To-AbuseIPDB:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇷
masterguru
2026-01-16 10:10:28
(6 months ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
2026-01-16 08:35:42
(6 months ago)
(apache-useragents) Failed apache-useragents trigger with match [Go-http-client/1.1] from 159.223.76 ...
show more
(apache-useragents) Failed apache-useragents trigger with match [Go-http-client/1.1] from 159.223.76.134 (SG/Singapore/-): 5 in the last 300 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 159.223.76.134 - - [16/Jan/2026:09:35:38 +0100] "GET /api/.env HTTP/1.1" 403 405 "-" "Go-http-client/1.1"
159.223.76.134 - - [16/Jan/2026:09:35:38 +0100] "GET /.env HTTP/1.1" 403 405 "-" "Go-http-client/1.1"
159.223.76.134 - - [16/Jan/2026:09:35:38 +0100] "GET /app/.env HTTP/1.1" 403 405 "-" "Go-http-client/1.1"
159.223.76.134 - - [16/Jan/2026:09:35:38 +0100] "GET /laravel/.env HTTP/1.1" 403 405 "-" "Go-http-client/1.1"
159.223.76.134 - - [16/Jan/2026:09:35:38 +0100] "GET /old/.env HTTP/1.1" 403 405 "-" "Go-http-client/1.1"
show less
Port Scan
🇺🇸
TPI-Abuse
2026-01-16 03:19:13
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 159.223.76.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 159.223.76.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 15 22:19:07.846987 2026] [security2:error] [pid 12042:tid 12042] [client 159.223.76.134:59244] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "13waggoners.com"] [uri "/app/.env"] [unique_id "aWmuK0-Z9lXiLMTVpcUDZAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-16 01:20:48
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 159.223.76.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 159.223.76.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 15 20:20:43.497721 2026] [security2:error] [pid 6477:tid 6482] [client 159.223.76.134:53080] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "12am.com"] [uri "/laravel/.env"] [unique_id "aWmSa02OzrS3U9ITRYbfWQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-15 23:51:37
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 159.223.76.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 159.223.76.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 15 18:51:30.803319 2026] [security2:error] [pid 13774:tid 13774] [client 159.223.76.134:54876] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "123clearmyticket.com"] [uri "/old/.env"] [unique_id "aWl9gnkCczE2QZEQVbfspQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
SpaceHost-Server
2026-01-15 23:27:51
(6 months ago)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-01-15 23:08:56
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 159.223.76.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 159.223.76.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 15 18:08:50.543160 2026] [security2:error] [pid 27948:tid 27948] [client 159.223.76.134:64762] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "1214productions.com"] [uri "/api/.env"] [unique_id "aWlzguk1olCA3wvWrLezHwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-01-15 22:05:36
(6 months ago)
Scanning/Probing (20)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-01-15 20:13:41
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 159.223.76.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 159.223.76.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 15 15:13:37.304357 2026] [security2:error] [pid 5194:tid 5194] [client 159.223.76.134:54486] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "10bestattorneys.com"] [uri "/old/.env"] [unique_id "aWlKcST17cdEC4hzx-PPfwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-15 19:38:41
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 159.223.76.134 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 159.223.76.134 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 15 14:38:34.784990 2026] [security2:error] [pid 25115:tid 25131] [client 159.223.76.134:63402] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "104ventures.com"] [uri "/app/.env"] [unique_id "aWlCOvanxgFuP6p_5fR_AgAAAI4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
macrob
2026-01-15 18:22:06
(6 months ago)
2026/01/15 18:22:04 [error] 1345798#1345798: *230465109 access forbidden by rule, client: 159.223.76 ...
show more
2026/01/15 18:22:04 [error] 1345798#1345798: *230465109 access forbidden by rule, client: 159.223.76.134, server: 100fs.org, request: "GET /api/.env HTTP/1.1", host: "100fs.org"
2026/01/15 18:22:04 [error] 1345799#1345799: *230465111 access forbidden by rule, client: 159.223.76.134, server: 100fs.org, request: "GET /old/.env HTTP/1.1", host: "100fs.org"
2026/01/15 18:22:04 [error] 1345798#1345798: *230465110 access forbidden by rule, client: 159.223.76.134, server: 100fs.org, request: "GET /.env HTTP/1.1", host: "100fs.org"
...
show less
Web App Attack
🇫🇷
dynamix
2026-01-15 16:21:32
(6 months ago)
Multiple WAF Violations
Web App Attack