🇵🇱
sefinek.net
2024-11-19 03:03:24
(1 year ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
ASN: 142002 (SCLO ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: MANAGED_CHALLENGE
ASN: 142002 (SCLOUDPTELTD-AS Scloud Pte Ltd)
Protocol: HTTP/1.1 (GET method)
Zone: sefinek.net
Endpoint: /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php
Timestamp: 2024-11-19T01:27:18Z
Ray ID: 8e4c6ac2bfcb2b53
UA: python-requests/2.32.3
Report generated by Cloudflare-WAF-To-AbuseIPDB:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇸🇬
Cloudkul Cloudkul
2024-11-19 00:05:08
(1 year ago)
Attempted Not Found (404 status code) requests on our application, more than 30% of their total requ ...
show more
Attempted Not Found (404 status code) requests on our application, more than 30% of their total requests.
show less
Brute-Force
Web App Attack
2024-11-18 19:43:15
(1 year ago)
[Mon Nov 18 14:43:14.145147 2024] [:error] [pid 24057] [client 165.154.254.249] ModSecurity: Access ...
show more
[Mon Nov 18 14:43:14.145147 2024] [:error] [pid 24057] [client 165.154.254.249] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "sigintassign.com"] [uri "/.env"] [unique_id "ZzuY0n8AAAEAAF35O2gAAAAI"]
[Mon Nov 18 14:43:14.554174 2024] [:error] [pid 2985] [client 165.154.254.249] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attac
show less
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2024-11-18 05:28:54
(1 year ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 165.154.254.249 (US/Unit ...
show more
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 165.154.254.249 (US/United States/-)
show less
Port Scan
🇫🇮
Mr-Money
2024-11-18 04:04:41
(1 year ago)
2/Nov/2024:06:51:01 +0100165.154.254.249 - - [18/Nov/2024:05:04:38 +0100] "GET /.env HTTP/1.1" 404 4 ...
show more
2/Nov/2024:06:51:01 +0100165.154.254.249 - - [18/Nov/2024:05:04:38 +0100] "GET /.env HTTP/1.1" 404 491 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
2/Nov/2024:06:51:01 +0100165.154.254.249 - - [18/Nov/2024:05:04:39 +0100] "GET /.env HTTP/1.1" 404 3595 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
2/Nov/2024:06:51:01 +0100165.154.254.249 - - [18/Nov/2024:05:04:41 +0100] "GET /.env HTTP/1.1" 404 488 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
...
show less
Hacking
SQL Injection
Bad Web Bot
Exploited Host
Web App Attack
2024-11-18 01:37:03
(1 year ago)
(mod_security) mod_security triggered on hostname [redacted] 165.154.254.249 (US/United States/-)
SQL Injection
🇺🇸
myagent.site
2024-11-17 18:53:51
(1 year ago)
Blocking for trying to access an exploit file: /.env
Hacking
🇫🇷
GabrielJST
2024-11-17 10:31:23
(1 year ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 165.154.254.249 (US/ ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 165.154.254.249 (US/United States/-)
show less
Bad Web Bot
🇩🇪
conseilgouz
2024-11-17 07:21:36
(1 year ago)
gie-17 : Block hidden directories=>/.env(/)
Hacking
🇫🇷
✨
2024-11-17 07:19:02
(1 year ago)
Domain : mitiendaonline.net
Rule : env
2024-11-17 07:17:49 152.53.103.155 GET /.env - 80 - 172.70.21 ...
show more
Domain : mitiendaonline.net
Rule : env
2024-11-17 07:17:49 152.53.103.155 GET /.env - 80 - 172.70.214.53 HTTP/1.1 Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 - mitiendaonline.net 200 0 64 0 497 1374 - 165.154.254.249
show less
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2024-11-17 05:06:17
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 165.154.254.249 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 165.154.254.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 17 00:06:13.685743 2024] [security2:error] [pid 18350:tid 18350] [client 165.154.254.249:58821] [client 165.154.254.249] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "matteozacchino.dev"] [uri "/.env"] [unique_id "Zzl5xa2-ec-EsfC1w-soFQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Gwyneth Llewelyn
2024-11-17 03:13:39
(1 year ago)
165.154.254.249 - - [17/Nov/2024:03:13:37 +0000] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Linu ...
show more
165.154.254.249 - - [17/Nov/2024:03:13:37 +0000] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
2024/11/17 03:13:38 [error] 1948901#1948901: *5692208 access forbidden by rule, client: 165.154.254.249, server: betatechnologies.info, request: "GET /.env HTTP/2.0", host: "betatechnologies.info"
165.154.254.249 - - [17/Nov/2024:03:13:38 +0000] "GET /.env HTTP/2.0" 403 1045 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
show less
Web App Attack
🇺🇸
TPI-Abuse
2024-11-17 01:57:06
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 165.154.254.249 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 165.154.254.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 16 20:56:59.133149 2024] [security2:error] [pid 27276:tid 27276] [client 165.154.254.249:52770] [client 165.154.254.249] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chapa.net"] [uri "/.env"] [unique_id "ZzlNawjZRWuiqu6eh-IbKgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-11-17 00:45:42
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 165.154.254.249 (-): 1 in the last 300 secs; Po ...
show more
(mod_security) mod_security (id:210492) triggered by 165.154.254.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 16 19:45:36.402026 2024] [security2:error] [pid 7784:tid 7784] [client 165.154.254.249:54762] [client 165.154.254.249] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "nealschon.global"] [uri "/.env"] [unique_id "Zzk8sC1NAxiCeoqG8j_AUAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
el-brujo
2024-11-17 00:28:27
(1 year ago)
17/Nov/2024:01:28:26.937284 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
17/Nov/2024:01:28:26.937284 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 165.154.254.249] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "hostench.eu"] [uri "/.env"] [unique_id "Zzk4qhCZuloxr091h00AMgABais"]
...
show less
Hacking
Web App Attack