🇧🇪
madeit
2026-10-17 10:12:54
(4 hours ago)
Web App Attack
🇧🇪
madeit
2026-08-30 07:38:46
(1 month ago)
Web App Attack
🇮🇹
IRT@Unisi
2026-07-07 03:03:23
(3 months ago)
anomaly:tcp_dst_session,1001>threshold1000,repeats60timessincelastlog
DDoS Attack
🇧🇬
Stoyko Stoykov
2026-06-04 01:59:37
(4 months ago)
172.70.110.9 - - [04/Jun/2026:04:59:36 +0300] "GET /.env HTTP/2.0" 404 176 "-" "Mozilla/5.0 (Windows ...
show more
172.70.110.9 - - [04/Jun/2026:04:59:36 +0300] "GET /.env HTTP/2.0" 404 176 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/101.0.4951.64 Safari/537.36 Edg/101.0.1210.47"
...
show less
Hacking
Web App Attack
🇳🇱
homeshowdomain.nl
2026-04-20 22:01:34
(5 months ago)
Auto-ban: >3000 req/min op 2026-04-20
Web App Attack
SSH
Hacking
🇨🇦
yukon.ca
2026-04-13 11:13:20
(6 months ago)
Web Server Enforcement Violation: Web Server Exposed Git Repository Information Disclosure
Port:80
Hacking
Exploited Host
🇺🇸
TPI-Abuse
2026-03-31 03:58:53
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.110.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.110.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Mar 30 23:58:47.628148 2026] [security2:error] [pid 11155:tid 11155] [client 172.70.110.9:13219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.jerusalem-temple-today.com"] [uri "/.env.test"] [unique_id "actGd37p1Ux8jk8WRXfjnAAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
pinguin
2026-03-22 11:32:14
(6 months ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: LOG
Protocol: HTTP/2 (GET method)
...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: LOG
Protocol: HTTP/2 (GET method)
Endpoint: /
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
mnsf
2026-03-21 23:05:14
(6 months ago)
Scanning/Probing (11)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 05:57:43
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.110.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.110.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 01:57:38.297607 2026] [security2:error] [pid 4063913:tid 4063913] [client 172.70.110.9:9625] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.tataylor.net"] [uri "/.env.development.local"] [unique_id "ab4zUl5djR1Ja0hKqap2QwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 03:59:26
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.110.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.110.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 23:59:22.063366 2026] [security2:error] [pid 13036:tid 13036] [client 172.70.110.9:13429] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paleopathologist.com"] [uri "/.env.dev"] [unique_id "ab4XmmOo-6ux4aow0U_2pQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 06:53:57
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.110.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.110.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 02:53:52.476012 2026] [security2:error] [pid 25503:tid 25503] [client 172.70.110.9:10230] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.digitaltom.net"] [uri "/server/.env"] [unique_id "abzvAG-5gE_XuoR7JQf0BQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 04:37:34
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.110.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.110.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Mar 20 00:37:27.421114 2026] [security2:error] [pid 11391:tid 11391] [client 172.70.110.9:9368] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.vpatech.com"] [uri "/.env.development.local"] [unique_id "abzPB_l7hsZVaHP8j4i1RwAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-20 02:34:17
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.110.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.110.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 22:34:12.188775 2026] [security2:error] [pid 10356:tid 10356] [client 172.70.110.9:13952] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.jamworldmovements.com"] [uri "/config/.env"] [unique_id "abyyJCqoovDqOiv0QtGmMAAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-19 11:57:35
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 172.70.110.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 172.70.110.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Mar 19 07:57:29.549882 2026] [security2:error] [pid 21583:tid 21583] [client 172.70.110.9:13774] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.lg.cloudex.link"] [uri "/config/.env.local"] [unique_id "abvkqSSsBL1qwsajor8X_QAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack