🇳🇱
Mangelot Hosting
2026-10-20 14:03:55
(1 day ago)
(web_sensitive_file) srv103 Sensitive file probe (.env/.git/backup) 188.166.250.75 (SG/Singapore/-): ...
show more
(web_sensitive_file) srv103 Sensitive file probe (.env/.git/backup) 188.166.250.75 (SG/Singapore/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇫🇮
as211431.net
2026-10-20 13:24:37
(1 day ago)
Triggered Cloudflare WAF (firewallManaged) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST met ...
show more
Triggered Cloudflare WAF (firewallManaged) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇦🇺
paulshipley.com.au
2026-10-20 12:40:44
(1 day ago)
[Tue Oct 20 23:40:43.690480 2026] [security2:error] [pid 254867] [client 188.166.250.75:60892] [clie ...
show more
[Tue Oct 20 23:40:43.690480 2026] [security2:error] [pid 254867] [client 188.166.250.75:60892] [client 188.166.250.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ccideas.com.au"] [uri "/"] [unique_id "atdhS1dH4jCUPxXIP_B-7wAAAAI"]
...
show less
Web App Attack
🇭🇰
i553041
2026-10-20 10:53:31
(1 day ago)
188.166.250.75 - - [20/Oct/2026:18:53:24 +0800] "GET /portal/.env HTTP/1.1" 401 0 "-" "Mozilla/5.0 ( ...
show more
188.166.250.75 - - [20/Oct/2026:18:53:24 +0800] "GET /portal/.env HTTP/1.1" 401 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "188.166.250.75"
188.166.250.75 - - [20/Oct/2026:18:53:25 +0800] "GET /erp/.env HTTP/1.1" 401 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "188.166.250.75"
188.166.250.75 - - [20/Oct/2026:18:53:30 +0800] "GET /smtp/.env HTTP/1.1" 401 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "188.166.250.75"
188.166.250.75 - - [20/Oct/2026:18:53:30 +0800] "GET /notifications/.env HTTP/1.1" 401 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "188.166.250.75"
188.166.250.75 - - [20/Oct/2026:18:53:31 +0800] "GET /notify/.env HTTP/1.1" 401 0 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0
...
show less
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-10-20 05:02:16
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 188.166.250.75 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 188.166.250.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 01:02:09.420614 2026] [security2:error] [pid 26934:tid 26934] [client 188.166.250.75:47942] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cbrsanpedro.cl"] [uri "/.git/config"] [unique_id "atb10WFRsfltTzpl60MdVQAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇭🇰
CyberFox
2026-10-18 09:22:13
(4 days ago)
1742/udp,123/udp,161/udp,3401/udp,3478/udp,9600/udp,1741/udp,1743/udp,500/udp,260/udp,1740/udp (11 o ...
show more
1742/udp,123/udp,161/udp,3401/udp,3478/udp,9600/udp,1741/udp,1743/udp,500/udp,260/udp,1740/udp (11 or more attempts)
show less
Port Scan
🇬🇧
findlab
2025-05-02 11:10:02
(1 year ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2025-05-02 09:22:48
(1 year ago)
102 requests with url.path */sftp-config.json
Brute-Force
Bad Web Bot
🇫🇷
COMAITE
2025-05-02 08:23:57
(1 year ago)
Multiple web server 400 error codes from same source ip 188.166.250.75.
Web App Attack
🇫🇮
oh.mg
2025-05-02 06:34:50
(1 year ago)
[Fri May 02 08:34:49.568689 2025] [security2:error] [pid 676480:tid 676504] [client 188.166.250.75:0 ...
show more
[Fri May 02 08:34:49.568689 2025] [security2:error] [pid 676480:tid 676504] [client 188.166.250.75:0] [client 188.166.250.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "www.mmn.ca"] [uri "/darksatellite/endsus/sftp-config.json"] [unique_id "aBRniS_O_5f0oPZnoVInZAAAARY"]
...
show less
Bad Web Bot
Web App Attack
🇺🇸
BSG Webmaster
2025-05-02 06:16:28
(1 year ago)
Hacking Attempt using path /sftp-config.json
Hacking
🇩🇪
kranem
2025-05-02 06:00:18
(1 year ago)
Triggered Cloudflare WAF from SG.
Action taken: BLOCK
ASN: 14061 (DIGITALOCEAN-ASN)
Protocol: HTTP/1 ...
show more
Triggered Cloudflare WAF from SG.
Action taken: BLOCK
ASN: 14061 (DIGITALOCEAN-ASN)
Protocol: HTTP/1.1 (GET method)
Endpoint: /.vscode/sftp.json
Timestamp: 2025-05-02T03:44:29Z
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
show less
Bad Web Bot
🇺🇸
snappic
2025-05-02 04:40:11
(1 year ago)
Malicious URI path & DigitalOcean User Agent Spoofing [GET /sftp-config.json] [Mozilla/5.0 (Macintos ...
show more
Malicious URI path & DigitalOcean User Agent Spoofing [GET /sftp-config.json] [Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0]
show less
Bad Web Bot
Web App Attack
🇫🇮
oh.mg
2025-05-02 04:28:27
(1 year ago)
[Fri May 02 06:28:26.311041 2025] [security2:error] [pid 676216:tid 676231] [client 188.166.250.75:5 ...
show more
[Fri May 02 06:28:26.311041 2025] [security2:error] [pid 676216:tid 676231] [client 188.166.250.75:50508] [client 188.166.250.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "www.oh.mg"] [uri "/ca/sftp-config.json"] [unique_id "aBRJ6uLW2hDvsj6uVsrKsAAAAMo"]
[Fri May 02 06:28:26.939371 2025] [security2:error] [pid 676216:tid 676243] [client 188.166.250.75:58571] [client 188.166.250.75] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.10.0-d
...
show less
Bad Web Bot
Web App Attack
🇺🇸
snappic
2025-05-02 03:38:27
(1 year ago)
Malicious URI path & DigitalOcean User Agent Spoofing [GET /virtual/capture/ZD993/sftp-config.json] ...
show more
Malicious URI path & DigitalOcean User Agent Spoofing [GET /virtual/capture/ZD993/sftp-config.json] [Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0]
show less
Bad Web Bot
Web App Attack