🇬🇧
consul.to
2026-04-17 03:33:15
(2 months ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
xmission.com
2026-04-02 01:22:08
(2 months ago)
Blocked by UFW (TCP on 51413)
Source port: 62470
TTL: 53
Packet length: 60
TOS: 0x08
This report (f ...
show more
Blocked by UFW (TCP on 51413)
Source port: 62470
TTL: 53
Packet length: 60
TOS: 0x08
This report (for 191.96.67.175) was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Port Scan
2026-03-19 03:04:40
(3 months ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: Clou ...
show more
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: Cloud secrets probing
show less
Bad Web Bot
Web App Attack
🇩🇪
Wido
2026-03-18 18:45:40
(3 months ago)
Web Attack: Unauthorized access attempt to sensitive/hidden system file.
Hacking
Web App Attack
🇳🇱
JCB
2026-03-18 10:44:00
(3 months ago)
191.96.67.175 - - [18/Mar/2026:00:52:52 +0200] "GET /.env HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macint ...
show more
191.96.67.175 - - [18/Mar/2026:00:52:52 +0200] "GET /.env HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
show less
Web App Attack
2026-03-18 09:24:05
(3 months ago)
"GET /.env HTTP/1.1"
Hacking
Web App Attack
🇪🇸
librebit
2026-03-18 06:47:20
(3 months ago)
Brute force
Brute-Force
🇺🇸
octageeks.com
2026-03-18 04:09:59
(3 months ago)
Wordpress malicious attack:[octablocked]
Web App Attack
2026-03-18 02:05:19
(3 months ago)
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: Clou ...
show more
Blocked by FortiWeb WAF ML threat detection. ML probability: 99%, Country: US, Attack patterns: Cloud secrets probing
show less
Bad Web Bot
Web App Attack
🇺🇸
dtorrer
2026-03-18 00:45:33
(3 months ago)
General vulnerability scan.
Port Scan
🇺🇸
TPI-Abuse
2026-03-18 00:41:52
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 191.96.67.175 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 191.96.67.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 17 20:41:49.093040 2026] [security2:error] [pid 12456:tid 12456] [client 191.96.67.175:11915] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "astglobaltech.com"] [uri "/.env"] [unique_id "abn0zbsfviHFDreAIcq-xQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Hary74656
2026-03-18 00:34:46
(3 months ago)
[Wed Mar 18 01:34:34.584697 2026] [security2:error] [pid 194381:tid 194543] [client 191.96.67.175:32 ...
show more
[Wed Mar 18 01:34:34.584697 2026] [security2:error] [pid 194381:tid 194543] [client 191.96.67.175:3271] [client 191.96.67.175] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "26th.eu"] [uri "/.env"] [unique_id "abnzGRRZq0yQ7MQqXAgNhAAAASE"]
[Wed Mar 18 01:34:38.457758 2026] [security2:error] [pid 194914:tid 195075] [client 191.96.67.175:54014] [client 191.96.67.175] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs
...
show less
Web App Attack
🇫🇷
dwmp
2026-03-18 00:31:49
(3 months ago)
[18/Mar/2026:01:31:42.725295 +0100] abnybnC745xeqsJfppOutwAAAJY 191.96.67.175 36980 38.242.227.117 7 ...
show more
[18/Mar/2026:01:31:42.725295 +0100] abnybnC745xeqsJfppOutwAAAJY 191.96.67.175 36980 38.242.227.117 7081
[18/Mar/2026:01:31:46.031520 +0100] abnycrL6xiE6g8r1jCMaywAAAUs 191.96.67.175 36992 38.242.227.117 7081
[18/Mar/2026:01:31:48.868692 +0100] abnydHC745xeqsJfppOuuAAAAJI 191.96.67.175 36994 38.242.227.117 7081
...
show less
Brute-Force
SSH
🇩🇪
Hazzard
2026-03-18 00:26:33
(3 months ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
🇺🇸
TPI-Abuse
2026-03-18 00:13:39
(3 months ago)
(mod_security) mod_security (id:210492) triggered by 191.96.67.175 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 191.96.67.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Mar 17 20:13:36.023545 2026] [security2:error] [pid 19093:tid 19093] [client 191.96.67.175:46753] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "1214productions.com"] [uri "/.env"] [unique_id "abnuMDZfW9kPuIyD4N0BFQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack