2026-03-13 05:22:35
(2 months ago)
Banned by SPAMHAUS DROP list
DDoS Attack
Hacking
Bad Web Bot
Web App Attack
🇺🇸
Ocean Ascents
2026-01-21 16:37:23
(4 months ago)
Probe for vulnerabilities. Path attempted: /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-01-21 14:02:28
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.172.232 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.172.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 21 09:02:23.214414 2026] [security2:error] [pid 27796:tid 27796] [client 209.50.172.232:48569] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bilimkurgumanyagi.com"] [uri "/.svn/wc.db"] [unique_id "aXDcbx4cJ5LYFX3BcCO1fgAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-21 12:07:43
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.172.232 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.172.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jan 21 07:07:35.489412 2026] [security2:error] [pid 12805:tid 12805] [client 209.50.172.232:51963] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "radtraininginc.com"] [uri "/.env"] [unique_id "aXDBh8TP3zKJAlYl2MVJkwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
sefinek.net
2026-01-21 08:11:45
(4 months ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET metho ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /.git/HEAD
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇷
ingroscart.it
2026-01-20 19:37:34
(4 months ago)
(mod_security) mod_security triggered on hostname [redacted] 209.50.172.232 (US/United States/-)
SQL Injection
2026-01-14 19:30:14
(4 months ago)
Configuration snooping (/.env):
209.50.172.232 - - [14/Jan/2026:19:24:00 +0000] "GET /.env HTTP/1.1 ...
show more
Configuration snooping (/.env):
209.50.172.232 - - [14/Jan/2026:19:24:00 +0000] "GET /.env HTTP/1.1" 404 241 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15"
show less
Hacking
Web App Attack
🇧🇷
hostseries
2025-12-24 05:28:14
(5 months ago)
Trigger: LF_DISTATTACK
Brute-Force
🇺🇸
TPI-Abuse
2025-11-24 09:52:04
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.172.232 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.172.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 04:51:53.576351 2025] [security2:error] [pid 9772:tid 9772] [client 209.50.172.232:30685] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.narrowacresbees.com"] [uri "/.svn/wc.db"] [unique_id "aSQquRjthaTPq7zWmdwo7wAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-24 07:47:40
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.172.232 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.172.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 24 02:47:11.556826 2025] [security2:error] [pid 5375:tid 5375] [client 209.50.172.232:18549] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.jeremyurbanski.com"] [uri "/.svn/wc.db"] [unique_id "aSQNfwPHHcig7XLNXSNlRgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-10 07:09:31
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 209.50.172.232 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 209.50.172.232 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 10 02:09:26.412448 2025] [security2:error] [pid 32533:tid 32533] [client 209.50.172.232:26639] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ixd.net"] [uri "/.env"] [unique_id "aRGPprfEdLV4rug8UcSKRAAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Marc
2025-10-29 20:39:53
(7 months ago)
Brute-Force
🇩🇪
neckaralb-admin.de
2025-10-29 17:10:17
(7 months ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
2025-10-28 23:26:37
(7 months ago)
This IP was involved in a brute force and password spray attack.
Brute-Force
Web App Attack
🇱🇻
garmtech.com
2025-10-23 15:55:38
(7 months ago)
IM360 WAF: SQL Injection Attack: Common DB Names Detected
SQL Injection