🇺🇸
TPI-Abuse
2026-05-30 06:37:27
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 31.76.244.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 31.76.244.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 30 02:37:23.861077 2026] [security2:error] [pid 29076:tid 29076] [client 31.76.244.68:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.solarshop.aguasolar.com"] [uri "/.env.production.local"] [unique_id "ahqFo1ys4YqFs2usVP93jgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Sylvyon
2026-05-30 06:28:31
(1 week ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoi ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /.env | UA: Mozilla/5.0 (ZZ; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-30 03:17:51
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 31.76.244.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 31.76.244.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 23:17:48.044439 2026] [security2:error] [pid 8783:tid 8783] [client 31.76.244.68:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "srippy.com"] [uri "/.env.local"] [unique_id "ahpW3Dwas9qeakURqQcE-QAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-30 01:49:49
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 31.76.244.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 31.76.244.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 21:49:41.900191 2026] [security2:error] [pid 27825:tid 27825] [client 31.76.244.68:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||dougrhodes.com.inspiraciongaleria.com|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "dougrhodes.com.inspiraciongaleria.com"] [uri "/dougrhodes.sql"] [unique_id "ahpCNUsWDb7pe-32-3nWEgAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-05-30 00:06:29
(1 week ago)
block ruleset Badbot using very old user-agents 5CF3CDB778C7D82564405B86B9242E612F378C68
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-29 14:45:11
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 31.76.244.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 31.76.244.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 29 10:45:05.393820 2026] [security2:error] [pid 15357:tid 15357] [client 31.76.244.68:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fibw.com"] [uri "/.env"] [unique_id "ahmmcbOzzAqefPFPCBJ6HAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-05-29 14:05:48
(1 week ago)
Abuse Detected (1)
Brute-Force
Web App Attack
🇩🇪
Lino Project
2026-05-28 10:14:52
(1 week ago)
31.76.244.68 - - [28/May/2026:12:14:51 +0200] "GET /.env.production HTTP/2.0" 403 253 "-" "Mozilla/5 ...
show more
31.76.244.68 - - [28/May/2026:12:14:51 +0200] "GET /.env.production HTTP/2.0" 403 253 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_16) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3 Safari/605.1.15"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
mk-dizajn.hr
2026-05-27 22:34:15
(1 week ago)
$f2bV_matches
Bad Web Bot
🇬🇧
pinguin
2026-05-27 03:12:13
(1 week ago)
Triggered Cloudflare WAF (firewallManaged) from DE.
Action taken: LOG
Protocol: HTTP/1.1 (GET method ...
show more
Triggered Cloudflare WAF (firewallManaged) from DE.
Action taken: LOG
Protocol: HTTP/1.1 (GET method)
Endpoint: /wp-config.php.bak
UA: Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
mk-dizajn.hr
2026-05-26 17:50:44
(1 week ago)
$f2bV_matches
Bad Web Bot
2026-05-26 01:50:02
(1 week ago)
suspicious request in access.log
Web App Attack
🇳🇱
e.fierstra
2026-05-25 23:42:23
(1 week ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-25 21:05:21
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 31.76.244.68 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 31.76.244.68 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 25 17:05:18.082050 2026] [security2:error] [pid 28491:tid 28491] [client 31.76.244.68:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.fly805.com.inetbrain.com"] [uri "/.env.old"] [unique_id "ahS5jsrww60SitWxD03FhQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack