🇨🇭
TheCoon
2026-11-08 11:04:00
UTC ·
(3 days ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-24 16:25:55
UTC ·
(2 weeks ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-23 06:30:50
UTC ·
(2 weeks ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-21 06:53:20
UTC ·
(3 weeks ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇴
adalbertoreyes.org
2026-05-15 23:52:50
UTC ·
(5 months ago)
CategoryPortScan
Port Scan
🇪🇸
Gem
2026-05-15 22:09:23
UTC ·
(5 months ago)
Unauthorized web scan.
Web App Attack
🇩🇪
ut-addicted.com
2026-05-15 10:46:33
UTC ·
(5 months ago)
\[Fri May 15 12:46:31.980882 2026\] \[:error\] \[pid 5585:tid 140545091409664\] \[client 34.155.67.168:48870\] \[client 34.155.67.168\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/loca ...
show more
\[Fri May 15 12:46:31.980882 2026\] \[:error\] \[pid 5585:tid 140545091409664\] \[client 34.155.67.168:48870\] \[client 34.155.67.168\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 5\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "www.ut-addicted.com"\] \[uri "/.git/config"\] \[unique_id "agb5h@c6ZqGYYrLPqYcQqAAAAQs"\]
show less
Brute-Force
Web App Attack
🇳🇱
MM-bot
2026-05-15 05:06:43
UTC ·
(5 months ago)
URL-probe: HTTP/1.1 GET request on /.git/config (2026-05-15 07:06:43 UTC+2)
Web App Attack
Hacking
🇳🇿
Antinson
2026-05-15 04:29:51
UTC ·
(5 months ago)
Requests to unauthorized or suspicious endpoints (.git, .well-known, .php, etc.)
Bad Web Bot
🇨🇭
YF
2026-05-15 03:05:12
UTC ·
(5 months ago)
Git config exposure probe
Web App Attack
🇬🇧
thetomtaylor.co.uk
2026-05-15 02:09:02
UTC ·
(5 months ago)
Fail2Ban - [NGINX]WordPress Logins Sniffings on nginx-wordpress-sniffer ... [mx01,mx02,mx03]
Bad Web Bot
Web App Attack
2026-05-15 01:47:57
UTC ·
(5 months ago)
(caddyscan) Scanner path probe from 34.155.67.168 (FR/France/168.67.155.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.155.67.168 - - [15/May/2026:01:25:53 +0 ...
show more
(caddyscan) Scanner path probe from 34.155.67.168 (FR/France/168.67.155.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.155.67.168 - - [15/May/2026:01:25:53 +0000] "GET /.git/config HTTP/1.1"
[REDACTED] 200 2627 34.155.67.168 - - [15/May/2026:01:34:45 +0000] "GET /.git/config HTTP/1.1"
[REDACTED] 200 2627 34.155.67.168 - - [15/May/2026:01:34:52 +0000] "GET /.git/config HTTP/1.1"
[REDACTED] 200 2627 34.155.67.168 - - [15/May/2026:01:34:56 +0000] "GET /.git/config HTTP/1.1"
[REDACTED] 200 2627 34.155.67.168 - - [15/May/2026:01:47:53 +0000] "GET /.git/config HTTP/1.1"
show less
Port Scan
2026-05-15 01:21:58
UTC ·
(5 months ago)
(caddyscan) Scanner path probe from 34.155.67.168 (FR/France/168.67.155.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.155.67.168 - - [15/May/2026:01:09:05 +0 ...
show more
(caddyscan) Scanner path probe from 34.155.67.168 (FR/France/168.67.155.34.bc.googleusercontent.com): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 34.155.67.168 - - [15/May/2026:01:09:05 +0000] "GET /.git/config HTTP/1.1"
[REDACTED] 200 2627 34.155.67.168 - - [15/May/2026:01:10:19 +0000] "GET /.git/config HTTP/1.1"
[REDACTED] 200 2627 34.155.67.168 - - [15/May/2026:01:10:34 +0000] "GET /.git/config HTTP/1.1"
[REDACTED] 200 2627 34.155.67.168 - - [15/May/2026:01:10:34 +0000] "GET /.git/config HTTP/1.1"
[REDACTED] 200 2627 34.155.67.168 - - [15/May/2026:01:21:54 +0000] "GET /.git/config HTTP/1.1"
show less
Port Scan
🇫🇮
as211431.net
2026-05-15 01:21:49
UTC ·
(5 months ago)
Triggered Cloudflare WAF (firewallCustom) from FR.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /.git/config
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
This ...
show more
Triggered Cloudflare WAF (firewallCustom) from FR.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /.git/config
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/56.0.2924.87 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-05-15 01:11:37
UTC ·
(5 months ago)
IP banned by Fail2Ban in jail nginx-abusive-ips
Web App Attack
Brute-Force
Bad Web Bot
