🇳🇱
EGP Abuse Dept
2026-10-21 07:20:32
(35 minutes ago)
Scanning for web/db/file exploits on www.hygrotemp.nl
SQL Injection
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-10-21 07:19:41
(36 minutes ago)
Excessive multi-domain requests
Brute-Force
🇺🇸
TPI-Abuse
2026-10-21 03:41:53
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.156.72.24 (24.72.156.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.156.72.24 (24.72.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 23:41:47.489022 2026] [security2:error] [pid 26090:tid 26090] [client 34.156.72.24:36140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.odinathletes.com"] [uri "/files../.env"] [unique_id "atg0ezRDRGyxV2JvbBKbfAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 03:26:00
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.156.72.24 (24.72.156.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.156.72.24 (24.72.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 23:25:55.591420 2026] [security2:error] [pid 17991:tid 17991] [client 34.156.72.24:36890] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.nwarchitect.com"] [uri "/js../.env"] [unique_id "atgwwxS5dBw1qjhjyJAAawAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 02:59:18
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.156.72.24 (24.72.156.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.156.72.24 (24.72.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 22:59:12.004304 2026] [security2:error] [pid 19671:tid 19866] [client 34.156.72.24:57694] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.oswgr.com"] [uri "/static/..;/..;/.env"] [unique_id "atgqgHbSFCl6XaaPBTcVRQAAAhA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 02:41:42
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.156.72.24 (24.72.156.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210492) triggered by 34.156.72.24 (24.72.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 22:41:35.356786 2026] [security2:error] [pid 16491:tid 16491] [client 34.156.72.24:54818] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.originalmobiliario.com"] [uri "/images../.env"] [unique_id "atgmXyBhWCHlK93M4sObVAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-10-21 01:05:47
(6 hours ago)
csagent: score 20.0: secrets grab x2; 1 domain(s) in 1s
Web App Attack
🇫🇮
as211431.net
2026-10-20 22:44:51
(9 hours ago)
Triggered Cloudflare WAF (firewallCustom) from BE.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 ...
show more
Triggered Cloudflare WAF (firewallCustom) from BE.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 (POST method)
Endpoint: /lib/file-control.php
UA: Mozilla/5.0 (compatible; Meta-ExternalFetcher/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
jormaster3k
2026-10-20 18:38:41
(13 hours ago)
Attack against Apache (too many 404s)
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 18:28:13
(13 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.156.72.24 (24.72.156.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.156.72.24 (24.72.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 14:28:05.819711 2026] [security2:error] [pid 1484:tid 1484] [client 34.156.72.24:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||blog.nyemdr.com|F|2"] [data ".nyemdr.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "blog.nyemdr.com"] [uri "/z9x8c7v6b5-debug-trigger-blog.nyemdr.com"] [unique_id "ateytbXxK16dtTY56DncWgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 17:37:50
(14 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.156.72.24 (24.72.156.34.bc.googleusercontent ...
show more
(mod_security) mod_security (id:210730) triggered by 34.156.72.24 (24.72.156.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 13:37:46.657334 2026] [security2:error] [pid 23115:tid 23115] [client 34.156.72.24:51168] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ourhotmail.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ourhotmail.com"] [uri "/z9x8c7v6b5-debug-trigger-ourhotmail.com"] [unique_id "atem6p_bbGsMWmnI3Z8LXwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
rubixstudios
2026-10-20 17:07:02
(14 hours ago)
Excessive HTTP requests consistent with automated attack behaviour detected by Imunify360
DDoS Attack
Brute-Force
Web App Attack
🇫🇷
dynamix
2026-10-20 16:53:06
(15 hours ago)
Multiple WAF Violations
Web App Attack
🇪🇸
pipeline.es
2026-10-20 16:38:49
(15 hours ago)
Web scanning / probing for vulnerable paths | URL: /sign-in | Evidence: ondazulviagens.com 34.156.72 ...
show more
Web scanning / probing for vulnerable paths | URL: /sign-in | Evidence: ondazulviagens.com 34.156.72.24 - - [20/Oct/2026:18:36:35 +0200] \"GET /sign-in HTTP/2.0\" 404 21314 \"-\" \"Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36\" GEOIP_COUNTRY_CODE=BE 33827 | ASN: GOOGLE-CLOUD-PLATFORM | Country: US
show less
Port Scan
Web App Attack
2026-10-20 16:10:02
(15 hours ago)
suspicious request in access.log
Web App Attack
