🇺🇸
ipblock.com
2026-10-13 17:14:00
(2 weeks ago)
IPBlock protected site ID [1438-do].
Bad agent, site scraper bot.
Bad Web Bot
🇳🇱
Savvii
2026-10-13 17:05:11
(2 weeks ago)
20 attempts against mh-misbehave-ban on frost
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
as211431.net
2026-10-13 16:17:04
(2 weeks ago)
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /cgi-bin/php-cgi.exe
UA: Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)
...
show more
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /cgi-bin/php-cgi.exe
UA: Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇲🇾
Rizzy
2026-10-13 14:49:52
(2 weeks ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇧🇷
radardatelecom
2026-10-13 14:15:06
(2 weeks ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇨🇭
zynex
2026-10-13 14:00:49
(2 weeks ago)
URL Probing: /public/.env
Web App Attack
🇩🇪
Savvii
2026-10-13 12:51:31
(2 weeks ago)
20 attempts against mh-misbehave-ban on rose
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
jormaster3k
2026-10-13 12:35:38
(2 weeks ago)
Attack against Apache (too many 404s)
Web App Attack
2026-10-13 12:26:48
(2 weeks ago)
34.158.80.5 detected on srv01
Brute-Force
2026-10-13 12:07:12
(2 weeks ago)
Bot / seems abusive / Apache connections: 24
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-10-13 11:56:20
(2 weeks ago)
{"level":"info","ts":1791892579.434356,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.158.80.5","remote_port":"46076","client_ip":"34.158.80.5","proto":"HTTP/2.0","method":"GET","host":"status.shuttle.be","uri":"/w ...
show more
{"level":"info","ts":1791892579.434356,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.158.80.5","remote_port":"46076","client_ip":"34.158.80.5","proto":"HTTP/2.0","method":"GET","host":"status.shuttle.be","uri":"/webpack-stats.json","headers":{"Accept-Encoding":["gzip, deflate, br, zstd"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"Sec-Fetch-User":["?1"],"Upgrade-Insecure-Requests":["1"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Sec-Ch-Ua-Platform":["\"macOS\""],"Sec-Fetch-Site":["none"],"Priority":["u=0, i"],"Sec-Fetch-Dest":["document"],"Accept-Language":["en-US,en;q=0.9"],"Sec-Ch-Ua-Mobile":["?0"],"X-Nextjs-Data":["1"],"Sec-Fetch-Mode":["navigate"],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Brave\";v=\"153\", \"Not_A Brand\";v=\"8\""],"User-Agent":[
...
show less
DDoS Attack
Web App Attack
🇫🇷
COMAITE
2026-10-13 11:43:10
(2 weeks ago)
Common web attack from 34.158.80.5.
Web App Attack
2026-10-13 11:42:29
(2 weeks ago)
[Tue Oct 13 05:35:37.081235 2026] [authz_core:error] [pid 14029] [client 34.158.80.5:53566] AH01630: client denied by server configuration: /var/www/api/.htpasswd
[Tue Oct 13 06:32:14.517760 2026] [authz_core:error] [pid 21056] [client 34.158.80.5:57 ...
show more
[Tue Oct 13 05:35:37.081235 2026] [authz_core:error] [pid 14029] [client 34.158.80.5:53566] AH01630: client denied by server configuration: /var/www/api/.htpasswd
[Tue Oct 13 06:32:14.517760 2026] [authz_core:error] [pid 21056] [client 34.158.80.5:57494] AH01630: client denied by server configuration: /var/www/api/.htpasswd
[Tue Oct 13 06:44:51.044147 2026] [authz_core:error] [pid 21460] [client 34.158.80.5:56082] AH01630: client denied by server configuration: /var/www/api/.htpasswd
[Tue Oct 13 06:51:19.020420 2026] [authz_core:error] [pid 23698] [client 34.158.80.5:52052] AH01630: client denied by server configuration: /var/www/api/.htpasswd
[Tue Oct 13 07:04:40.968225 2026] [authz_core:error] [pid 25397] [client 34.158.80.5:51924] AH01630: client denied by server configuration: /var/www/api/.htpasswd
[Tue Oct 13 07:42:25.581386 2026] [authz_core:error] [pid 31537] [client 34.158.80.5:38512] AH01630: client denied by server configuration: /var/www/api/.htpasswd
show less
Bad Web Bot
Web App Attack
🇩🇪
arnisolutions
2026-10-13 11:38:50
(2 weeks ago)
Mass vulnerability scanning (LFI / path traversal probes with query parameters such as lokasie=/proc/...) against a production server. Observed on 1 day(s) between 2026-10-13 and 2026-10-13 (UTC). Additional activity: badscanner. Sample request: GET ...
show more
Mass vulnerability scanning (LFI / path traversal probes with query parameters such as lokasie=/proc/...) against a production server. Observed on 1 day(s) between 2026-10-13 and 2026-10-13 (UTC). Additional activity: badscanner. Sample request: GET /@fs/var/run/secrets/kubernetes.io/serviceaccount/token?raw?? HTTP/2.0
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-10-13 11:05:13
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.158.80.5 (5.80.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 07:05:08.123581 2026] [security2:error] [pid 1772:tid 1870] ...
show more
(mod_security) mod_security (id:210492) triggered by 34.158.80.5 (5.80.158.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 07:05:08.123581 2026] [security2:error] [pid 1772:tid 1870] [client 34.158.80.5:58874] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.killerrockandroll.com"] [uri "/files../.env"] [unique_id "as4QZGHSwyrZ_Q96slchkAAAAkg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
