🇺🇸
jormaster3k
2026-11-06 19:22:01
UTC ·
(14 minutes ago)
Attack against Apache (too many 404s)
Web App Attack
🇿🇦
conure.sh
2026-11-06 18:47:04
UTC ·
(49 minutes ago)
csagent: score 20.7: 404 noise floor x3, secrets grab x2; 1 domain(s) in 5s
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 18:14:33
UTC ·
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 34.21.200.1 (1.200.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 13:14:30.541384 2026] [security2:error] [pid 19715:tid 1971 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.200.1 (1.200.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 13:14:30.541384 2026] [security2:error] [pid 19715:tid 19715] [client 34.21.200.1:49290] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.thevoice4you.eu"] [uri "/old/.env"] [unique_id "au4ZBmb8YohhBCR9XgcqjAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2026-11-06 15:50:12
UTC ·
(3 hours ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 15:17:20
UTC ·
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.21.200.1 (1.200.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 10:17:14.565803 2026] [security2:error] [pid 1483738:tid 14 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.21.200.1 (1.200.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 10:17:14.565803 2026] [security2:error] [pid 1483738:tid 1483781] [client 34.21.200.1:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.tapdd.com"] [uri "/.env.supabase"] [unique_id "au3venb-e35rpyFXgrujkQAAAEQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
masterguru
2026-11-06 15:04:49
UTC ·
(4 hours ago)
BAD BOT - Detected and Blocked.. Matched phrase "claudebot" at REQUEST_HEADERS:User-Agent. (1100000-122)
Bad Web Bot
🇫🇮
as211431.net
2026-11-06 14:57:32
UTC ·
(4 hours ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /docker-compose.yml
UA: Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 M ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /docker-compose.yml
UA: Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇬🇧
gws-hostmaster
2026-11-06 14:47:26
UTC ·
(4 hours ago)
ModSecurity OWASP CRS (Anomaly Score: 5): HTTP header is restricted by policy (/x-middleware-subrequest/);
Web App Attack
🇳🇱
Alt255
2026-11-06 14:45:40
UTC ·
(4 hours ago)
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.21.200.1 - - [06/Nov/2026:15:45:29 +0100] "GET /.env.supabase HTTP/2.0" 403 346 "-" "CCBot/2.0 (https://commoncrawl.org/faq/)"
...
Bad Web Bot
Web App Attack
🇿🇦
hostsec_za
2026-11-06 14:09:10
UTC ·
(5 hours ago)
Webmail Auth Attack. 246 failed logins in 10 minutes.
Brute-Force
🇮🇹
VHosting
2026-11-06 13:55:06
UTC ·
(5 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 13:53:42
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210730) triggered by 34.21.200.1 (1.200.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 08:53:36.379159 2026] [security2:error] [pid 17611:tid 1761 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.21.200.1 (1.200.21.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 08:53:36.379159 2026] [security2:error] [pid 17611:tid 17611] [client 34.21.200.1:45464] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||connect.sonoranwaterworks.com|F|2"] [data ".sonoranwaterworks.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "connect.sonoranwaterworks.com"] [uri "/z9x8c7v6b5-debug-trigger-connect.sonoranwaterworks.com"] [unique_id "au3b4MlaUg9vFA4jdb_spwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Cloud86 B.V.
2026-09-10 03:23:01
UTC ·
(1 month ago)
categories: Email Spam
Email Spam
