🇵🇱
sefinek.net
2026-11-06 08:46:28
UTC ·
(1 day ago)
Triggered Cloudflare WAF (firewallManaged) from DE.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /config/gcp-credentials.json | UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplex ...
show more
Triggered Cloudflare WAF (firewallManaged) from DE.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /config/gcp-credentials.json | UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; PerplexityBot/1.0; +https://perplexity.ai/perplexitybot) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
epixian
2026-11-06 06:03:13
UTC ·
(1 day ago)
Webshell / backdoor / GraphQL probe: 17 requests in 24 h, 6 with attack payloads (301 x17). Detected: sensitive file probe, path traversal. UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0;
[email protected] )
Hacking
Web App Attack
🇧🇪
cmbplf
2026-11-06 05:22:51
UTC ·
(1 day ago)
5.042 requests from abuseipdb.com blacklisted IP (1w6d23h)
Brute-Force
Bad Web Bot
🇩🇪
big-cloud.nl
2026-11-06 03:48:46
UTC ·
(1 day ago)
Try to access /api/.env.bak
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 02:54:59
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.40.116.231 (231.116.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 21:54:56.017645 2026] [security2:error] [pid 26741:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.40.116.231 (231.116.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 21:54:56.017645 2026] [security2:error] [pid 26741:tid 26741] [client 34.40.116.231:36200] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.villageofallouezwi.gov"] [uri "/.env.monorepo"] [unique_id "au1BgETD93rj6r_F_M0wOQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
nyuuzyou
2026-11-06 02:25:04
UTC ·
(1 day ago)
Web application attack requests blocked by local CrowdSec AppSec over completed HTTP/TCP on application ports 80/443. 2 matched requests; rules: crowdsecurity/vpatch-env-access, crowdsecurity/vpatch-git-config. Exact source IP locally banned. Observe ...
show more
Web application attack requests blocked by local CrowdSec AppSec over completed HTTP/TCP on application ports 80/443. 2 matched requests; rules: crowdsecurity/vpatch-env-access, crowdsecurity/vpatch-git-config. Exact source IP locally banned. Observed 2026-11-06T02:25:03Z through 2026-11-06T02:25:04Z.
show less
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-11-06 01:36:12
UTC ·
(1 day ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-11-06 01:35:39
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 34.40.116.231 (231.116.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 20:35:32.892842 2026] [security2:error] [pid 14122:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 34.40.116.231 (231.116.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 20:35:32.892842 2026] [security2:error] [pid 14122:tid 14122] [client 34.40.116.231:33438] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpanel.libertyformals.com"] [uri "/.env.supabase"] [unique_id "au0u5E1jFvubPp7Hae3u9QAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-05 22:50:06
UTC ·
(1 day ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇳🇱
Eric
2026-11-05 22:07:43
UTC ·
(1 day ago)
[Thu Nov 05 22:07:42.885111 2026] [security2:error] [pid 627362:tid 627362] [client 34.40.116.231:0] [client 34.40.116.231] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-c ...
show more
[Thu Nov 05 22:07:42.885111 2026] [security2:error] [pid 627362:tid 627362] [client 34.40.116.231:0] [client 34.40.116.231] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "pop-the-slots.com"] [uri "/z9x8c7v6b5-debug-trigger-pop-the-slots.com"] [unique_id "auz-LsTnGZxqL9L1HUHmQgAAAEA"]
[Thu Nov 05 22:07:43.366657 2026] [security2:error] [pid 620185:tid 620185] [client 34.40.116.231:0] [client 34.40.116.231] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Ex
...
show less
Hacking
Web App Attack
🇳🇱
Savvii
2026-11-05 21:51:29
UTC ·
(1 day ago)
20 attempts against mh-misbehave-ban on mensa
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-11-05 21:25:40
UTC ·
(1 day ago)
csagent: score 21.0: 404 noise floor x4, secrets grab x2; 1 domain(s) in 7s
Web App Attack
2026-11-05 21:02:00
UTC ·
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted] 34.40.116.231 (DE/Germany/231.116.40.34.bc.googleusercontent.com)
SQL Injection
🇳🇱
debestelapp
2026-11-05 20:45:09
UTC ·
(1 day ago)
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 20:34:20
UTC ·
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 34.40.116.231 (231.116.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 15:34:13.787324 2026] [security2:error] [pid 2265:tid 2 ...
show more
(mod_security) mod_security (id:210730) triggered by 34.40.116.231 (231.116.40.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 15:34:13.787324 2026] [security2:error] [pid 2265:tid 2265] [client 34.40.116.231:42846] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.sailyourkayak.com|F|2"] [data ".sailyourkayak.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.sailyourkayak.com"] [uri "/z9x8c7v6b5-debug-trigger-www.sailyourkayak.com"] [unique_id "auzoRQZk_QJKtThyRnUTcQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
