🇻🇮
Axel
2026-11-13 05:35:12
UTC ·
(4 hours ago)
WAF/ModSecurity blocked 2 malicious request(s) (HTTP 403) from this IP. Activity: query_string: remote php execute x2. Latest: 2026-11-13T05:35:12Z.
Hacking
Web App Attack
🇻🇮
Axel
2026-11-13 05:35:09
UTC ·
(4 hours ago)
WAF/ModSecurity blocked 177 malicious request(s) (HTTP 403) from this IP. Activity: Crawler - ClaudeBot x54; request_uri: .ENV Files x41; Crawler - OpenAI x28; cPGuard - Bad Bot/UserAgent detected and blocked. x16; Crawler - ChatGPT x12; request_uri: ...
show more
WAF/ModSecurity blocked 177 malicious request(s) (HTTP 403) from this IP. Activity: Crawler - ClaudeBot x54; request_uri: .ENV Files x41; Crawler - OpenAI x28; cPGuard - Bad Bot/UserAgent detected and blocked. x16; Crawler - ChatGPT x12; request_uri: directory travel x11; blocked sensitive path x4; request_uri: hidden .php execute x2; Block *.env x2; Apache - Path Traversal x2; request_uri: read wordpress configuration file x1; request_uri: read joomla configuration file x1; request_uri: .PHP backup files x1; query_string: remote php execute x1; Malicious IP behind the proxy detected x1. Latest: 2026-11-13T05:35:09Z.
show less
Hacking
Web App Attack
🇺🇸
interbiznw.com
2026-11-13 04:50:25
UTC ·
(4 hours ago)
malicious-web-requests-vulnerability-scanning
Hacking
Brute-Force
Exploited Host
Web App Attack
🇸🇬
Cloudkul Cloudkul
2026-11-13 04:30:23
UTC ·
(5 hours ago)
Attempted Brute Force on our application
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-11-13 04:25:35
UTC ·
(5 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇺🇸
Spider
2026-11-13 03:51:19
UTC ·
(5 hours ago)
Automated report from Atlas Development (atlas-development.net) edge protection. Systematic path enumeration detected: 10 distinct endpoints probed within 10 minutes, cycling through common CMS install-path guesses. Sample: GET /.env.supabase (404) G ...
show more
Automated report from Atlas Development (atlas-development.net) edge protection. Systematic path enumeration detected: 10 distinct endpoints probed within 10 minutes, cycling through common CMS install-path guesses. Sample: GET /.env.supabase (404) GET /.env.test (404) GET /.vite/manifest.json (404) GET /dist/.vite/manifest.json (404) GET /build/manifest.json (404) GET /dist/manifest.json (404) GET /z9x8c7v6b5-debug-trigger-atlas-development.net (404) GET /ngsw.json (404) GET /sitemap.xml (404) GET / (200)
show less
Bad Web Bot
Web App Attack
🇨🇦
Mediashaker
2026-11-13 02:02:54
UTC ·
(7 hours ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 35.190.236.26 (JP/Japan/26.236.190.35.bc.googleusercontent.com)
Bad Web Bot
🇧🇪
boxed-it
2026-11-13 00:28:25
UTC ·
(9 hours ago)
GET /config/.env.php (Tarpitted for 11s, wasted 720B)
Web App Attack
2026-11-12 23:50:23
UTC ·
(9 hours ago)
35.190.236.26 - - [12/Nov/2026:23:50:22 +0000] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/2.0" 400 294 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/p ...
show more
35.190.236.26 - - [12/Nov/2026:23:50:22 +0000] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/2.0" 400 294 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user)"
...
show less
Bad Web Bot
Web App Attack
🇫🇷
hghosting
2026-11-12 22:40:10
UTC ·
(10 hours ago)
CrowdSec auto-report: crowdsecurity/http-probing — 11 events
Brute-Force
SSH
🇺🇸
wordpresshosting.solutions
2026-11-12 22:01:29
UTC ·
(11 hours ago)
Web app vulnerability scanning detected
Web App Attack
🇵🇱
mscode.pl
2026-11-12 21:53:41
UTC ·
(11 hours ago)
Triggered Cloudflare WAF (firewallManaged) from JP.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (GET method)
Zone: as201132.net
Endpoint: /secrets.json
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0 ...
show more
Triggered Cloudflare WAF (firewallManaged) from JP.
Action taken: BLOCK
ASN: 396982 (Google LLC)
Protocol: HTTP/2 (GET method)
Zone: as201132.net
Endpoint: /secrets.json
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ClaudeBot/1.0; [email protected] )
show less
Bad Web Bot
🇮🇹
VHosting
2026-11-12 21:15:03
UTC ·
(12 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-11-12 21:07:55
UTC ·
(12 hours ago)
[mx02al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.190.236.26 - - [12/Nov/2026:22:07:36 +0100] "GET /.env.supabase HTTP/2.0" 404 1422 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); com ...
show more
[mx02al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.190.236.26 - - [12/Nov/2026:22:07:36 +0100] "GET /.env.supabase HTTP/2.0" 404 1422 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot"
...
show less
Bad Web Bot
Web App Attack
🇬🇧
pinguin
2026-11-12 20:48:29
UTC ·
(12 hours ago)
Triggered Cloudflare WAF (firewallManaged) from JP.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /dashboard
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
This repo ...
show more
Triggered Cloudflare WAF (firewallManaged) from JP.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /dashboard
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
