🇨🇭
TheCoon
2026-11-13 07:24:07
UTC ·
(22 hours ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-11-08 11:12:41
UTC ·
(5 days ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-24 16:34:00
UTC ·
(2 weeks ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-23 06:39:04
UTC ·
(3 weeks ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-21 07:00:24
UTC ·
(3 weeks ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇮🇳
evicky2002
2026-07-06 15:38:20
UTC ·
(4 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇳🇿
Antinson
2026-05-15 08:38:36
UTC ·
(5 months ago)
Requests to unauthorized or suspicious endpoints (.git, .well-known, .php, etc.)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-05-15 07:29:07
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 35.221.145.4 (4.145.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 03:29:01.421454 2026] [security2:error] [pid 30040:tid 30 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.221.145.4 (4.145.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 03:29:01.421454 2026] [security2:error] [pid 30040:tid 30040] [client 35.221.145.4:44446] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thebrightstonesolution.com"] [uri "/.git/config"] [unique_id "agbLPZzZ7g0zb0BGP_re-gAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
aranguren.org
2026-05-15 06:59:26
UTC ·
(5 months ago)
35.221.145.4 - - [15/May/2026:16:58:17 +1000] "GET /.git/config HTTP/1.1" 200 341 "-" "Mozilla/5.0 (Linux; Android 9; HMA-L29) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"
35.221.145.4 - - [15/May/2026:16:59:25 +1 ...
show more
35.221.145.4 - - [15/May/2026:16:58:17 +1000] "GET /.git/config HTTP/1.1" 200 341 "-" "Mozilla/5.0 (Linux; Android 9; HMA-L29) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.111 Mobile Safari/537.36"
35.221.145.4 - - [15/May/2026:16:59:25 +1000] "GET /.git/config HTTP/1.1" 200 341 "-" "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0"
35.221.145.4 - - [15/May/2026:16:59:25 +1000] "GET /.git/info/ HTTP/1.1" 200 932 "-" "Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.0"
...
show less
Web App Attack
🇩🇪
kommunos
2026-05-15 06:33:14
UTC ·
(5 months ago)
/.git/config
Web App Attack
🇬🇧
pinguin
2026-05-15 06:07:19
UTC ·
(5 months ago)
Triggered Cloudflare WAF (firewallManaged) from TW.
Action taken: LOG
Protocol: HTTP/1.1 (GET method)
Endpoint: /.git/config
UA: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/76.0.3809.81 Mobile ...
show more
Triggered Cloudflare WAF (firewallManaged) from TW.
Action taken: LOG
Protocol: HTTP/1.1 (GET method)
Endpoint: /.git/config
UA: Mozilla/5.0 (iPhone; CPU iPhone OS 12_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/76.0.3809.81 Mobile/15E148 Safari/605.1
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇷
masterguru
2026-05-15 05:51:16
UTC ·
(5 months ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 35.221.145.4 (TW/Taiwan/4.145.221.35.bc.googleusercontent.com): 1 in the last 3600 secs (0-195)
Hacking
🇨🇦
polycoda
2026-05-15 05:41:20
UTC ·
(5 months ago)
AutoBlock: ⚙️ Configuration File Access (Non Decay-Based)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 05:39:51
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 35.221.145.4 (4.145.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 01:39:45.277390 2026] [security2:error] [pid 9152:tid 915 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.221.145.4 (4.145.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 15 01:39:45.277390 2026] [security2:error] [pid 9152:tid 9152] [client 35.221.145.4:38242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.lavozdominicana.com"] [uri "/.git/config"] [unique_id "agaxodvW3nNCcAiZ1K_2ogAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-15 03:32:33
UTC ·
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 35.221.145.4 (4.145.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 23:32:26.422349 2026] [security2:error] [pid 19833:tid 19 ...
show more
(mod_security) mod_security (id:210492) triggered by 35.221.145.4 (4.145.221.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 14 23:32:26.422349 2026] [security2:error] [pid 19833:tid 19833] [client 35.221.145.4:35634] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.aiinlocal.com.verdadesreales.com"] [uri "/.git/config"] [unique_id "agaTyn6Tppg-LK4MsNKsJQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
