🇺🇸
kosada.com
2026-02-24 03:22:29
(4 months ago)
Web vulnerability probing: /owa/auth.owa
Web App Attack
🇪🇸
librebit
2026-02-23 00:08:00
(4 months ago)
Brute force
Brute-Force
🇫🇷
mrcrassi
2026-02-20 18:54:45
(4 months ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST meth ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /owa/auth.owa
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-02-15 10:38:45
(5 months ago)
45.74.1.249 (AL/Albania/Tirana/Tirana/-/[redacted]
Brute-Force
🇸🇪
triplecode
2026-02-12 09:41:24
(5 months ago)
Reported from hMailServer
Hacking
🇭🇺
bcsaba
2026-02-11 14:03:08
(5 months ago)
Trying to log into non-existent OWA.
45.74.1.249 - - - - [11/Feb/2026:15:03:06 +0100] "POST /owa/aut ...
show more
Trying to log into non-existent OWA.
45.74.1.249 - - - - [11/Feb/2026:15:03:06 +0100] "POST /owa/auth.owa HTTP/1.1" 400 632 "https://mail.*REDACTED*/owa/auth/logon.aspx?replaceCurrent=1&url=https%3a%2f%2fmail.*REDACTED*%2fowa%2f" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.110 Safari/537.36" "-"
show less
Web App Attack
🇩🇪
zeitschel.net
2026-02-11 05:59:28
(5 months ago)
2026-02-11 06:58:57 Unauthorized /owa/auth.owa
Hacking
Web App Attack
🇩🇪
filstal.org
2026-02-09 08:14:13
(5 months ago)
Vulnerability scan activity detected by Fail2Ban
Web App Attack
🇨🇦
polycoda
2026-02-04 09:55:45
(5 months ago)
📄 Probes for tons of inexistent files and/or PHP scripts
Hacking
Web App Attack
🇺🇸
CBJ
2026-02-02 22:51:46
(5 months ago)
fail2ban: apache-random-recon
...
Web App Attack
🇨🇭
DasBiberlein
2026-02-01 07:50:08
(5 months ago)
RdpGuard detected brute-force attempt on RDP
Brute-Force
🇷🇴
clauss
2026-01-28 19:15:02
(5 months ago)
IP reached maximum auth failures for a one day block
Brute-Force
🇺🇸
TPI-Abuse
2026-01-26 05:37:32
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 45.74.1.249 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.74.1.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jan 26 00:37:28.782804 2026] [security2:error] [pid 27273:tid 27326] [client 45.74.1.249:13112] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "unitedonegroup.com"] [uri "/.env"] [unique_id "aXb9mHutfbZCCFbMrnE4sQAAAIU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
[email protected]
2026-01-26 05:33:01
(5 months ago)
45.74.1.249 - - [26/Jan/2026:05:33:01 +0000] "HEAD /.env HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows N ...
show more
45.74.1.249 - - [26/Jan/2026:05:33:01 +0000] "HEAD /.env HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
45.74.1.249 - - [26/Jan/2026:05:33:01 +0000] "HEAD /api/.env HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
45.74.1.249 - - [26/Jan/2026:05:33:01 +0000] "HEAD /.env.production HTTP/1.1" 404 - "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-01-26 04:44:10
(5 months ago)
(mod_security) mod_security (id:210492) triggered by 45.74.1.249 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.74.1.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 25 23:44:03.282624 2026] [security2:error] [pid 24013:tid 24013] [client 45.74.1.249:40344] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "powerkiteforum.com"] [uri "/.env"] [unique_id "aXbxE6NKR0Tee1tp1tLDbgAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack