🇹🇷
rtbh.com.tr
2025-11-27 20:10:10
UTC ·
(11 months ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇬🇧
[email protected]
2025-11-27 00:53:14
UTC ·
(11 months ago)
...
Brute-Force
SSH
🇲🇾
Rizzy
2025-11-27 00:47:09
UTC ·
(11 months ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 23:53:31
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 18:53:25.334209 2025] [security2:error] [pid 4025:tid 4025] [client 52.254.84.116:6090] ModS ...
show more
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 18:53:25.334209 2025] [security2:error] [pid 4025:tid 4025] [client 52.254.84.116:6090] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.pandahh.com"] [uri "/user/.env"] [unique_id "aSeS9YLWU17EyI63QMuIWQAAAAE"], referer: https://duckduckgo.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 23:02:06
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 18:02:01.667656 2025] [security2:error] [pid 31220:tid 31220] [client 52.254.84.116:5475] Mo ...
show more
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 18:02:01.667656 2025] [security2:error] [pid 31220:tid 31220] [client 52.254.84.116:5475] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wisecoautomotive.com"] [uri "/user/.env"] [unique_id "aSeG6UpRTcObjJa8ob9J9QAAAA8"], referer: https://www.bing.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2025-11-26 23:01:23
UTC ·
(11 months ago)
Auto-ban: >3000 req/min op 2025-11-26
Hacking
Web App Attack
SSH
🇺🇸
TPI-Abuse
2025-11-26 20:29:31
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:29:27.941395 2025] [security2:error] [pid 30829:tid 30829] [client 52.254.84.116:3882] Mo ...
show more
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 15:29:27.941395 2025] [security2:error] [pid 30829:tid 30829] [client 52.254.84.116:3882] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.thehallway.net"] [uri "/user/.env"] [unique_id "aSdjJ2rnsDTdmXQcE7BLFAAAABo"], referer: https://www.bing.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 19:57:20
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 14:57:07.937264 2025] [security2:error] [pid 2379:tid 2379] [client 52.254.84.116:7907] ModS ...
show more
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 14:57:07.937264 2025] [security2:error] [pid 2379:tid 2379] [client 52.254.84.116:7907] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tmcomic.flyingdodostudio.com"] [uri "/user/.env"] [unique_id "aSdbk1Q5qJooDBELIQBlXAAAAAc"], referer: https://www.google.de/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
Burayot
2025-11-26 19:33:03
UTC ·
(11 months ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 52.254.84.116 (US/United States/-): 2 in the last 3600 secs
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 18:14:30
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 13:14:25.351272 2025] [security2:error] [pid 7367:tid 7367] [client 52.254.84.116:5558] ModS ...
show more
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 13:14:25.351272 2025] [security2:error] [pid 7367:tid 7367] [client 52.254.84.116:5558] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.comicpreservation.com"] [uri "/user/.env"] [unique_id "aSdDgSm0aFPMSEC-m88HHAAAAAQ"], referer: https://www.google.co.uk/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ghostwarriors
2025-11-26 17:50:05
UTC ·
(11 months ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 15:40:43
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 10:40:39.644477 2025] [security2:error] [pid 24350:tid 24350] [client 52.254.84.116:3200] Mo ...
show more
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 10:40:39.644477 2025] [security2:error] [pid 24350:tid 24350] [client 52.254.84.116:3200] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.celiaconaway.com"] [uri "/user/.env"] [unique_id "aScfd3df_HLn87Q57xYh-QAAAAc"], referer: https://www.google.fr/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 14:38:24
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 09:38:18.069748 2025] [security2:error] [pid 2298:tid 2298] [client 52.254.84.116:8387] ModS ...
show more
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 09:38:18.069748 2025] [security2:error] [pid 2298:tid 2298] [client 52.254.84.116:8387] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "register-yacht-turkey.com"] [uri "/user/.env"] [unique_id "aScQ2ipJeXhXXkZeJvfirQAAAAc"], referer: https://www.yahoo.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
pinguin
2025-11-26 12:12:27
UTC ·
(11 months ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /phpinfo.php
UA: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/119.0.6045.109 Mo ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /phpinfo.php
UA: Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/119.0.6045.109 Mobile/15E148 Safari/604.1
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2025-11-26 11:53:37
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 06:53:32.042156 2025] [security2:error] [pid 31539:tid 31539] [client 52.254.84.116:8841] Mo ...
show more
(mod_security) mod_security (id:210492) triggered by 52.254.84.116 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 06:53:32.042156 2025] [security2:error] [pid 31539:tid 31539] [client 52.254.84.116:8841] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.dianamead.com"] [uri "/user/.env"] [unique_id "aSbqPJYQSoot4avHyopFNwAAAAI"], referer: https://www.google.com/
show less
Brute-Force
Bad Web Bot
Web App Attack