This IP address has been reported a total of
8
times from
7 distinct
sources.
69.48.203.38 was first reported on
October 17th 2026 , and the most recent report was
16 hours ago France
with 4
reports;
United States of America
with 3
reports;
Netherlands
with 1
report.
The most common categories in these recent reports were:
Web App Attack
6
times;
Bad Web Bot
5
times;
Brute-Force
3
times;
Hacking
1
time;
Exploited Host
1
time.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
1gz
2026-10-17 17:04:35
(16 hours ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET meth ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /wp-config.php-backup
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-10-17 14:13:46
(19 hours ago)
Web App Attack
Brute-Force
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 13:56:33
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 69.48.203.38 (ip69-48-203-38.pbiaas.com): 1 in ...
show more
(mod_security) mod_security (id:210492) triggered by 69.48.203.38 (ip69-48-203-38.pbiaas.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 09:56:26.645542 2026] [security2:error] [pid 394:tid 394] [client 69.48.203.38:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "echelonts.com"] [uri "/.env"] [unique_id "atN-iszbYXa4hRdzV27ztQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
lindi
2026-10-17 13:52:44
(19 hours ago)
trying to access .env file
...
Hacking
Web App Attack
🇫🇷
GabrielJST
2026-10-17 13:52:22
(19 hours ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 69.48.203.38 (US/Uni ...
show more
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 69.48.203.38 (US/United States/ip69-48-203-38.pbiaas.com)
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-17 13:39:20
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 69.48.203.38 (ip69-48-203-38.pbiaas.com): 1 in ...
show more
(mod_security) mod_security (id:210492) triggered by 69.48.203.38 (ip69-48-203-38.pbiaas.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 09:39:16.413715 2026] [security2:error] [pid 14950:tid 14950] [client 69.48.203.38:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.rodrigoaldecoa.com"] [uri "/.env"] [unique_id "atN6hJmbELYwFqgpSzuP6AAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
j-tap
2026-10-17 13:32:33
(19 hours ago)
WordPress honeypot: automated scanner (xmlrpc / installer / .env / direct login POST)
Web App Attack
🇳🇱
Alt255
2026-10-17 13:32:03
(19 hours ago)
[cb-03al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-03al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 69.48.203.38 - - [17/Oct/2026:15:31:43 +0200] "GET /.env HTTP/2.0" 404 394 "-" "python-requests/2.26.0"
...
show less
Bad Web Bot
Web App Attack
Showing 1 to
8
of 8 reports
