🇺🇸
infra-monitor
2026-09-05 02:00:05
(19 minutes ago)
Automated ban via infra-monitor: suspicious-probe
Port Scan
🇩🇪
TheDjRider
2026-09-05 01:48:09
(31 minutes ago)
CrowdSec detected Web application reconnaissance. Scenario: local/framework-recon. Automatic ban tri ...
show more
CrowdSec detected Web application reconnaissance. Scenario: local/framework-recon. Automatic ban triggered. Detection time (UTC): 2026-09-05T01:48:06.948004449Z. Context: http_status=200, http_status=404
show less
Web App Attack
🇬🇧
andypiper
2026-09-05 01:02:10
(1 hour ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇫🇷
vtchost.com
2026-09-05 00:49:06
(1 hour ago)
forbidden http request, scanning for weaknesses
...
Web App Attack
🇺🇸
lavnet.net
2026-09-05 00:28:14
(1 hour ago)
93.123.109.250 - - [05/Sep/2026:00:28:14 +0000] "GET /portal/.env HTTP/2.0" 404 1923 "-" "Mozilla/5. ...
show more
93.123.109.250 - - [05/Sep/2026:00:28:14 +0000] "GET /portal/.env HTTP/2.0" 404 1923 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36"
93.123.109.250 - - [05/Sep/2026:00:28:14 +0000] "GET /new/.env HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36"
93.123.109.250 - - [05/Sep/2026:00:28:14 +0000] "GET /dev/.env HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36"
93.123.109.250 - - [05/Sep/2026:00:28:14 +0000] "GET /app/.env HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36"
93.123.109.250 - - [05/Sep/2026:00:28:14 +0000] "GET /api/.env HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.3
...
show less
Brute-Force
🇺🇸
paulo.apoloni
2026-09-05 00:12:00
(2 hours ago)
93.123.109.250 - - [04/Sep/2026:21:11:57 -0300] "GET /.git/HEAD HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Wi ...
show more
93.123.109.250 - - [04/Sep/2026:21:11:57 -0300] "GET /.git/HEAD HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36"
93.123.109.250 - - [04/Sep/2026:21:11:57 -0300] "GET /.git/HEAD HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36"
93.123.109.250 - - [04/Sep/2026:21:11:58 -0300] "GET /.git/HEAD HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36"
93.123.109.250 - - [04/Sep/2026:21:11:59 -0300] "GET /.git/HEAD HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36"
93.123.109.250 - - [04/Sep/2026:21:11:59 -0300] "GET /.git/HEAD HTTP/2.0" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-09-04 23:52:05
(2 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: app.budyn.top | URI: /.git/HEAD | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇨🇦
Anytech
2026-09-04 22:02:11
(4 hours ago)
Blocked by ConnMonitor
Web App Attack
🇺🇸
dot.mg
2026-09-04 21:55:01
(4 hours ago)
Bad behaviour
Web Spam
🇺🇸
TPI-Abuse
2026-09-04 21:50:13
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 93.123.109.250 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 93.123.109.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 17:50:01.619999 2026] [security2:error] [pid 2521:tid 2521] [client 93.123.109.250:43568] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "amazeconsultants.org"] [uri "/.git/HEAD"] [unique_id "aps9CXyWRUxn9aN8oNxOhQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 21:26:05
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 93.123.109.250 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 93.123.109.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 17:25:57.370328 2026] [security2:error] [pid 10098:tid 10098] [client 93.123.109.250:39278] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "allotrope.com"] [uri "/.git/HEAD"] [unique_id "aps3ZeqmJd8fcco-ISW1cAAAAB8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
as211431.net
2026-09-04 21:19:38
(4 hours ago)
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: BLOCK
Protocol: HTTP/2 (GET method) ...
show more
Triggered Cloudflare WAF (firewallCustom) from NL.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /.git/HEAD
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇷
Baking333
2026-09-04 21:09:50
(5 hours ago)
[redacted] 93.123.109.250 - - [04/Sep/2026:22:09:48 +0100] "GET /.git/HEAD HTTP/1.1" 302 1534 0/4140 ...
show more
[redacted] 93.123.109.250 - - [04/Sep/2026:22:09:48 +0100] "GET /.git/HEAD HTTP/1.1" 302 1534 0/41408 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36" [redacted] 93.123.109.250 - - [04/Sep/2026:22:09:48 +0100] "GET /.svn/[redacted] HTTP/1.1" 302 1534 0/37088 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/116.0.0.0 Safari/537.36"
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-04 21:01:07
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 93.123.109.250 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 93.123.109.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 17:00:59.680045 2026] [security2:error] [pid 1428:tid 1428] [client 93.123.109.250:59824] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "amychop.com"] [uri "/.git/HEAD"] [unique_id "apsxi-R7sCNqTLSsRodNMgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
iulianh
2026-09-04 20:58:40
(5 hours ago)
80,443
Brute-Force
SSH