2026-10-11 05:05:03
(23 hours ago)
suspicious request in access.log
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 05:01:19
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 94.130.71.131 (static.131.71.130.94.clients.you ...
show more
(mod_security) mod_security (id:210492) triggered by 94.130.71.131 (static.131.71.130.94.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 01:01:14.233391 2026] [security2:error] [pid 5400:tid 5512] [client 94.130.71.131:53908] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "absurdotron.com"] [uri "/.env.prod"] [unique_id "asnGmvPKO0k7vTj1hBf6wwAAANg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇷
Halux
2026-10-08 01:24:48
(4 days ago)
94.130.71.131 Probing protected path or service
Web App Attack
🇺🇸
1gz
2026-09-14 13:36:55
(3 weeks ago)
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: CHALLENGE
Protocol: HTTP/2 (GET met ...
show more
Triggered Cloudflare WAF (firewallCustom) from DE.
Action taken: CHALLENGE
Protocol: HTTP/2 (GET method)
Endpoint: /script.js
UA: Mozilla/5.0 (iPhone; CPU iPhone OS 18_7 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.7.5 Mobile/15E148 Safari/604.1
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-05-28 05:44:53
(4 months ago)
Attac
Brute-Force
🇦🇺
screwlooseit.com.au
2026-05-19 12:36:52
(4 months ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
DE/Germany/static.131.71.130.94.clients.your-server.de
Web App Attack
2026-05-19 07:50:52
(4 months ago)
Attac
Brute-Force
🇺🇸
TPI-Abuse
2026-05-18 16:20:01
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 94.130.71.131 (static.131.71.130.94.clients.you ...
show more
(mod_security) mod_security (id:240335) triggered by 94.130.71.131 (static.131.71.130.94.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 12:19:53.823661 2026] [security2:error] [pid 21128:tid 21149] [client 94.130.71.131:50546] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 94.130.71.131 (+1 hits since last alert)|duplexgoldmine.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "duplexgoldmine.com"] [uri "/xmlrpc.php"] [unique_id "ags8KQfnHw-mfKrdI-S8vAAAAFM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-18 06:54:06
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 94.130.71.131 (static.131.71.130.94.clients.you ...
show more
(mod_security) mod_security (id:240335) triggered by 94.130.71.131 (static.131.71.130.94.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 18 02:53:58.777745 2026] [security2:error] [pid 24462:tid 24462] [client 94.130.71.131:53623] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5965"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 94.130.71.131 (+1 hits since last alert)|coyotebytes.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "coyotebytes.net"] [uri "/xmlrpc.php"] [unique_id "agq3hrb2P1CWQVbkT3N20gAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-05-18 06:24:24
(4 months ago)
Attac
Brute-Force
2026-05-13 16:07:31
(4 months ago)
Blocked: Reason='Vulnerability probing — PHP scan detected (150/60 min)'; Requests=150
Port Scan
🇺🇸
TPI-Abuse
2026-05-13 08:21:10
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 94.130.71.131 (static.131.71.130.94.clients.you ...
show more
(mod_security) mod_security (id:240335) triggered by 94.130.71.131 (static.131.71.130.94.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 04:21:02.644449 2026] [security2:error] [pid 3642:tid 3642] [client 94.130.71.131:53080] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 94.130.71.131 (+1 hits since last alert)|f40ph.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "f40ph.org"] [uri "/xmlrpc.php"] [unique_id "agQ0bvIjxpGGDeWI7yd6_QAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
abdubhai
2026-05-13 08:17:50
(4 months ago)
94.130.71.131 - - [13/May/2026:1
...
Brute-Force
🇺🇸
TPI-Abuse
2026-05-13 07:49:56
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 94.130.71.131 (static.131.71.130.94.clients.you ...
show more
(mod_security) mod_security (id:240335) triggered by 94.130.71.131 (static.131.71.130.94.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 13 03:49:48.551864 2026] [security2:error] [pid 10759:tid 10759] [client 94.130.71.131:53363] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 94.130.71.131 (+1 hits since last alert)|georgesmarina.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "georgesmarina.com"] [uri "/xmlrpc.php"] [unique_id "agQtHAzXr2vQOMoTtiL9OQAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-12 11:11:59
(4 months ago)
(mod_security) mod_security (id:240335) triggered by 94.130.71.131 (static.131.71.130.94.clients.you ...
show more
(mod_security) mod_security (id:240335) triggered by 94.130.71.131 (static.131.71.130.94.clients.your-server.de): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 12 07:11:52.011333 2026] [security2:error] [pid 2081:tid 2081] [client 94.130.71.131:55362] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 94.130.71.131 (+1 hits since last alert)|wsspy.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "wsspy.com"] [uri "/xmlrpc.php"] [unique_id "agMK-Jz38bK0TvqAjfJUtwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
