🇩🇪
FeG Deutschland
2026-10-22 18:54:15
(6 seconds ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇺🇸
dot.mg
2026-10-22 18:40:36
(13 minutes ago)
Bad behaviour
Web Spam
🇩🇪
tinect
2026-10-22 18:07:15
(47 minutes ago)
Gets ban for 8h for triggering crowdsecurity/http-sensitive-files at root1.
Web App Attack
🇬🇧
consul.to
2026-10-22 17:42:25
(1 hour ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
slay3r9903
2026-10-22 16:06:11
(2 hours ago)
IP address blocked by Cloudflare security rules due to suspicious activity and security violations.
Hacking
Bad Web Bot
🇺🇸
Charlesiv
2026-10-22 16:00:25
(2 hours ago)
Triggered Cloudflare WAF (firewallCustom) from FR.
Action taken: BLOCK
ASN: 215599 (Zkillu SAS)
Prot ...
show more
Triggered Cloudflare WAF (firewallCustom) from FR.
Action taken: BLOCK
ASN: 215599 (Zkillu SAS)
Protocol: HTTP/1.1 (GET method)
Endpoint: /
Timestamp: 2026-10-22T15:08:36Z
Ray ID: a4e96b18dc488e67
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
show less
Bad Web Bot
2026-10-22 15:54:44
(2 hours ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇵🇱
Budyn
2026-10-22 15:11:44
(3 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cpanel.goblinpot.site | URI: /.env.txt | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"Accept-Encoding":"gzip, br","Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"FR","Cf-Connecting-Ip":"31.56.58.167","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a4e96fac9cdbcc0a-CDG","Accept":"*\/*","X-Forwarded-For":"31.56.58.167"}
show less
Bad Web Bot
Web App Attack
🇫🇷
lindi
2026-10-22 14:52:08
(4 hours ago)
Probing for resource vulnerabilities
...
Web Spam
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
🇦🇱
router.al
2026-10-22 14:48:20
(4 hours ago)
10/22/2026-14:48:20.072183 31.56.58.167 Protocol: 6 GPL WEB_SERVER 403 Forbidden
Port Scan
🇫🇮
as211431.net
2026-10-22 14:37:34
(4 hours ago)
Triggered Cloudflare WAF (firewallCustom) from FR.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1. ...
show more
Triggered Cloudflare WAF (firewallCustom) from FR.
Action taken: MANAGED_CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /
UA: metabase-cve-2026-72898-detect/1.0 (benign detection probes only)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
2026-10-22 14:08:39
(4 hours ago)
[Thu Oct 22 14:08:22.894280 2026] [authz_core:error] [pid 86461:tid 86509] [client 31.56.58.167:3849 ...
show more
[Thu Oct 22 14:08:22.894280 2026] [authz_core:error] [pid 86461:tid 86509] [client 31.56.58.167:38498] AH01630: client denied by server configuration: /srv/www/shop.gassycat.be/htdocs/api
[Thu Oct 22 14:08:22.902813 2026] [authz_core:error] [pid 86461:tid 86494] [client 31.56.58.167:34600] AH01630: client denied by server configuration: /srv/www/shop.gassycat.be/htdocs/api
[Thu Oct 22 14:08:37.698484 2026] [authz_core:error] [pid 84772:tid 84858] [client 31.56.58.167:47230] AH01630: client denied by server configuration: /srv/www/shop.gassycat.be/htdocs/api
[Thu Oct 22 14:08:37.906118 2026] [authz_core:error] [pid 86406:tid 86444] [client 31.56.58.167:47246] AH01630: client denied by server configuration: /srv/www/shop.gassycat.be/htdocs/api
[Thu Oct 22 14:08:38.989454 2026] [authz_core:error] [pid 84772:tid 84871] [client 31.56.58.167:47248] AH01630: client denied by server configuration: /srv/www/shop.gassycat.be/htdocs/api
...
show less
Brute-Force
🇩🇪
BlueWire Hosting
2026-10-22 12:26:56
(6 hours ago)
Aggressive scanning resulting into 404
Bad Web Bot
🇵🇱
Budyn
2026-10-22 11:40:38
(7 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: docker.dont-eat-the-pudding.top | URI: /.env.txt | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"Accept-Encoding":"gzip, br","Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"FR","Cf-Connecting-Ip":"31.56.58.167","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a4e83a72cbc4a2e6-CDG","Accept":"*\/*","X-Forwarded-For":"31.56.58.1
show less
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-22 11:35:17
(7 hours ago)
[ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 31. ...
show more
[ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 31.56.58.167 - - \[22/Oct/2026:13:35:07 +0200\] "GET /.git/HEAD HTTP/1.1" 301 604 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/126.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack