🇧🇷
guguabx
2026-10-28 10:27:30
(11 minutes ago)
Taboka Proteção: caiu na armadilha: /.aws/credentials
Web App Attack
Bad Web Bot
🇵🇱
Budyn
2026-10-28 10:24:49
(14 minutes ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: k8s.astropot.site | URI: /.dev.vars | UA: Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"SG","Cf-Connecting-Ip":"104.28.222.46","Cdn-Loop":"cloudflare; loops=1","Sec-Ch-Ua-Mobile":"?1","Accept-Encoding":"gzip, br","Accept":"text\/html,application\/xhtml+xml,applicatio
show less
Hacking
Web App Attack
🇬🇧
KTSTechnology
2026-10-28 10:23:23
(15 minutes ago)
Web vulnerability scanning detected by our ISP firewall
Web App Attack
🇹🇷
Jova
2026-10-28 10:10:43
(28 minutes ago)
Probing a web server for sensitive files (.env, backups, configs): 3 requests.
Web App Attack
🇩🇪
FeG Deutschland
2026-10-28 09:57:39
(41 minutes ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14
Exploited Host
Web App Attack
🇬🇧
consul.to
2026-10-28 09:18:08
(1 hour ago)
Web attack/malicious scanning detected
Web App Attack
🇵🇱
Budyn
2026-10-28 08:22:41
(2 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: registry.astropot.online | URI: /.env.dev | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"SG","Cf-Connecting-Ip":"104.28.222.46","Cdn-Loop":"cloudflare; loops=1","Sec-Ch-Ua":"\"Google Chrome\";v=\"135\", \"Chromium\";v=\"135\", \"Not.A\/Brand\";v=\"24\"","Accept-Encod
show less
Bad Web Bot
Web App Attack
🇸🇪
cider1725
2026-10-28 08:21:43
(2 hours ago)
104.28.222.46 - - [28/Oct/2026:08:21:39 +0000] "GET /.env.local HTTP/1.1" 444 0 "https://www.google. ...
show more
104.28.222.46 - - [28/Oct/2026:08:21:39 +0000] "GET /.env.local HTTP/1.1" 444 0 "https://www.google.com/search?q=search.thesandbox.net" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0" "-"
104.28.222.46 - - [28/Oct/2026:08:21:42 +0000] "GET /.env.development HTTP/1.1" 444 0 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; ChatGPT-User/1.0; +https://openai.com/bot)" "-"
104.28.222.46 - - [28/Oct/2026:08:21:42 +0000] "GET /.env.dev HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36" "-"
...
show less
Brute-Force
Web App Attack
🇳🇴
Bots.go.to.hell
2026-10-28 08:18:34
(2 hours ago)
This IP was detected by CrowdSec triggering custom/http-range-ban
Web App Attack
Port Scan
🇩🇪
hidemail.app
2026-10-28 07:20:13
(3 hours ago)
Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto ...
show more
Automated scan for exposed config/secret files and known web exploits (e.g. /.env, RCE probes); auto-banned by fail2ban.
show less
Web App Attack
Hacking
🇫🇷
RodGel
2026-10-28 06:46:58
(3 hours ago)
High AbuseIPDB score: 100
Web App Attack
🇦🇹
SchiWaGoA
2026-10-28 06:23:30
(4 hours ago)
fail2ban npm-scanner: Web vulnerability scanning (probing for .env, .git, phpinfo and similar files)
Web App Attack
Bad Web Bot
🇵🇱
Budyn
2026-10-28 06:16:20
(4 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: portal.astropot.tech | URI: /.env.local | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"SG","Cf-Connecting-Ip":"104.28.222.46","Cdn-Loop":"cloudflare; loops=1","Sec-Fetch-Dest":"document","Sec-Ch-Ua-Platform":"\"Windows\"","Sec-Ch-Ua-Mobile":"?0","Sec-Ch-Ua":"\"Google Chrom
show less
Bad Web Bot
Web App Attack
🇩🇪
raph
2026-10-28 06:12:00
(4 hours ago)
[DOT FILES] crawler *.env*, .git*, .config*, etc.
Bad Web Bot
Web App Attack
🇧🇪
taivas.nl
2026-10-28 05:37:40
(5 hours ago)
Many_bad_calls
Web App Attack
