🇸🇪
vaia.cloud
2026-10-29 10:15:01
(4 days ago)
crowdsecurity/http-cve-probing
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-10-29 09:51:21
(4 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: shop.definitelynotahoneypot.top | URI: /wp-json/batch/ ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: shop.definitelynotahoneypot.top | URI: /wp-json/batch/v1 | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"AU","Cf-Connecting-Ip":"170.64.163.177","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a52147f71eb96cd5-SYD","Connection":"Keep-Alive","Accept-Encoding":"gzip, br","X-Forwarded-For":"170.64.163.177"}
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-29 07:02:43
(5 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: grafana.teddypot.store | URI: /wp-json/batch/v1 | UA: ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Unknown Bot / General Web Recon. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: grafana.teddypot.store | URI: /wp-json/batch/v1 | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"AU","Cf-Connecting-Ip":"170.64.163.177","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a52050f3dec537b2-SYD","Connection":"Keep-Alive","Accept-Encoding":"gzip, br","X-Forwarded-For":"170.64.163.177"}
show less
Bad Web Bot
Web App Attack
🇩🇪
EGP Abuse Dept
2026-10-29 04:34:15
(5 days ago)
Scanning for web/db/file exploits on www.metalak.nl
SQL Injection
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-29 04:13:49
(5 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: status.astropot.tech | URI: /wp-login.php | UA: Mozilla/5.0 | ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: status.astropot.tech | URI: /wp-login.php | UA: Mozilla/5.0 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"AU","Cf-Connecting-Ip":"170.64.163.177","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a51f598d2acb3779-SYD","Connection":"Keep-Alive","Accept":"*\/*","Accept-Encoding":"gzip, br","X-Forwarded-For":"170.64.163.177"}
show less
Bad Web Bot
Web App Attack
2026-10-15 04:33:16
(2 weeks ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
🇬🇧
openstrike.co.uk
2026-10-14 05:14:27
(2 weeks ago)
5 attacks on Laravel URLs, env grabbing URLs, PHP URLs, VC URLs, site downloads (type 2):
GET /_ignition/execute-solution HTTP/1.1
GET /.env HTTP/1.1
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
GET /.git/config HTTP/1.1
GET /dem ...
show more
5 attacks on Laravel URLs, env grabbing URLs, PHP URLs, VC URLs, site downloads (type 2):
GET /_ignition/execute-solution HTTP/1.1
GET /.env HTTP/1.1
POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1
GET /.git/config HTTP/1.1
GET /demo HTTP/1.1
show less
Web App Attack
Hacking
🇳🇱
homeshowdomain.nl
2026-10-13 22:00:00
(2 weeks ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-12.
Web App Attack
SSH
Hacking
🇪🇸
NinJa
2026-10-13 12:28:00
(2 weeks ago)
Illegal Resource Access
Brute-Force
Web App Attack
2026-10-13 12:22:28
(2 weeks ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 12:19:19
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 170.64.163.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 08:19:14.694832 2026] [security2:error] [pid 8804:tid 8804] [client 170.64.163.177:45564] M ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.163.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 08:19:14.694832 2026] [security2:error] [pid 8804:tid 8804] [client 170.64.163.177:45564] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tek-front.com"] [uri "/.env"] [unique_id "as4hwuGADpzxR1IUj1KjogAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-13 11:34:13
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 170.64.163.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 07:34:06.106113 2026] [security2:error] [pid 11461:tid 11461] [client 170.64.163.177:56164] ...
show more
(mod_security) mod_security (id:210492) triggered by 170.64.163.177 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 13 07:34:06.106113 2026] [security2:error] [pid 11461:tid 11461] [client 170.64.163.177:56164] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tedmccachren.com"] [uri "/.env"] [unique_id "as4XLtPYX9bo6V4hpMzGWQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
maxpower
2026-10-13 11:21:19
(2 weeks ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 170.64.163.177 (AU/Australia/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 170.64.163.177 - - [13/Oct/2026:13:21:16 +0200] "POST /vendor/phpunit/p ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 170.64.163.177 (AU/Australia/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 170.64.163.177 - - [13/Oct/2026:13:21:16 +0200] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/2.0" 200 4839 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36" "-" host=tecnousatopescara.it
show less
Port Scan
🇧🇷
Halux
2026-10-13 11:19:40
(2 weeks ago)
170.64.163.177 Probing protected path or service
Web App Attack
🇭🇳
soporte
2026-10-13 11:12:02
(2 weeks ago)
Probe for vulnerabilities. Path attempted: /.env
Web App Attack
