🇵🇱
Budyn
2026-10-15 13:54:44
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: sql.goblinpot.store | URI: /.env | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇧🇷
ICS Labs
2026-10-15 13:44:41
(1 week ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-10-15 UTC.
Brute-Force
🇩🇪
ghostwarriors
2026-10-15 07:20:05
(1 week ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
netman
2026-10-15 07:13:53
(1 week ago)
34.50.75.89 evellere.uk - [15/Oct/2026:07:12:58 +0000] "GET /.env HTTP/1.1" 404 158 "-" "Mozilla/5.0 ...
show more
34.50.75.89 evellere.uk - [15/Oct/2026:07:12:58 +0000] "GET /.env HTTP/1.1" 404 158 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0"
34.50.75.89 evellere.uk - [15/Oct/2026:07:12:58 +0000] "GET /.env HTTP/1.1" 301 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15"
34.50.75.89 evellere.uk - [15/Oct/2026:07:12:59 +0000] "GET /.env HTTP/1.1" 404 158 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1"
34.50.75.89 evellere.uk - [15/Oct/2026:07:12:59 +0000] "GET /.env.local HTTP/1.1" 301 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.50.75.89 evellere.uk - [15/Oct/2026:07:13:00 +0000] "GET /.env.production HTTP/1.1" 301 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) Ap
...
show less
DDoS Attack
Web App Attack
🇵🇱
Budyn
2026-10-15 06:56:43
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: k8s.teddypot.store | URI: /.env | UA: Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-10-15 05:45:02
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
Alt255
2026-10-15 05:11:28
(1 week ago)
[livebd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Examp ...
show more
[livebd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.50.75.89 - - [15/Oct/2026:07:11:17 +0200] "GET /.env HTTP/1.1" 404 16938 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36 Edg/130.0.0.0"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 04:06:38
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 34.50.75.89 (89.75.50.34.bc.googleusercontent.c ...
show more
(mod_security) mod_security (id:210492) triggered by 34.50.75.89 (89.75.50.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 00:06:31.013835 2026] [security2:error] [pid 18498:tid 18498] [client 34.50.75.89:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "uni-plan.com"] [uri "/.env"] [unique_id "atBRR2CLGUZAH3fjO2Gy3wAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-10-14 23:35:14
(1 week ago)
{"level":"info","ts":1792020804.4739015,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1792020804.4739015,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.50.75.89","remote_port":"48976","client_ip":"34.50.75.89","proto":"HTTP/1.1","method":"GET","host":"jihgfedcbaupdate.987654321update.dgnvuwww.www.www.www.status.quarks-erp.com","uri":"/.env","headers":{"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15"]}},"bytes_read":0,"user_id":"","duration":0.000062339,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://jihgfedcbaupdate.987654321update.dgnvuwww.www.www.www.status.quarks-erp.com/.env"],"Content-Type":[]}}
{"level":"info","ts":1792020805.5761673,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.50.75.89","remote_port":"48982","client_ip":"34.50.75.89","proto":"HTTP/1.1","method":"GET","host":"jihgfedcbaupdate.987654321update.dgnvuwww.www.www.www.status.
...
show less
DDoS Attack
Web App Attack
🇨🇭
leo1305
2026-10-14 18:15:48
(1 week ago)
CrowdSec detection | scenario: http-probing
Port Scan
Web App Attack
🇩🇪
IVski.com
2026-10-14 01:34:44
(1 week ago)
IVski WAF | Webshell probe detected - requesting common script extensions
Hacking
Brute-Force
Web App Attack
🇺🇸
RamSet
2026-10-13 18:02:17
(1 week ago)
[swy] HTTP-Probe on port 443 (via domain). 132 distinct paths probed in 1min. Sustained 278 req/min, ...
show more
[swy] HTTP-Probe on port 443 (via domain). 132 distinct paths probed in 1min. Sustained 278 req/min, 125 nonexistent paths (404). Paths: /.env, /.env.local, /.env.production, /.env.staging, /.env.development, /.env.backup, /.env.bak, /.env.old, /.env.swp, /.env.save, /.env.dist, /.env.example, /.env.sample, /.env.template, /.env.js, /.git/config, /.git/config.old, /.git/config~, /.git/config.save, /.git/config.bak, /.git/credentials, /.svn/entries, /wp-config.php.bak, /wp-config.php.old, /wp-config.php.save, /wp-config.php.swp, /wp-config.php~, /.aws/credentials, /.aws/config, /.git-credentials, /.htpasswd, /actuator/env, /actuator/configprops, /.Dockerrun.aws.json, /.bash_history, /.boto, /.circleci/config.yml, /.docker/config.json, /.env_dev, /.env_local, /.envrc, /.eslintrc.json, /.github/workflows/deploy.yml, /.github/workflows/main.yml, /.gitlab-ci.yaml, /.gitlab-ci.yml, /.kube/config, /.msmtprc, /.my.cnf, /.netrc, /.npmrc, /.pgpass, /.pypirc, /.s3cfg, /.s3cmd.ini, …
show less
Bad Web Bot
Web App Attack
🇵🇱
lns.bz
2026-10-13 10:35:14
(1 week ago)
Web app attack [PL.Lu]
Exploited Host
Web App Attack
🇳🇱
Site.eu
2026-10-13 09:37:26
(1 week ago)
Excessive multi-domain requests
Brute-Force
🇫🇮
JRID
2026-10-13 04:28:19
(1 week ago)
Detected by CrowdSec + Suricata IDS: automated attack/scan against web servers.
Brute-Force
Web App Attack
