🇨🇭
TheCoon
2026-10-24 16:31:30
(1 week ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-23 06:36:32
(1 week ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇨🇭
TheCoon
2026-10-21 06:58:24
(1 week ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇩🇪
updown.io
2026-10-15 16:15:36
(2 weeks ago)
{"level":"info","ts":1792080793.5600393,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.80.69.73","remote_port":"1584","client_ip":"34.80.69.73","proto":"HTTP/1.1","method":"GET","host":"status.wyrimaps.net","uri":" ...
show more
{"level":"info","ts":1792080793.5600393,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.80.69.73","remote_port":"1584","client_ip":"34.80.69.73","proto":"HTTP/1.1","method":"GET","host":"status.wyrimaps.net","uri":"/.env","headers":{"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15"]}},"bytes_read":0,"user_id":"","duration":0.000066818,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://status.wyrimaps.net/.env"],"Content-Type":[]}}
{"level":"info","ts":1792080796.4365666,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"34.80.69.73","remote_port":"1590","client_ip":"34.80.69.73","proto":"HTTP/1.1","method":"GET","host":"status.wyrimaps.net","uri":"/.env.local","headers":{"User-Agent":["Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/
...
show less
DDoS Attack
Web App Attack
🇳🇱
Site.eu
2026-10-15 14:42:28
(2 weeks ago)
Excessive multi-domain requests
Brute-Force
🇵🇱
Budyn
2026-10-15 14:36:39
(2 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: gitlab.astropot.space | URI: /.env | UA: Mozilla/ ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: gitlab.astropot.space | URI: /.env | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
2026-10-15 03:00:33
(2 weeks ago)
[ns27.kdns.gr] httpd-config-scan: sites=www.hristospanagia.gr; logs=/var/log/httpd/domains/hristospanagia.gr.log; samples=/.env.js
Hacking
Web App Attack
🇩🇪
FD-IX
2026-10-15 01:09:03
(2 weeks ago)
Fail2Ban: ModSecurity detected a web application attack.
Bad Web Bot
Web App Attack
🇫🇮
TrafficAnalyser
2026-10-14 23:32:02
(2 weeks ago)
Probing "GET /.env HTTP/1.1"
Web App Attack
🇵🇱
Budyn
2026-10-14 22:53:56
(2 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cpanel.teddypot.site | URI: /.env | UA: Mozilla/5 ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cpanel.teddypot.site | URI: /.env | UA: Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇵🇱
itsvic.dev
2026-10-14 21:12:41
(2 weeks ago)
34.80.69.73 - - [14/Oct/2026:21:12:40 +0000] "files.itsvic.dev" "GET /.env HTTP/1.1" 404 317 176 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15"
34.80.69.73 - - [14/Oct/2026:2 ...
show more
34.80.69.73 - - [14/Oct/2026:21:12:40 +0000] "files.itsvic.dev" "GET /.env HTTP/1.1" 404 317 176 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15"
34.80.69.73 - - [14/Oct/2026:21:12:40 +0000] "files.itsvic.dev" "GET /.env HTTP/1.1" 404 317 176 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15"
34.80.69.73 - - [14/Oct/2026:21:12:40 +0000] "files.itsvic.dev" "GET /.env.local HTTP/1.1" 404 317 201 "-" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1"
...
show less
Brute-Force
Web App Attack
🇬🇧
Apache
2026-10-14 08:06:52
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 34.80.69.73 (TW/Taiwan/73.69.80.34.bc.googleusercontent.com): 5 in the last 300 secs (CF_ENABLE)
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-10-14 02:35:35
(2 weeks ago)
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.80.69.73 - - [14/Oct/2026:04:35:23 +0200] "GET /.env HTTP/1.1" 301 4591 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1. ...
show more
[ti-02ra] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.80.69.73 - - [14/Oct/2026:04:35:23 +0200] "GET /.env HTTP/1.1" 301 4591 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
IVski.com
2026-10-14 01:04:13
(2 weeks ago)
IVski WAF | Webshell probe detected - requesting common script extensions
Hacking
Brute-Force
Web App Attack
🇫🇷
masterguru
2026-10-14 00:34:35
(2 weeks ago)
Restricted File Access Attempt. Matched phrase ".env" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
