🇵🇱
Budyn
2026-10-30 03:44:58
(11 minutes ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cdn.dont-eat-the-pudding.top | URI: /.well-kno ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cdn.dont-eat-the-pudding.top | URI: /.well-known/ | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0 | BODY: [Empty / GET Request] | HEADERS: {"Accept-Encoding":"gzip, br","Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"US","Cf-Connecting-Ip":"35.238.129.244","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a5276cad2a36dade-ORD","X-Forwarded-For":"35.238.129.244","X-Waf-Trigger":"1"}
show less
Hacking
Web App Attack
🇫🇷
Zundapper
2026-10-30 03:31:20
(25 minutes ago)
35.238.129.244 - - [30/Oct/2026:04:31:18 +0100] "GET /WP/ HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0"
35.238.129.244 - - [30/Oct/2026:04:31:18 +0100] "GET /bc/ HTTP/1.1" 404 548 "-" "Mozilla/5 ...
show more
35.238.129.244 - - [30/Oct/2026:04:31:18 +0100] "GET /WP/ HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0"
35.238.129.244 - - [30/Oct/2026:04:31:18 +0100] "GET /bc/ HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0"
35.238.129.244 - - [30/Oct/2026:04:31:18 +0100] "GET /bk/ HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0"
35.238.129.244 - - [30/Oct/2026:04:31:19 +0100] "GET /db/ HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0"
35.238.129.244 - - [30/Oct/2026:04:31:19 +0100] "GET /js/ HTTP/1.1" 404 548 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0"
...
show less
Web App Attack
Port Scan
🇩🇪
macrob
2026-10-30 03:18:20
(38 minutes ago)
2026/10/30 03:18:16 [error] 3346446#3346446: *11561343 access forbidden by rule, client: 35.238.129.244, server: cdn.binixocrm.com, request: "GET /.env/ HTTP/1.1", host: "cdn.binixocrm.com"
2026/10/30 03:18:17 [error] 3346446#3346446: *11561343 acces ...
show more
2026/10/30 03:18:16 [error] 3346446#3346446: *11561343 access forbidden by rule, client: 35.238.129.244, server: cdn.binixocrm.com, request: "GET /.env/ HTTP/1.1", host: "cdn.binixocrm.com"
2026/10/30 03:18:17 [error] 3346446#3346446: *11561343 access forbidden by rule, client: 35.238.129.244, server: cdn.binixocrm.com, request: "GET /.tmb/ HTTP/1.1", host: "cdn.binixocrm.com"
2026/10/30 03:18:19 [error] 3346446#3346446: *11561343 access forbidden by rule, client: 35.238.129.244, server: cdn.binixocrm.com, request: "GET /admin/ HTTP/1.1", host: "cdn.binixocrm.com"
...
show less
Web App Attack
🇫🇷
✨
2026-10-30 03:03:11
(53 minutes ago)
Rule : Security
IP in black list
Port Scan
Hacking
Brute-Force
🇩🇪
Philister11
2026-10-30 02:38:50
(1 hour ago)
CrowdSec: crowdsecurity/http-admin-interface-probing (US/AS396982)
Web App Attack
Hacking
🇫🇮
sibahota
2026-10-30 02:12:03
(1 hour ago)
35.238.129.244 - - [30/Oct/2026:02:11:59 +0000] campaigns.dexcy.in "GET /WP/ HTTP/1.1" 404 1276 0.001 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0" 172.18.0.1:9500 404 0.001 "http://campaigns.dexcy.in/WP/"
35.238 ...
show more
35.238.129.244 - - [30/Oct/2026:02:11:59 +0000] campaigns.dexcy.in "GET /WP/ HTTP/1.1" 404 1276 0.001 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0" 172.18.0.1:9500 404 0.001 "http://campaigns.dexcy.in/WP/"
35.238.129.244 - - [30/Oct/2026:02:12:00 +0000] campaigns.dexcy.in "GET /bc/ HTTP/1.1" 404 1276 0.001 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0" 172.18.0.1:9500 404 0.000 "http://campaigns.dexcy.in/bc/"
35.238.129.244 - - [30/Oct/2026:02:12:00 +0000] campaigns.dexcy.in "GET /bk/ HTTP/1.1" 404 1276 0.001 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0" 172.18.0.1:9500 404 0.000 "http://campaigns.dexcy.in/bk/"
35.238.129.244 - - [30/Oct/2026:02:12:00 +0000] campaigns.dexcy.in "GET /db/ HTTP/1.1" 404 1276 0.001 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0" 172.18.0.1:9500 404 0.001 "http://campaigns.dexcy.in/db/"
35.238.129.244 - - [30/O
...
show less
Bad Web Bot
Web App Attack
🇨🇦
Sakusen
2026-10-30 02:09:32
(1 hour ago)
Automated web attack: 131 reqs, 127 paths probed, 105 returned 404; probed: 127 .php
Hacking
Bad Web Bot
Web App Attack
🇳🇱
xlusions
2026-10-30 02:09:14
(1 hour ago)
Automated vulnerability scan detected (e.g. /fwe.php).
Web App Attack
Port Scan
🇬🇧
andypiper
2026-10-30 02:00:26
(1 hour ago)
CrowdSec ban for AbuseIPDB Top List
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-10-30 01:37:22
(2 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cdn.astropot.store | URI: /wp-admin/ | UA: Mozilla/5.0 (Windo ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: WP Path Scanning (Recon). Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cdn.astropot.store | URI: /wp-admin/ | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0 | BODY: [Empty / GET Request] | HEADERS: {"Accept-Encoding":"gzip, br","Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"US","Cf-Connecting-Ip":"35.238.129.244","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a526b1c1eadbeb58-ORD","X-Forwarded-For":"35.238.129.244"}
show less
Bad Web Bot
Web App Attack
🇫🇮
albionfreemarket.com
2026-10-30 01:31:50
(2 hours ago)
35.238.129.244 - - [30/Oct/2026:01:31:49 +0000] "GET /graphql/ HTTP/2.0" 403 171 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 Chrome/131.0.0.0" 0.000 "-" "US"
...
Bad Web Bot
Web App Attack
🇩🇪
JLKnoch Software GmbH
2026-10-30 01:16:16
(2 hours ago)
CrowdSec crowdsecurity/http-backdoors-attempts
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 00:58:35
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.238.129.244 (244.129.238.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 20:58:29.108994 2026] [security2:error] [pid 4466:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 35.238.129.244 (244.129.238.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 20:58:29.108994 2026] [security2:error] [pid 4466:tid 4466] [client 35.238.129.244:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cdn-0.socialstudiesforkids.com"] [uri "/.env/"] [unique_id "auPrtbgfSJsXZ5OnOTR0oAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
itxworks.com
2026-10-30 00:44:47
(3 hours ago)
Honeypot hit: web probing / scanner. Auto-reported by CrowdSec.
Web App Attack
Bad Web Bot
2026-10-30 00:03:57
(3 hours ago)
[Thu Oct 29 13:10:43.057971 2026] [proxy_fcgi:error] [pid 4072982:tid 4073080] [client 35.238.129.244:40840] AH01071: Got error 'Primary script unknown'
[Thu Oct 29 13:10:50.423247 2026] [proxy_fcgi:error] [pid 4072982:tid 4073097] [client 35.238.129 ...
show more
[Thu Oct 29 13:10:43.057971 2026] [proxy_fcgi:error] [pid 4072982:tid 4073080] [client 35.238.129.244:40840] AH01071: Got error 'Primary script unknown'
[Thu Oct 29 13:10:50.423247 2026] [proxy_fcgi:error] [pid 4072982:tid 4073097] [client 35.238.129.244:40840] AH01071: Got error 'Primary script unknown'
[Thu Oct 29 13:10:43.057971 2026] [proxy_fcgi:error] [pid 4072982:tid 4073080] [client 35.238.129.244:40840] AH01071: Got error 'Primary script unknown'
...
show less
Brute-Force
Web App Attack
