🇳🇱
Tsumugi Kotobuki
2026-11-09 08:40:28
UTC ·
(22 hours ago)
Port Scan on Honeypot | Ports: 445/SMB | Proto: TCP(1) | Flags: all SYN | TTL: 110 | Len: 48B | Win: 8192(1) | F2B/ufw-honeypot@2026-11-09T08:40:28Z
Port Scan
Hacking
🇩🇪
Coinetic AI Security
2026-11-09 00:36:49
UTC ·
(1 day ago)
Connection to a trap port: 1 attempts on port 445, 2026-11-09 00:36 - 00:36 UTC. Blocked and reported automatically by Coinetic AI Security (https://coinetic.io).
Port Scan
Hacking
🇫🇷
Kejult
2026-11-08 10:47:21
UTC ·
(1 day ago)
Honeypot Finding: SMB activity on TCP/445; 4 Dionaea events.
Port Scan
🇫🇷
thecocasio
2026-11-08 08:26:18
UTC ·
(1 day ago)
PortSentry honeypot: unsolicited TCP connection to closed decoy port 445 (SMB) on a host running no such service. Automated port-scan detection at 2026-11-08T08:26:18Z.
Port Scan
🇫🇷
uthul
2026-11-07 18:28:09
UTC ·
(2 days ago)
T-Pot honeypot: 3 hits on ports [445] (automated)
Port Scan
Hacking
🇫🇷
vtchost.com
2026-11-07 13:09:23
UTC ·
(2 days ago)
portscan on honeypot system
...
Port Scan
🇫🇷
noi
2026-11-07 12:01:59
UTC ·
(2 days ago)
honeypot proto=TCP dpt=445 flags=SYN hits=1 window=1h
Port Scan
🇫🇷
Kejult
2026-11-07 11:25:00
UTC ·
(2 days ago)
Honeypot Finding: SMB activity on TCP/445; 3 Dionaea events.
Port Scan
🇫🇮
Birdo
2026-11-06 14:54:47
UTC ·
(3 days ago)
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands.
Observed: 2026-11-06 14:53 to 2026-11-06 14:54 UTC | 4 sessions | 16 e ...
show more
[Honeypot Report] Vulnerability exploitation attempt via SMB
An automated exploitation tool attempted to exploit CVE-2017-0144, then obtained shell access and executed commands.
Observed: 2026-11-06 14:53 to 2026-11-06 14:54 UTC | 4 sessions | 16 events | SMB (port 445)
Attack chain:
1. Exploit attempt: CVE-2017-0144
2. Shell access obtained; 6 distinct commands executed: SMB1 SESSION_SETUP_ANDX anonymous (null session granted) ; TREE_CONNECT \\<target>\IPC$ ; SMB1 NEGOTIATE (4 dialects)
Classification: scanner | Signatures: Legacy SMB1 Dialect Negotiation, SMB1 EternalBlue / MS17-010 Probe
Full evidence: https://github.com/1Birdo/lyrebird-intel/blob/main/incidents/2026/11/103.156.60.13.md
Reported by birdo.uk (Lyrebird honeypot lyrebird-01). Emulated service - no host was compromised.
show less
Exploited Host
Hacking
Port Scan
2026-11-06 13:09:22
UTC ·
(3 days ago)
denied traffic to a honeypot network. destination port 445.
Port Scan
Hacking
🇺🇸
1gz
2026-10-03 02:47:49
UTC ·
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from VN.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/bota/sulm-ajror-rus-ne-kharkiv-plagos-22-persona-dron-godet-nje-pike-karburanti-ne-kiev/1030336/
UA: Mozilla/5.0 (Windows NT 10.0; ...
show more
Triggered Cloudflare WAF (firewallCustom) from VN.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/bota/sulm-ajror-rus-ne-kharkiv-plagos-22-persona-dron-godet-nje-pike-karburanti-ne-kiev/1030336/
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇷
bigorre.org
2026-09-26 15:29:27
UTC ·
(1 month ago)
Unidentified crawling: not a self-announced bot in user-agent
Bad Web Bot
🇺🇸
1gz
2026-09-23 15:21:27
UTC ·
(1 month ago)
Triggered Cloudflare WAF (firewallCustom) from VN.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/kuvendi-e-kalon-ne-shqyrtim-reformen-territoriale-pa-perfunduar-konsultimet-publike/1024637/
UA: Mozilla/5.0 (Windows NT 6.3; Win6 ...
show more
Triggered Cloudflare WAF (firewallCustom) from VN.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /lajme/kuvendi-e-kalon-ne-shqyrtim-reformen-territoriale-pa-perfunduar-konsultimet-publike/1024637/
UA: Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3208.186 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
kosada.com
2026-09-21 02:22:51
UTC ·
(1 month ago)
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=29&topics%5B2%5D=32&topics%5B3%5D=81&topics%5B4%5D=31 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko ...
show more
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=29&topics%5B2%5D=32&topics%5B3%5D=81&topics%5B4%5D=31 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0")
show less
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-15 01:22:27
UTC ·
(1 month ago)
(mod_security) mod_security (id:210730) triggered by 103.156.60.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 21:22:19.547320 2026] [security2:error] [pid 24446:tid 24446] [client 103.156.60.13:13623] M ...
show more
(mod_security) mod_security (id:210730) triggered by 103.156.60.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 21:22:19.547320 2026] [security2:error] [pid 24446:tid 24446] [client 103.156.60.13:13623] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kanata.ws|F|2"] [data ".sql"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kanata.ws"] [uri "/www/db-backup.sql"] [unique_id "aqidy99fd0KTdBzpxhLHagAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
