Anonymous
2026-11-09 04:02:34
UTC ·
(17 hours ago)
Pay by Jag firewall blocked probes for sensitive files from this address against protected websites.
Hacking
Web App Attack
🇩🇪
big-cloud.nl
2026-11-09 03:58:33
UTC ·
(17 hours ago)
Try to access /.env
Web App Attack
🇵🇱
Budyn
2026-11-09 02:43:05
UTC ·
(18 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: staging.teddypot.tech | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: staging.teddypot.tech | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇭🇳
unph
2026-11-09 02:42:36
UTC ·
(18 hours ago)
Malicious probe detected: Repositorio Git expuesto (Method: GET, Probe: /.git/HEAD, UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Sa)
Web App Attack
Bad Web Bot
🇺🇸
EmilGH
2026-11-09 02:36:54
UTC ·
(18 hours ago)
104.155.95.227 - - [09/Nov/2026:02:36:45 +0000] "GET /.git/HEAD HTTP/1.1" 403 4433 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
104.155.95.227 - - [09/Nov/2026:02:36:46 +0000] " ...
show more
104.155.95.227 - - [09/Nov/2026:02:36:45 +0000] "GET /.git/HEAD HTTP/1.1" 403 4433 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
104.155.95.227 - - [09/Nov/2026:02:36:46 +0000] "GET /.quantserve.com/quant.js HTTP/1.1" 403 4432 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
104.155.95.227 - - [09/Nov/2026:02:36:46 +0000] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 467 "-" "Mozilla/5.0 (compatible; scanner/1.0)"
104.155.95.227 - - [09/Nov/2026:02:36:47 +0000] "GET /.quantserve.com/quant.js HTTP/1.1" 403 470 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
104.155.95.227 - - [09/Nov/2026:02:36:47 +0000] "POST /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 467 "-" "Mozilla/5.0 (compatible; scanner/1.0)"
104.155.95.227 - - [09/Nov/2026:02:3
...
show less
Bad Web Bot
Web App Attack
Anonymous
2026-11-08 18:34:06
UTC ·
(1 day ago)
Probing for exposed secret / credential files
Hacking
Web App Attack
🇩🇪
mbch
2026-11-08 17:13:01
UTC ·
(1 day ago)
Observed automated probing of web application/configuration paths over completed HTTP requests. UTC 2026-11-08T17:13:01.747000+00:00 to 2026-11-08T17:13:50.853000+00:00: 10 distinct paths in 49.106s, denied HTTP 404. Trusted client-IP processing; for ...
show more
Observed automated probing of web application/configuration paths over completed HTTP requests. UTC 2026-11-08T17:13:01.747000+00:00 to 2026-11-08T17:13:50.853000+00:00: 10 distinct paths in 49.106s, denied HTTP 404. Trusted client-IP processing; forwarding headers accepted only from official configured Cloudflare networks. No successful compromise established. Examples: /firebase-adminsdk.json, /service-account.json, /gcp-credentials.json, /google-credentials.json, /.aws/credentials, /.aws/config, /terraform.tfstate, /.terraform/terraform.tfstate, /terraform.tfvars, /.env.production.
show less
Web App Attack
Anonymous
2026-11-08 07:22:17
UTC ·
(1 day ago)
Web scanner: GET /.git/HEAD
Web App Attack
Hacking
🇳🇱
homeshowdomain.nl
2026-11-07 23:00:59
UTC ·
(1 day ago)
Auto-ban: >3000 req/min op 2026-11-07
Web App Attack
SSH
Hacking
🇩🇪
on-com
2026-11-07 21:20:09
UTC ·
(1 day ago)
URL scan
Brute-Force
Web App Attack
🇩🇪
FeG Deutschland
2026-11-07 19:24:57
UTC ·
(2 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14
Exploited Host
Web App Attack
🇬🇧
consul.to
2026-11-07 16:20:49
UTC ·
(2 days ago)
Web attack/malicious scanning detected
Web App Attack
Anonymous
2026-11-07 16:15:46
UTC ·
(2 days ago)
Probing for exposed secret / credential files
Hacking
Web App Attack
🇳🇱
ConsulHosting
2026-11-07 13:46:00
UTC ·
(2 days ago)
Automatically blocked due to distributed attack
Hacking
🇳🇱
Alt255
2026-11-07 13:16:57
UTC ·
(2 days ago)
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.155.95.227 - - [07/Nov/2026:14:16:54 +0100] "GET /.git/HEAD HTTP/1.1" 404 5808 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 ...
show more
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.155.95.227 - - [07/Nov/2026:14:16:54 +0100] "GET /.git/HEAD HTTP/1.1" 404 5808 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack