🇳🇱
Tsumugi Kotobuki
2026-11-04 07:12:14
UTC ·
(5 days ago)
Port Scan on Honeypot | Ports: 80/HTTP | Proto: TCP(1) | Flags: all SYN | TTL: 52 | Len: 60B | Win: 64240(1) | F2B/ufw-honeypot@2026-11-04T07:12:14Z
Port Scan
Hacking
🇵🇱
pms
2026-10-17 15:12:00
UTC ·
(3 weeks ago)
GET /.htpasswd.tmp
Web App Attack
🇮🇩
securejdprop
2026-10-07 08:43:09
UTC ·
(1 month ago)
This IP was detected by CrowdSec triggering crowdsecurity/suricata-major-severity(ET DROP Spamhaus DROP Listed Traffic Inbound group 23).
Hacking
Web App Attack
🇪🇸
librebit
2026-09-04 10:06:12
UTC ·
(2 months ago)
Brute force
Brute-Force
🇺🇸
drewf.ink
2026-09-02 03:39:02
UTC ·
(2 months ago)
[03:39] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon)
Web App Attack
🇺🇸
drewf.ink
2026-09-01 09:35:11
UTC ·
(2 months ago)
[09:35] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon)
Web App Attack
🇺🇸
drewf.ink
2026-08-29 19:42:35
UTC ·
(2 months ago)
[19:42] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon)
Web App Attack
🇪🇸
10dencehispahard SL
2026-01-23 07:26:59
UTC ·
(9 months ago)
Wordpress probing for vulnerabilities
Hacking
Exploited Host
🇦🇺
MAGIC
2026-01-10 01:18:20
UTC ·
(9 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2025-11-26 11:09:28
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 104.167.19.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 06:09:21.383108 2025] [security2:error] [pid 7483:tid 7483] [client 104.167.19.65:38093] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 104.167.19.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 26 06:09:21.383108 2025] [security2:error] [pid 7483:tid 7483] [client 104.167.19.65:38093] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcontacts.dukemason.com"] [uri "/.env"] [unique_id "aSbf4SMBq9j4yVozFRbYaQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-26 00:48:13
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 104.167.19.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 19:48:09.016395 2025] [security2:error] [pid 2174018:tid 2174018] [client 104.167.19.65:1858 ...
show more
(mod_security) mod_security (id:210492) triggered by 104.167.19.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 19:48:09.016395 2025] [security2:error] [pid 2174018:tid 2174018] [client 104.167.19.65:18587] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.lucasadams.com"] [uri "/.svn/wc.db"] [unique_id "aSZOSQ3TrHpbrQlyyRPzywAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-11-25 15:33:59
UTC ·
(11 months ago)
botnet
DDoS Attack
🇺🇸
TPI-Abuse
2025-11-25 05:48:35
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 104.167.19.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:48:31.107354 2025] [security2:error] [pid 23086:tid 23086] [client 104.167.19.65:11365] M ...
show more
(mod_security) mod_security (id:210492) triggered by 104.167.19.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:48:31.107354 2025] [security2:error] [pid 23086:tid 23086] [client 104.167.19.65:11365] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eliteelectricalservices.us"] [uri "/.svn/wc.db"] [unique_id "aSVDL634qfVkp3_c2Hb7bwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-25 05:29:12
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 104.167.19.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:29:08.074036 2025] [security2:error] [pid 5420:tid 5420] [client 104.167.19.65:13845] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 104.167.19.65 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 25 00:29:08.074036 2025] [security2:error] [pid 5420:tid 5420] [client 104.167.19.65:13845] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "edupal.net"] [uri "/.env"] [unique_id "aSU-pKQb-dfsm_km0b1lRQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
MAGIC
2025-11-17 02:03:29
UTC ·
(11 months ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
