🇳🇱
Alt255
2026-10-18 10:57:02
(1 day ago)
[ti-01sc] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-01sc] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.207.44.119 - - [18/Oct/2026:12:56:19 +0200] "GET /app/.env.copy HTTP/1.1" 301 5747 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 22:55:18
(1 day ago)
(mod_security) mod_security (id:210730) triggered by 104.207.44.119 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210730) triggered by 104.207.44.119 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 18:55:09.866204 2026] [security2:error] [pid 9870:tid 9870] [client 104.207.44.119:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||eddysgroup.com|F|2"] [data ".yml.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "eddysgroup.com"] [uri "/config.yml.backup"] [unique_id "atP8zUw8NlR5vpIfFsBt6AAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-17 08:32:56
(2 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: panel.dont-eat-the-pudding.online | URI: /.env.production | UA: python-httpx/0.28.1 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇳🇴
jad-abuse
2026-10-16 01:39:16
(3 days ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: source_ba ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: source_backup. Observed by 1 sensor(s); 1 hits.
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-10 12:50:30
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: auth.teddypot.space | URI: /server/.env | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Hacking
Web App Attack
🇳🇱
Alt255
2026-10-06 22:56:47
(1 week ago)
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.207.44.119 - - [07/Oct/2026:00:56:26 +0200] "GET /.htpasswd.save HTTP/1.1" 403 7853 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
🇺🇸
drewf.ink
2026-09-29 01:36:14
(2 weeks ago)
[01:36] Attempted HTTPS GlobalProtect login with credentials bclark:W******1
Web App Attack
🇲🇽
octageeks.com
2026-09-19 04:07:19
(1 month ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇲🇽
octageeks.com
2026-09-18 04:12:07
(1 month ago)
Wordpress malicious attack:[octawp]
Web App Attack
🇩🇪
raph
2026-09-17 18:51:04
(1 month ago)
[Wordpress] crawler /wp-admin/*, /wp-content/*, etc.
Bad Web Bot
Web App Attack
🇨🇿
lp
2026-09-04 01:49:44
(1 month ago)
Unauthorized VPN login attempts: 2 attempts were recorded from 104.207.44.119
2026-09-04T02:34:39+02 ...
show more
Unauthorized VPN login attempts: 2 attempts were recorded from 104.207.44.119
2026-09-04T02:34:39+02:00 vpn Access-Reject 'zoubin' station: 104.207.44.119 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-04T02:36:15+02:00 vpn Access-Reject 'mhz' station: 104.207.44.119 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇫🇷
Sklurk
2026-08-10 03:59:21
(2 months ago)
Web App Attack
Web App Attack
🇩🇪
LRob
2026-05-14 00:00:22
(5 months ago)
Repeated 403 errors, blocked by Fail2ban in custom-403 jail
Bad Web Bot
🇬🇧
consul.to
2026-03-16 01:03:58
(7 months ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇮
JimArchon72
2026-02-26 02:15:01
(7 months ago)
2026/02/26 02:14:57 "GET /wp-login.php HTTP/2.0"
Web App Attack
