Anonymous
2026-10-29 21:39:03
UTC ·
(2 weeks ago)
MikroTik Enterprise Honeypot
Port Scan
🇫🇷
Kejult
2026-10-22 21:45:00
UTC ·
(3 weeks ago)
Honeypot Finding: repeated TCP service probing on TCP/8087 (service); 2 application-level events across 2 source port(s). Sensor(s): Honeytrap.
Port Scan
🇺🇸
raymarron.com
2026-09-22 13:44:13
UTC ·
(1 month ago)
HEAD /wp/
HEAD /blog/
HEAD /old/
HEAD /backup/
HEAD /wordpress/
HEAD /new/
Web App Attack
🇵🇱
mkey
2026-09-21 06:54:20
UTC ·
(1 month ago)
[First: 2026-09-20 22:20:27/1s] HITS=4 Repeated suspicious web requests; sample=HEAD /backup/ 404 | HEAD /new/ 404 | HEAD /old/ 404
Port Scan
Hacking
Web App Attack
🇩🇪
findlab
2026-09-20 21:15:01
UTC ·
(1 month ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇦🇺
paulshipley.com.au
2026-09-20 19:49:27
UTC ·
(1 month ago)
iaki.com.au:443 104.248.28.255 - - [21/Sep/2026:05:49:25 +1000] "HEAD /wordpress/ HTTP/1.1" 404 757 "http://iaki.com.au/wordpress/" "Mozilla/5.0 (Linux; Android 10; vivo 1904) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.60 Mobile Safari/ ...
show more
iaki.com.au:443 104.248.28.255 - - [21/Sep/2026:05:49:25 +1000] "HEAD /wordpress/ HTTP/1.1" 404 757 "http://iaki.com.au/wordpress/" "Mozilla/5.0 (Linux; Android 10; vivo 1904) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.60 Mobile Safari/537.36"
...
show less
Web App Attack
🇸🇪
SkyDancer
2026-09-20 19:31:51
UTC ·
(1 month ago)
Multiple intrusion attempts via http/https on known vulnerable url offsets. Attack automatically blocked by SkyDancer Ai(web-X).
Hacking
Brute-Force
🇫🇷
Zundapper
2026-09-20 19:04:44
UTC ·
(1 month ago)
104.248.28.255 - - [20/Sep/2026:21:04:42 +0200] "HEAD /new/ HTTP/2.0" 404 0 "https://www.illustrami.com/new/" "Mozilla/5.0 (Linux; Android 14; SM-A146P) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/25.0 Chrome/123.0.6312.120 Mobile Safari/53 ...
show more
104.248.28.255 - - [20/Sep/2026:21:04:42 +0200] "HEAD /new/ HTTP/2.0" 404 0 "https://www.illustrami.com/new/" "Mozilla/5.0 (Linux; Android 14; SM-A146P) AppleWebKit/537.36 (KHTML, like Gecko) SamsungBrowser/25.0 Chrome/123.0.6312.120 Mobile Safari/537.36"
104.248.28.255 - - [20/Sep/2026:21:04:43 +0200] "HEAD /wordpress/ HTTP/2.0" 404 0 "https://www.illustrami.com/wordpress/" "Mozilla/5.0 (Linux; Android 14; OnePlus 12) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.102 Mobile Safari/537.36"
104.248.28.255 - - [20/Sep/2026:21:04:43 +0200] "HEAD /wordpress/ HTTP/2.0" 404 0 "https://www.illustrami.com/wordpress/" "Mozilla/5.0 (Linux; Android 14; OnePlus 12) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.102 Mobile Safari/537.36"
104.248.28.255 - - [20/Sep/2026:21:04:43 +0200] "HEAD /backup/ HTTP/2.0" 404 0 "https://www.illustrami.com/backup/" "Mozilla/5.0 (Linux; Android 10; vivo 1904) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.5938.60 Mobile Safari/537.36"
...
show less
Web App Attack
Port Scan
🇩🇪
AetherFox
2026-09-20 18:11:44
UTC ·
(1 month ago)
AetherFox VoidGuard detected: [Sun Sep 20 18:11:43.703984 2026] [authz_core:error] [pid 3234461:tid 3234467] [client 104.248.28.255:36812] AH01630: client denied by server configuration: proxy:http://[MASKED]/new/
[Sun Sep 20 18:11:43.704160 2026] [a ...
show more
AetherFox VoidGuard detected: [Sun Sep 20 18:11:43.703984 2026] [authz_core:error] [pid 3234461:tid 3234467] [client 104.248.28.255:36812] AH01630: client denied by server configuration: proxy:http://[MASKED]/new/
[Sun Sep 20 18:11:43.704160 2026] [authz_core:error] [pid 3234461:tid 3234467] [client 104.248.28.255:36812] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html
[Sun Sep 20 18:11:43.740660 2026] [authz_core:error] [pid 3234461:tid 3234491] [client 104.248.28.255:36812] AH01630: client denied by server configuration: proxy:http://[MASKED]/wordpress/
[Sun Sep 20 18:11:43.740821 2026] [authz_core:error] [pid 3234461:tid 3234491] [client 104.248.28.255:36812] AH01630: client denied by server configuration: /var/www/html/ERRORpages/403.html
[Sun Sep 20 18:11:43.789822 2026] [authz_core:error] [pid 3234461:tid 3234479] [client 104.248.28.255:36812] AH01630: client denied by server configuration: proxy:http://[MASKED]/backup
...
show less
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-09-20 18:05:37
UTC ·
(1 month ago)
Too many Status 40X (12)
Brute-Force
Web App Attack
🇫🇷
Zundapper
2026-09-20 17:53:12
UTC ·
(1 month ago)
104.248.28.255 - - [20/Sep/2026:19:53:11 +0200] "HEAD /new/ HTTP/2.0" 404 0 "http://idealmuseum.com/new/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.70 Safari/537.36 Vivaldi/6.7.3200.25"
104.24 ...
show more
104.248.28.255 - - [20/Sep/2026:19:53:11 +0200] "HEAD /new/ HTTP/2.0" 404 0 "http://idealmuseum.com/new/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.70 Safari/537.36 Vivaldi/6.7.3200.25"
104.248.28.255 - - [20/Sep/2026:19:53:11 +0200] "HEAD /wordpress/ HTTP/2.0" 404 0 "http://idealmuseum.com/wordpress/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 15_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.6422.141 Safari/537.36"
104.248.28.255 - - [20/Sep/2026:19:53:11 +0200] "HEAD /backup/ HTTP/2.0" 404 0 "http://idealmuseum.com/backup/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0"
104.248.28.255 - - [20/Sep/2026:19:53:11 +0200] "HEAD /old/ HTTP/2.0" 404 0 "http://idealmuseum.com/old/" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.5993.90 Safari/537.36"
104.248.28.255 - - [20/Sep/2026:19:53:12 +0200] "HEAD /blog/ HTTP/2.0" 404 0 "http://idealmuseum.com/b
...
show less
Web App Attack
Port Scan
🇳🇱
e.fierstra
2026-09-20 17:45:17
UTC ·
(1 month ago)
excessive HTTP 404 errors
Bad Web Bot
🇩🇪
LRob
2026-09-20 17:26:50
UTC ·
(1 month ago)
Walking a list of paths that do not exist (scanning) | method: HEAD | path: /new/ (+5 more) | 2026-09-20 17:26 UTC
Port Scan
Web App Attack
🇩🇪
Vegascosmetics
2026-09-20 17:15:20
UTC ·
(1 month ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after admin/path reconnaissance / port-scan-like web scan. Evidence: AttackPattern: /backup/ (Match: /backup/)
Port Scan
Hacking
Web App Attack
🇺🇸
kosada.com
2026-09-20 17:14:35
UTC ·
(1 month ago)
Repeated requests for suspicious nonexistent URLs, for example: /wp/ (HTTP/1.1 port 443, user agent: "Mozilla/5.0 (Linux; Android 14; Samsung SM-A546B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.14 Mobile Safari/537.36")
Web App Attack