2026-10-28 19:57:53
(3 hours ago)
104.28.167.14 - - [28/Oct/2026:19:55:31 +0000] "GET /.env.test?password-protected=login&redirect_to=https%3A%2F%2Fwp27.wordpress-schulung.wbs-web.de%2F.env.test HTTP/1.1" 404 5679 "-" "-" 525684 "app27-router@file" "http://2.29.32.117:8002" 141ms
104 ...
show more
104.28.167.14 - - [28/Oct/2026:19:55:31 +0000] "GET /.env.test?password-protected=login&redirect_to=https%3A%2F%2Fwp27.wordpress-schulung.wbs-web.de%2F.env.test HTTP/1.1" 404 5679 "-" "-" 525684 "app27-router@file" "http://2.29.32.117:8002" 141ms
104.28.167.14 - - [28/Oct/2026:19:57:47 +0000] "GET /.env HTTP/1.1" 302 0 "-" "-" 526150 "app11-router@file" "http://91.99.218.158:8003" 58ms
...
show less
Web App Attack
🇳🇱
Alt255
2026-10-28 19:04:55
(3 hours ago)
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.167.14 - - [28/Oct/2026:20:04:37 +0100] "GET /.git/HEAD HTTP/1.1" 404 6211 "https://www.google.com/search?q=www.classicleveranciers.nl" "M ...
show more
[ti-04al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.167.14 - - [28/Oct/2026:20:04:37 +0100] "GET /.git/HEAD HTTP/1.1" 404 6211 "https://www.google.com/search?q=www.classicleveranciers.nl" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-28 18:50:45
(4 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: what.are.you.looking.for.budyn.top | URI: /.aw ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: what.are.you.looking.for.budyn.top | URI: /.aws/credentials | UA: Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html) | BODY: [Empty / GET Request] | HEADERS: {"Accept":"text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8","Accept-Language":"en-US,en;q=0.9","X-Waf-Trigger":"1"}
show less
Hacking
Web App Attack
2026-10-28 18:19:32
(4 hours ago)
104.28.167.14 - - [28/Oct/2026:19:19:31 +0100] "GET /. HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15"
Web App Attack
🇩🇪
Trashware
2026-10-28 15:03:03
(7 hours ago)
Troll got lost in Hellpot
Hacking
Bad Web Bot
Web App Attack
2026-10-28 13:17:59
(9 hours ago)
fail2ban jail apache-secrets-probe: 104.28.167.14 - - [28/Oct/2026:06:17:54 -0700] "GET /.git/config HTTP/1.1" 403 6720 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
Web App Attack
🇫🇮
paissangroup
2026-10-28 02:56:14
(20 hours ago)
Multiple WAF Violations
Web App Attack
🇳🇱
Alt255
2026-10-28 01:22:14
(21 hours ago)
[ti-tinov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.167.14 - - \[28/Oct/2026:02:21:47 +0100\] "GET / HTTP/1.1" 301 5612 "https://pipportal.nl/.git/config" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x ...
show more
[ti-tinov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.167.14 - - \[28/Oct/2026:02:21:47 +0100\] "GET / HTTP/1.1" 301 5612 "https://pipportal.nl/.git/config" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/135.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
2026-10-27 20:34:59
(1 day ago)
104.28.167.14 - - [28/Oct/2026:04:34:58 +0800] "GET /.env HTTP/1.1" 404 196 "https://www.google.com/search?q=manypu.com" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
...
Bad Web Bot
Web App Attack
🇸🇪
Mailz1
2026-10-27 20:15:24
(1 day ago)
104.28.167.14 - - [27/Oct/2026:21:15:23 +0100] "GET /.env.sample HTTP/1.1" 404 196 "https://www.google.com/search?q=mailz1.eu" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
...
Bad Web Bot
🇩🇪
Blexyel
2026-10-27 13:15:09
(1 day ago)
104.28.167.14 - - [27/Oct/2026:14:15:08 +0100] "GET /.git/config HTTP/1.1" 200 265 "-" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36"
...
Brute-Force
Web App Attack
2026-10-26 20:12:20
(2 days ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
2026-10-25 21:34:55
(3 days ago)
Web scanner: GET /.env.bak
Web App Attack
Hacking
🇳🇱
Alt255
2026-10-25 13:06:31
(3 days ago)
[ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.167.14 - - \[23/Oct/2026:07:51:04 +0200\] "GET / HTTP/1.1" 200 2163 "https://www.whiskysailing.com/wp-config.php.bak" "Mozilla/5.0 AppleWebKit/537 ...
show more
[ti-12al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 104.28.167.14 - - \[23/Oct/2026:07:51:04 +0200\] "GET / HTTP/1.1" 200 2163 "https://www.whiskysailing.com/wp-config.php.bak" "Mozilla/5.0 AppleWebKit/537.36 \(KHTML, like Gecko\; compatible\; ChatGPT-User/1.0\; +https://openai.com/bot\)"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-25 08:43:08
(3 days ago)
[cb-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.167.14 - - [25/Oct/2026:09:43:01 +0100] "GET /.env.production.local HTTP/1.1" 404 1350 "https://www.google.com/search?q=dansstudioliez.nl" ...
show more
[cb-06al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 104.28.167.14 - - [25/Oct/2026:09:43:01 +0100] "GET /.env.production.local HTTP/1.1" 404 1350 "https://www.google.com/search?q=dansstudioliez.nl" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0"
...
show less
Bad Web Bot
Web App Attack
