🇺🇸
Starburst SysOp Team
2026-08-31 08:26:08
(3 hours ago)
Malware host (X-Forwarded-For) detected by rbl.malware.expert. RBL lookup of 36.200.28.104.rbl.malwa ...
show more
Malware host (X-Forwarded-For) detected by rbl.malware.expert. RBL lookup of 36.200.28.104.rbl.malware.expert succeeded at REQUEST_HEADERS:x-forwarded-for. (1001000-mnz6-3)
show less
Hacking
2026-08-30 19:47:19
(16 hours ago)
$f2bV_matches
Brute-Force
2026-08-30 19:14:05
(16 hours ago)
Automated web probe/scanner blocked at the edge (WorldTree fleet). Signature: probe_path. Example re ...
show more
Automated web probe/scanner blocked at the edge (WorldTree fleet). Signature: probe_path. Example request: /config.json on warroom.apr.ai
show less
Web App Attack
Bad Web Bot
🇩🇪
et-a_network
2026-08-30 18:26:17
(17 hours ago)
104.28.200.36 - - [30/Aug/2026:18:26:17 +0000] "GET /.env.backup HTTP/2.0" 444 0 "-" "Mozilla/5.0 (c ...
show more
104.28.200.36 - - [30/Aug/2026:18:26:17 +0000] "GET /.env.backup HTTP/2.0" 444 0 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" host=e-pruef.et-a.eu via=172.68.159.218 rt=0.000
104.28.200.36 - - [30/Aug/2026:18:26:17 +0000] "GET /.env HTTP/2.0" 444 0 "https://www.google.com/search?q=e-pruef.et-a.eu" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" host=e-pruef.et-a.eu via=172.64.198.105 rt=0.000
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Savvii
2026-08-30 18:09:12
(17 hours ago)
20 attempts against mh-misbehave-ban on eris
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-08-30 16:52:29
(19 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: ssh.teddypot.online | URI: /.git/HEAD | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
slay3r9903
2026-08-30 16:26:25
(19 hours ago)
IP address blocked by Cloudflare security rules due to suspicious activity and security violations.
Hacking
Bad Web Bot
🇺🇸
TPI-Abuse
2026-08-30 12:34:07
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.28.200.36 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.200.36 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 30 08:34:03.542036 2026] [security2:error] [pid 31677:tid 31677] [client 104.28.200.36:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mindmaterial.io"] [uri "/.git/HEAD"] [unique_id "apQjO8BwGv8y6F8ChePT4AAAAAE"], referer: https://www.google.com/search?q=mindmaterial.io
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-08-30 12:10:00
(23 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: git.goblinpot.tech | URI: /.git/HEAD | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:137.0) Gecko/20100101 Firefox/137.0 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇫🇷
Catalin Negru
2026-08-30 11:34:11
(1 day ago)
Recidive ban by fail2ban on server.blackbit.ro
Brute-Force
🇩🇪
SwinT
2026-08-30 09:00:04
(1 day ago)
WAF repeated trigger detected by Fail2Ban in plesk-modsecurity jail
Web App Attack
🇫🇷
Baking333
2026-08-30 08:30:48
(1 day ago)
[redacted] 104.28.200.36 - - [30/Aug/2026:09:30:46 +0100] "GET /.git/config HTTP/1.1" 302 6778 0/512 ...
show more
[redacted] 104.28.200.36 - - [30/Aug/2026:09:30:46 +0100] "GET /.git/config HTTP/1.1" 302 6778 0/51247 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" [redacted] 104.28.200.36 - - [30/Aug/2026:09:30:46 +0100] "GET /.[redacted] HTTP/1.1" 302 6778 0/49071 "https://[redacted]/search?q=[redacted]" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36" [redacted] 104.28.200.36 - - [30/Aug/2026:09:30:46 +0100] "GET /.[redacted] HTTP/1.1" 302 6778 0/66004 "https://[redacted]/search?q=[redacted]" "Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.6422.113 Mobile Safari/537.36"
show less
Bad Web Bot
Web App Attack
2026-08-30 07:32:29
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted] 104.28.200.36 (IE/Ireland/-)
SQL Injection
🇩🇪
rzk
2026-08-30 07:24:02
(1 day ago)
CrowdSec scenario: crowdsecurity/http-sensitive-files. Banned by Koru Cloud platform after multi-eve ...
show more
CrowdSec scenario: crowdsecurity/http-sensitive-files. Banned by Koru Cloud platform after multi-event detection. ASN: CLOUDFLARENET. Country: IE. Timestamp: 2026-08-30T07:24:02+00:00.
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-08-30 07:02:23
(1 day ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cloud.budyn.xyz | URI: /config.php.bak | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Safari/605.1.15 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack