🇩🇪
xdearboy
2026-11-10 03:30:24
UTC ·
(1 hour ago)
Dionaea Honeypot: HTTP scan on path /.git/HEAD
Hacking
Web App Attack
2026-11-10 03:24:22
UTC ·
(1 hour ago)
[ns1.skdns.gr] httpd-suspicious-path: iis-w3c
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 02:30:05
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 136.85.178.219 (219.178.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 21:29:56.269278 2026] [security2:error] [pid 12786:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 136.85.178.219 (219.178.85.136.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 21:29:56.269278 2026] [security2:error] [pid 12786:tid 12786] [client 136.85.178.219:6560] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "powerkiteforum.com"] [uri "/.git/HEAD"] [unique_id "avKBpGUs1efV7Mv5wkbCtwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-10 00:31:34
UTC ·
(4 hours ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇩🇪
bescared
2026-11-10 00:20:04
UTC ·
(5 hours ago)
F2B - Malicious activity detected. URL Probing. -c23856ef-
Hacking
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-10 00:16:02
UTC ·
(5 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: minio.sweetpuddingtrap.online | Path: /.env | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: minio.sweetpuddingtrap.online | Path: /.env | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-10 00:03:40
UTC ·
(5 hours ago)
(web_sensitive_file) srv104 Sensitive file probe (.env/.git/backup) 136.85.178.219 (US/United States/219.178.85.136.bc.googleusercontent.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇪🇸
robotstxt
2026-11-09 21:47:28
UTC ·
(7 hours ago)
136.85.178.219 - - [09/Nov/2026:21:47:02 +0000] "GET /wp-config.php.bak HTTP/1.1" 403 9511 "-" rt="0.694" "Mozilla/5.0 (compatible; scanner/1.0)" "-" h="www.surefarmproject.eu" sn="www.surefarmproject.eu" ru="/wp-config.php.bak" u="/index.php" ucs="- ...
show more
136.85.178.219 - - [09/Nov/2026:21:47:02 +0000] "GET /wp-config.php.bak HTTP/1.1" 403 9511 "-" rt="0.694" "Mozilla/5.0 (compatible; scanner/1.0)" "-" h="www.surefarmproject.eu" sn="www.surefarmproject.eu" ru="/wp-config.php.bak" u="/index.php" ucs="-" ua="unix:/var/run/php/surefarmproject82.sock" us="404" uct="0.000" urt="0.694"
136.85.178.219 - - [09/Nov/2026:21:47:03 +0000] "GET /wp-config-sample.php HTTP/1.1" 403 9537 "-" rt="0.804" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" h="www.surefarmproject.eu" sn="www.surefarmproject.eu" ru="/wp-config-sample.php" u="/index.php" ucs="-" ua="unix:/var/run/php/surefarmproject82.sock" us="404" uct="0.000" urt="0.804"
136.85.178.219 - - [09/Nov/2026:21:47:03 +0000] "GET /.aws/credentials.bak HTTP/1.1" 403 9511 "-" rt="0.878" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" h="www.surefarmproject.eu" sn="
...
show less
Web App Attack
🇮🇹
VHosting
2026-11-09 21:45:05
UTC ·
(7 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇳🇱
Alt255
2026-11-09 20:51:33
UTC ·
(8 hours ago)
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 136.85.178.219 - - [09/Nov/2026:21:51:31 +0100] "GET /.env HTTP/1.1" 404 30634 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...
show more
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 136.85.178.219 - - [09/Nov/2026:21:51:31 +0100] "GET /.env HTTP/1.1" 404 30634 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-11-09 19:41:17
UTC ·
(9 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
2026-11-09 18:32:55
UTC ·
(10 hours ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇮🇹
Inartis
2026-11-09 18:19:02
UTC ·
(11 hours ago)
136.85.178.219 - - [09/Nov/2026:19:18:58 +0100] "GET /.env HTTP/1.1" 403 5530 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
136.85.178.219 - - [09/Nov/2026:19:18:59 +0100] "GET / ...
show more
136.85.178.219 - - [09/Nov/2026:19:18:58 +0100] "GET /.env HTTP/1.1" 403 5530 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
136.85.178.219 - - [09/Nov/2026:19:18:59 +0100] "GET /.env HTTP/1.1" 403 5562 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
136.85.178.219 - - [09/Nov/2026:19:19:01 +0100] "GET /.env HTTP/1.1" 302 439 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
