🇪🇸
tg_de
2026-02-27 05:27:46
(3 months ago)
101 attempts since 27.02.2026 05:25:44 UTC - last search for: /phpinfo.php3
Web App Attack
🇬🇷
ggb_st
2026-02-27 03:14:14
(3 months ago)
[2026-02-27 03:14:13] 152.42.177.210 triggered a honeypot. Requested on port 443. URI: /.aws/credent ...
show more
[2026-02-27 03:14:13] 152.42.177.210 triggered a honeypot. Requested on port 443. URI: /.aws/credentials, UA: Go-http-client/2.0
...
show less
Bad Web Bot
Brute-Force
Web App Attack
Hacking
SQL Injection
🇧🇪
delabiemedia.be
2026-02-26 22:08:12
(3 months ago)
152.42.177.210 - - [26/Feb/2026:23:08:05 +0100] "GET /.aws/credentials HTTP/1.1" 404 134 "-" "Go-htt ...
show more
152.42.177.210 - - [26/Feb/2026:23:08:05 +0100] "GET /.aws/credentials HTTP/1.1" 404 134 "-" "Go-http-client/1.1"
152.42.177.210 - - [26/Feb/2026:23:08:06 +0100] "GET /.aws/credentials.gpg HTTP/1.1" 404 134 "-" "Go-http-client/1.1"
152.42.177.210 - - [26/Feb/2026:23:08:08 +0100] "GET /.s3cfg HTTP/1.1" 404 134 "-" "Go-http-client/1.1"
152.42.177.210 - - [26/Feb/2026:23:08:09 +0100] "GET /.passwd-s3fs HTTP/1.1" 404 134 "-" "Go-http-client/1.1"
152.42.177.210 - - [26/Feb/2026:23:08:11 +0100] "GET /s3cmd.ini HTTP/1.1" 404 134 "-" "Go-http-client/1.1"
...
show less
Web App Attack
🇫🇷
LRNP
2026-02-26 21:38:22
(3 months ago)
_:443 152.42.177.210 - - [26/Feb/2026:21:38:10 +0000] "GET /.env HTTP/1.1" 404 118 "-" "Go-http-clie ...
show more
_:443 152.42.177.210 - - [26/Feb/2026:21:38:10 +0000] "GET /.env HTTP/1.1" 404 118 "-" "Go-http-client/1.1"
...
show less
Bad Web Bot
Web App Attack
🇨🇿
rawnullbyte
2026-02-26 19:41:10
(3 months ago)
🚨 Honeypot triggered! 🖥️ System: NPot 🎯 Target: Unknown 🛣️ Path: /.aws/credentials 👤 Attacker IP: 15 ...
show more
🚨 Honeypot triggered! 🖥️ System: NPot 🎯 Target: Unknown 🛣️ Path: /.aws/credentials 👤 Attacker IP: 152.42.177.210 ⏰ Time: 2026-02-26 19:41:09 📡 User-Agent: Go-http-client/1.1
show less
Web App Attack
🇸🇪
nekopavel
2026-02-26 18:45:55
(3 months ago)
152.42.177.210 - - [26/Feb/2026:19:45:46 +0100]"GET /.aws/credentials HTTP/2.0" 404 792"-" 78.69.8.2 ...
show more
152.42.177.210 - - [26/Feb/2026:19:45:46 +0100]"GET /.aws/credentials HTTP/2.0" 404 792"-" 78.69.8.25 "Go-http-client/2.0""0.000" "-""Singapore" "SG"
152.42.177.210 - - [26/Feb/2026:19:45:47 +0100]"GET /.aws/credentials.gpg HTTP/2.0" 404 792"-" 78.69.8.25 "Go-http-client/2.0""0.000" "-""Singapore" "SG"
152.42.177.210 - - [26/Feb/2026:19:45:52 +0100]"GET /.env HTTP/2.0" 404 792"-" 78.69.8.25 "Go-http-client/2.0""0.000" "-""Singapore" "SG"
...
show less
Hacking
Bad Web Bot
Web App Attack
🇩🇪
Mr-Money
2026-02-26 14:56:04
(3 months ago)
scenario: crowdsecurity/http-sensitive-files - events: 5
Web App Attack
Hacking
🇩🇪
ut-addicted.com
2026-02-26 09:09:37
(3 months ago)
\[Thu Feb 26 10:09:35.642410 2026\] \[:error\] \[pid 6793:tid 140546045593344\] \[client 152.42.177. ...
show more
\[Thu Feb 26 10:09:35.642410 2026\] \[:error\] \[pid 6793:tid 140546045593344\] \[client 152.42.177.210:37540\] \[client 152.42.177.210\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 8\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "78.46.187.162"\] \[uri "/s3cmd.ini"\] \[unique_id "aaANz93rjHpdxqSAI5D5-QAAAMs"\]
show less
Brute-Force
Web App Attack
🇩🇪
Hary74656
2026-02-26 07:36:52
(3 months ago)
[Thu Feb 26 08:36:33.629994 2026] [security2:error] [pid 263611:tid 263648] [remote 152.42.177.210:4 ...
show more
[Thu Feb 26 08:36:33.629994 2026] [security2:error] [pid 263611:tid 263648] [remote 152.42.177.210:44066] [client 152.42.177.210] ModSecurity: Access denied with code 403 (phase 2). Matched phrase ".aws/credentials" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: .aws/credentials found within REQUEST_FILENAME: /.aws/credentials"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "78.46.107.184"] [uri "/.aws/credentials"] [unique_id "aZ_4ATnpp51VrDnAs5B-SgADkgE"]
[Thu Feb 26 08:36:35.469860 2026] [security2:error] [pid 263611:tid 263649] [remote 152.42.177.210:44066] [client 152.42.177.210] ModSecurity: Access denied with code 403 (phase 2). Matched phrase ".aws
...
show less
Web App Attack
2026-02-26 02:48:10
(3 months ago)
[Wed Feb 25 18:48:06.454505 2026] [authz_core:error] [pid 1653532] [client 152.42.177.210:53430] AH0 ...
show more
[Wed Feb 25 18:48:06.454505 2026] [authz_core:error] [pid 1653532] [client 152.42.177.210:53430] AH01630: client denied by server configuration: /home/appowner/www/sec/.aws
[Wed Feb 25 18:48:07.133852 2026] [authz_core:error] [pid 1653534] [client 152.42.177.210:37026] AH01630: client denied by server configuration: /home/appowner/www/sec/.aws
[Wed Feb 25 18:48:07.853766 2026] [authz_core:error] [pid 1653532] [client 152.42.177.210:53430] AH01630: client denied by server configuration: /home/appowner/www/sec/.aws
[Wed Feb 25 18:48:08.590323 2026] [authz_core:error] [pid 1653534] [client 152.42.177.210:37026] AH01630: client denied by server configuration: /home/appowner/www/sec/.aws
[Wed Feb 25 18:48:09.252903 2026] [authz_core:error] [pid 1653532] [client 152.42.177.210:53430] AH01630: client denied by server configuration: /home/appowner/www/sec/.s3cfg
...
show less
Brute-Force
SSH
🇩🇪
Mr-Money
2026-02-25 20:52:39
(3 months ago)
scenario: crowdsecurity/http-probing - events: 11
Web App Attack
Hacking
🇫🇮
Kimmo Rieskaniemi
2026-02-25 20:22:35
(3 months ago)
CrowdSec triggered crowdsecurity/http-probing
Web App Attack
Hacking
🇫🇮
SamJUK
2026-02-25 20:12:52
(3 months ago)
Multiple WAF Violations
...
Bad Web Bot
Web App Attack
🇫🇮
kumiko
2026-02-25 19:18:25
(3 months ago)
[2026-02-25 21:18:25] Probing for dotfiles
"GET /.aws/credentials HTTP/2.0" 403
Bad Web Bot
Web App Attack
🇺🇸
Starburst SysOp Team
2026-02-25 18:25:45
(3 months ago)
Host header is a numeric IP address. Pattern match "(?:^( (920350-iad5-2)
Hacking
Bad Web Bot