🇵🇱
Budyn
2026-07-27 12:43:27
(3 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: URI: /.env.txt | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-07-27 11:05:07
(4 hours ago)
Scanning/Probing (25)
Brute-Force
Web App Attack
2026-07-27 11:04:06
(4 hours ago)
Bot / scanning and/or hacking attempts: GET /.env.preprod HTTP/1.1, GET /.env1 HTTP/1.1, GET /.env.d ...
show more
Bot / scanning and/or hacking attempts: GET /.env.preprod HTTP/1.1, GET /.env1 HTTP/1.1, GET /.env.dist HTTP/1.1, GET /.env.txt HTTP/1.1, GET /apps/.env HTTP/1.1, GET /site/.env HTTP/1.1, GET /.env.json HTTP/1.1, GET /.env2 HTTP/1.1, GET /.env~ HTTP/1.1, GET /web/.env HTTP/1.1, GET /.env.yaml HTTP/1.1, GET /.env.swp HTTP/1.1, GET /api/.env HTTP/1.1, GET /.env_copy HTTP/1.1, GET /.env.uat HTTP/1.1, GET /app/.env HTTP/1.1, GET /.env.docker HTTP/1.1, GET /.env.yml HTTP/1.1
show less
Hacking
Web App Attack
🇫🇷
masterguru
2026-07-27 08:31:46
(7 hours ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-196)
Hacking
Web App Attack
2026-07-27 05:57:15
(9 hours ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇩🇪
R.G.
2026-07-27 05:47:15
(9 hours ago)
(ScanningForFiles) Scanning for files triggerd 16.148.11.204 (US/United States/ec2-16-148-11-204.us- ...
show more
(ScanningForFiles) Scanning for files triggerd 16.148.11.204 (US/United States/ec2-16-148-11-204.us-west-2.compute.amazonaws.com): 10 in the last 900 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇳🇱
ConsulHosting
2026-07-27 05:45:30
(10 hours ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇦🇺
aranguren.org
2026-07-26 05:31:54
(1 day ago)
16.148.11.204 - - [26/Jul/2026:15:31:51 +1000] "POST / HTTP/1.1" 404 993 "-" "Mozilla/5.0 (Macintosh ...
show more
16.148.11.204 - - [26/Jul/2026:15:31:51 +1000] "POST / HTTP/1.1" 404 993 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
16.148.11.204 - - [26/Jul/2026:15:31:52 +1000] "POST / HTTP/1.1" 404 993 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
16.148.11.204 - - [26/Jul/2026:15:31:52 +1000] "POST / HTTP/1.1" 404 993 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
16.148.11.204 - - [26/Jul/2026:15:31:52 +1000] "GET /.git/config HTTP/1.1" 404 993 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
16.148.11.204 - - [26/Jul/2026:15:31:52 +1000] "POST / HTTP/1.1" 404 993 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
16.14
...
show less
Bad Web Bot
2026-07-26 05:05:15
(1 day ago)
Blocked: Reason='Vulnerability probing — PHP scan detected (41/60 min)'; Requests=41
Port Scan
🇺🇸
TPI-Abuse
2026-07-26 02:45:06
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 16.148.11.204 (ec2-16-148-11-204.us-west-2.comp ...
show more
(mod_security) mod_security (id:210492) triggered by 16.148.11.204 (ec2-16-148-11-204.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 22:44:59.284088 2026] [security2:error] [pid 3310686:tid 3310713] [client 16.148.11.204:53752] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "prismatik.com"] [uri "/.git/config"] [unique_id "amV0q0Lh3n-IRUviBfcSEwAAAQ4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-07-25 22:00:28
(1 day ago)
Auto-ban: >3000 req/min op 2026-07-25
Web App Attack
SSH
Hacking
🇳🇱
Site.eu
2026-07-25 02:07:10
(2 days ago)
Excessive 404/403 errors
Brute-Force
🇳🇱
WeCloudit-Anti-Abuse
2026-07-25 01:17:29
(2 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-sensitive-files
Web App Attack
Hacking
🇮🇹
VHosting
2026-07-25 00:35:03
(2 days ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 06:07:07
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 16.148.11.204 (ec2-16-148-11-204.us-west-2.comp ...
show more
(mod_security) mod_security (id:210492) triggered by 16.148.11.204 (ec2-16-148-11-204.us-west-2.compute.amazonaws.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 02:07:03.467138 2026] [security2:error] [pid 3902187:tid 3902187] [client 16.148.11.204:52760] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "weathercarib.com"] [uri "/.git/config"] [unique_id "amMBB71-J6qJxPREXB8wOAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack