2026-06-17 16:13:30
(1 day ago)
Honeypot hit: Empty payload (likely service probe); 2078 [1], 2096 [1], 2082 [1], 2083 [1], 2077 [1] ...
show more
Honeypot hit: Empty payload (likely service probe); 2078 [1], 2096 [1], 2082 [1], 2083 [1], 2077 [1], 2087 [1] TCP
Reported by: https://github.com/sefinek/T-Pot-To-AbuseIPDB
show less
Port Scan
🇨🇿
Countryman
2026-06-17 15:59:24
(1 day ago)
repeated unauthorized connection attempts, host sweep, port scan
Port Scan
🇨🇿
Countryman
2026-06-17 15:59:24
(1 day ago)
repeated unauthorized connection attempts, host sweep, port scan
Port Scan
🇩🇪
cloudmax
2026-06-17 14:53:59
(1 day ago)
Cloudmax IPS Block - Suspicious activity. Possible port scanning, service reconnaissance, or vulnera ...
show more
Cloudmax IPS Block - Suspicious activity. Possible port scanning, service reconnaissance, or vulnerability probing
show less
Port Scan
🇺🇸
TPI-Abuse
2026-06-17 13:11:40
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 164.92.154.226 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 164.92.154.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 17 09:11:34.054596 2026] [security2:error] [pid 19326:tid 19326] [client 164.92.154.226:52092] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.182"] [uri "/.git/HEAD"] [unique_id "ajKdBhoaFQkkXR7YzG9iQQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇹🇷
Domainhizmetleri.com
2026-06-17 10:49:33
(2 days ago)
[honeypot] - MS-SQL-PROBE
Port Scan
Hacking
🇩🇪
acadeova
2026-06-17 10:23:39
(2 days ago)
🚨 Recon detected (nft drop)
SRC=164.92.154.226
Observed=TCP dpt=2096 in=enp0s6 ttl=57
Time=recent(jo ...
show more
🚨 Recon detected (nft drop)
SRC=164.92.154.226
Observed=TCP dpt=2096 in=enp0s6 ttl=57
Time=recent(journalctl: 10 minutes ago)
Assessment=Generic scanning / reconnaissance (PORT_SCAN)
show less
Port Scan
🇺🇸
MPL
2026-06-17 10:04:57
(2 days ago)
tcp port scan (10 or more attempts)
Port Scan
🇹🇭
Sawasdee
2026-06-17 08:51:10
(2 days ago)
Unwanted checking 80 or 443 port
...
Bad Web Bot
🇫🇷
dynamix
2026-06-17 06:16:05
(2 days ago)
Multiple WAF Violations
Web App Attack
🇳🇱
BIV
2026-06-17 05:50:08
(2 days ago)
Honeypot multi-source hit. Sources: tpot:Honeytrap,tpot:P0f,tpot:Suricata. Ports: 2077,2078,80. Auto ...
show more
Honeypot multi-source hit. Sources: tpot:Honeytrap,tpot:P0f,tpot:Suricata. Ports: 2077,2078,80. Automated tiered (T-Pot+DShield).
show less
Port Scan
Hacking
Bad Web Bot
2026-06-17 04:58:17
(2 days ago)
[Wed Jun 17 06:58:14.426664 2026] [:error] [pid 3603667:tid 3603667] [client 164.92.154.226:55296] M ...
show more
[Wed Jun 17 06:58:14.426664 2026] [:error] [pid 3603667:tid 3603667] [client 164.92.154.226:55296] ModSecurity: Warning. Matched "Operator `PmFromFile' with parameter `restricted-files.data' against variable `REQUEST_FILENAME' (Value: `/.git/HEAD' ) [file "/usr/local/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "131"] [id "930130"] [rev ""] [msg "Restricted File Access Attempt"] [data "Matched Data: .git/ found within REQUEST_FILENAME: /.git/HEAD"] [severity "2"] [ver "OWASP_CRS/4.28.0-dev"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-LFI"] [tag "capec/1000/255/153/126"] [uri "/.git/HEAD"] [unique_id "178167229441.095022"] [ref "o1,5v4,10t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin"]
[Wed Jun 17 06:58:16.066041 2026] [:error] [pid 3608531:tid 3608531] [client 164.92.154.226:55324] ModSecurity:
...
show less
Web App Attack
🇬🇧
Aetherweb Ark
2026-06-17 04:42:46
(2 days ago)
(mod_security) mod_security (id:949110) triggered by 164.92.154.226 (-): N in the last X secs
Web App Attack
🇹🇷
Threat.live
2026-06-17 04:05:06
(2 days ago)
Suspicious Connection Attempts
Brute-Force
🇺🇸
TPI-Abuse
2026-06-17 03:06:05
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 164.92.154.226 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 164.92.154.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 16 23:05:59.724964 2026] [security2:error] [pid 16416:tid 16416] [client 164.92.154.226:37202] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.91"] [uri "/.git/HEAD"] [unique_id "ajIPF_G1w8kg6m6iDdRNOAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack