🇿🇦
conure.sh
2026-10-25 07:02:19
(12 hours ago)
csagent: score 20.0: secrets grab x2; 2 domain(s) in 0s
Web App Attack
🇳🇱
Alt255
2026-10-25 04:04:16
(15 hours ago)
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 167.71.6.59 - - [25/Oct/2026:05:03:57 +0100] "GET /.env.local HTTP/1.1" 301 6020 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Vivaldi/6.8.3381.46"
...
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-25 03:38:11
(16 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: docker.sweetpuddingtrap.online | URI: /.env.local | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Vivaldi/6.8.3381.46 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"NL","Cf-Connecting-Ip":"167.71.6.59","Cdn-Loop":"cloudflare; loops=1","Connection":"Keep-Alive","Cf-Ray":"a4fe2fdb2e3f4389-AMS","Accept":"text\/plain,text\/html,application\/xh
show less
Bad Web Bot
Web App Attack
🇹🇷
Detmach
2026-10-24 22:47:14
(21 hours ago)
Security attack detected. Multiple failed attempts from 167.71.6.59. IP banned for 1440 minutes at 2 ...
show more
Security attack detected. Multiple failed attempts from 167.71.6.59. IP banned for 1440 minutes at 25.10.2026 01:46:36. Failed attempts: 1
show less
Brute-Force
2026-10-24 05:00:46
(1 day ago)
BruteForce IMAP/POP3/SMTP
Brute-Force
🇺🇸
mnsf
2026-10-24 04:05:03
(1 day ago)
Abuse Detected (9)
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-10-24 03:28:41
(1 day ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: status.teddypot.tech | URI: /.env.local | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 Vivaldi/6.8.3381.46 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"NL","Cf-Connecting-Ip":"167.71.6.59","Cdn-Loop":"cloudflare; loops=1","Connection":"Keep-Alive","Cf-Ray":"a4f5e493bd311c64-AMS","Accept":"text\/plain,text\/html,application\/xhtml+xml,ap
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-22 03:24:28
(3 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: registry.sweetpuddingtrap.online | URI: /.env.local | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:125.0) Gecko/20100101 Firefox/125.0 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"NL","Cf-Connecting-Ip":"167.71.6.59","Cdn-Loop":"cloudflare; loops=1","Connection":"Keep-Alive","Cf-Ray":"a4e563a22c52fba9-AMS","Accept":"text\/plain,text\/html,application\/xhtml+xml,application\/xml;q=0.9,*\/*;q=0.8","Accept-Lang
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 01:39:22
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 167.71.6.59 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 167.71.6.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 21:39:14.766343 2026] [security2:error] [pid 13623:tid 13623] [client 167.71.6.59:34986] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rohn.com"] [uri "/.env"] [unique_id "atlpQgCj7tJ7T5GjuATYpwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-21 22:01:28
(3 days ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-20.
show less
Web App Attack
SSH
Hacking
2026-10-21 20:54:36
(3 days ago)
sensitive path probe detected by fail2ban
...
Port Scan
Web App Attack
🇿🇦
conure.sh
2026-10-21 19:02:48
(4 days ago)
csagent: score 20.0: secrets grab x2; 2 domain(s) in 0s
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 02:37:51
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 167.71.6.59 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 167.71.6.59 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 22:37:44.398950 2026] [security2:error] [pid 8534:tid 8539] [client 167.71.6.59:44142] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.agriclean.net"] [uri "/.env"] [unique_id "atgleJvI5bfDZs686FR4agAAAIM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
jasperedv.de
2026-10-21 02:32:59
(4 days ago)
Failed IMAP Login - Brutforcing
Email Spam
Brute-Force
🇧🇪
voormedia
2026-10-21 00:12:00
(4 days ago)
Accessed trap at '/.env'
Web App Attack
