🇳🇱
e.fierstra
2026-11-15 20:20:25
UTC ·
(8 minutes ago)
excessive HTTP 404 errors
Bad Web Bot
🇸🇪
vaia.cloud
2026-11-15 14:50:02
UTC ·
(5 hours ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇩🇪
updown.io
2026-11-15 12:43:38
UTC ·
(7 hours ago)
{"level":"info","ts":1794746618.6545086,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"175.29.134.148","remote_port":"39647","client_ip":"175.29.134.148","proto":"HTTP/2.0","method":"GET","host":"status.calblock.io"," ...
show more
{"level":"info","ts":1794746618.6545086,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"175.29.134.148","remote_port":"39647","client_ip":"175.29.134.148","proto":"HTTP/2.0","method":"GET","host":"status.calblock.io","uri":"/config.php","headers":{"Sec-Ch-Ua":["\"Chromium\";v=\"152\", \"Google Chrome\";v=\"152\", \"Not.A/Brand\";v=\"99\""],"Sec-Ch-Ua-Mobile":["?0"],"Sec-Ch-Ua-Platform":["\"Windows\""],"Sec-Fetch-User":["?1"],"Sec-Fetch-Dest":["document"],"Accept-Language":["fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"],"Sec-Fetch-Site":["none"],"Sec-Fetch-Mode":["navigate"],"Accept-Encoding":["gzip, deflate, br"],"Upgrade-Insecure-Requests":["1"],"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7"]},"tls":{"resumed":false,"version":772,"ciph
...
show less
DDoS Attack
Web App Attack
🇵🇱
Budyn
2026-11-15 11:57:35
UTC ·
(8 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: staging.definitelynotahoneypot.top | Path: /.env | User-Agent: Mozilla/5.0 (Windows NT 10.0; ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: staging.definitelynotahoneypot.top | Path: /.env | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇩🇪
FeG Deutschland
2026-11-15 09:45:35
UTC ·
(10 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14
Exploited Host
Web App Attack
🇮🇹
VHosting
2026-11-15 08:10:06
UTC ·
(12 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-11-15 01:09:29
UTC ·
(19 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: shop.astropot.store | Path: /.env | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) App ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: shop.astropot.store | Path: /.env | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇩🇪
big-cloud.nl
2026-11-15 00:38:08
UTC ·
(19 hours ago)
Try to access /.env
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 19:23:00
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 175.29.134.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 14:22:54.203914 2026] [security2:error] [pid 15490:tid 15490] [client 175.29.134.148:42667] ...
show more
(mod_security) mod_security (id:210492) triggered by 175.29.134.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 14:22:54.203914 2026] [security2:error] [pid 15490:tid 15490] [client 175.29.134.148:42667] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "idetailingcreatives.com"] [uri "/.env"] [unique_id "avi1DnU6sKfAlwa4FnLgvwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
screwlooseit.com.au
2026-11-14 18:01:37
UTC ·
(1 day ago)
Blocked by CSF 13 firewall - Rule: config-dotfile
BD/Bangladesh/-
Web App Attack
🇺🇸
TPI-Abuse
2025-12-31 05:28:06
UTC ·
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 175.29.134.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 31 00:27:59.973580 2025] [security2:error] [pid 955:tid 955] [client 175.29.134.148:36383] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 175.29.134.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 31 00:27:59.973580 2025] [security2:error] [pid 955:tid 955] [client 175.29.134.148:36383] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||deserttrails.net|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "deserttrails.net"] [uri "/wp-json/wp/v2/users"] [unique_id "aVS0X_69WvW9hwNWVLjvzAAAAAc"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-31 03:26:19
UTC ·
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 175.29.134.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 30 22:26:15.608051 2025] [security2:error] [pid 10877:tid 10877] [client 175.29.134.148:42389] ...
show more
(mod_security) mod_security (id:225170) triggered by 175.29.134.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 30 22:26:15.608051 2025] [security2:error] [pid 10877:tid 10877] [client 175.29.134.148:42389] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||b-kinibottom.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "b-kinibottom.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aVSX13DdrZncECCvUotG3AAAAAI"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2025-12-30 20:45:02
UTC ·
(10 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
TPI-Abuse
2025-12-30 19:32:16
UTC ·
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 175.29.134.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 30 14:32:07.991553 2025] [security2:error] [pid 594811:tid 594816] [client 175.29.134.148:4595 ...
show more
(mod_security) mod_security (id:225170) triggered by 175.29.134.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 30 14:32:07.991553 2025] [security2:error] [pid 594811:tid 594816] [client 175.29.134.148:45957] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||trejbal.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "trejbal.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aVQotzgQX0O1D1RcuX-QygAAAAA"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
