🇵🇱
Budyn
2026-09-01 10:11:31
(26 minutes ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: billing.astropot.website | URI: /phpinfo.php | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
2026-09-01 09:40:09
(58 minutes ago)
| Suspicious URL access.
Web App Attack
Hacking
SQL Injection
🇺🇸
TPI-Abuse
2026-09-01 09:39:24
(59 minutes ago)
(mod_security) mod_security (id:210492) triggered by 180.243.190.67 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 180.243.190.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 05:39:20.483857 2026] [security2:error] [pid 6107:tid 6107] [client 180.243.190.67:8225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bikestickers.cc"] [uri "/.env/.env.bak"] [unique_id "apadSIbPyDLg3J35xqTk6gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 09:20:46
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 180.243.190.67 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 180.243.190.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 05:20:39.496154 2026] [security2:error] [pid 24127:tid 24221] [client 180.243.190.67:30177] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bigwheel-design.com"] [uri "/.env/.env.bak"] [unique_id "apaY5xnFIQXPc6l4--NcxQAAAMs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-01 07:09:03
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 180.243.190.67 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 180.243.190.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 01 03:08:54.598859 2026] [security2:error] [pid 31119:tid 31172] [client 180.243.190.67:5083] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bhhg.org"] [uri "/.env/.env.bak"] [unique_id "apZ6Br6E4kI5uuWPFcAm7gAAAY4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-09-01 06:21:46
(4 hours ago)
[TueSep0108:21:40.3865172026][security2:error][pid3769840:tid3769880][client180.243.190.67:0]ModSecu ...
show more
[TueSep0108:21:40.3865172026][security2:error][pid3769840:tid3769880][client180.243.190.67:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(\?:/\(\?:\^\|/\)\\\\\\\\.\(env\|git\|svn\|hg\|DS_Store\)\|/\(\?:wp-config\|\\\\\\\\.htaccess\|\\\\\\\\.htpasswd\)\|\\\\\\\\.\(\?:sql\|bak\|old\|log\)\$\)\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"156\"][id\"960720\"][msg\"Forbiddenfileaccessattempt\"][severity\"CRITICAL\"][hostname\"autoconfig.buletti-panettoni.ch\"][uri\"/.env/.env.bak\"][unique_id\"apZu9MiJimrLq9GHRL20ZgAAABY\"]
show less
Port Scan
Brute-Force
Web App Attack
🇩🇪
LRob
2026-09-01 06:03:35
(4 hours ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /.env/.env.bak | 2026-09-01 06:03 UTC
show less
Hacking
Web App Attack
🇩🇪
ghostwarriors
2026-09-01 04:50:09
(5 hours ago)
Attempts against non-existent wp-login
Brute-Force
Web App Attack
🇩🇪
yitzhaq
2026-09-01 04:37:17
(6 hours ago)
180.243.190.67 - - [01/Sep/2026:06:37:06 +0200] "GET / HTTP/1.1" 200 1138 "-" "Mozilla/5.0 (Windows ...
show more
180.243.190.67 - - [01/Sep/2026:06:37:06 +0200] "GET / HTTP/1.1" 200 1138 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3"
180.243.190.67 - - [01/Sep/2026:06:37:08 +0200] "GET /phpinfo.php HTTP/1.1" 404 522 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3"
180.243.190.67 - - [01/Sep/2026:06:37:09 +0200] "GET /test.php HTTP/1.1" 404 522 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3"
180.243.190.67 - - [01/Sep/2026:06:37:10 +0200] "GET /_profiler/phpinfo HTTP/1.1" 404 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3"
180.243.190.67 - - [01/Sep/2026:06:37:12 +0200] "GET /.env/.env.bak HTTP/1.1" 404 495 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.302
show less
Web App Attack
Hacking
🇺🇸
TPI-Abuse
2026-09-01 03:37:52
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 180.243.190.67 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 180.243.190.67 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Aug 31 23:37:48.292797 2026] [security2:error] [pid 19231:tid 19231] [client 180.243.190.67:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "betiqos.com"] [uri "/.env/.env.bak"] [unique_id "apZIjC9ZsbVn3yWb42GVFAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-09-01 03:09:01
(7 hours ago)
Try to access /.env/.env.bak
Web App Attack
🇮🇹
VHosting
2026-09-01 00:40:04
(9 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇩🇪
maxpower
2026-09-01 00:28:51
(10 hours ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 180.243.190.67 (ID/Indonesia/-): 1 in th ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 180.243.190.67 (ID/Indonesia/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 180.243.190.67 - - [01/Sep/2026:02:28:47 +0200] "GET /.aws/credentials HTTP/1.1" 200 11913 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3" "-" host=analisibioenergetica.com
show less
Port Scan
2026-09-01 00:14:51
(10 hours ago)
CrowdSec: crowdsecurity/vpatch-symfony-profiler
Hacking
Web App Attack
🇵🇱
Budyn
2026-08-31 23:57:03
(10 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: auth.budyn.xyz | URI: /.env/.env.bak | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack