🇩🇪
WellSpring
2026-10-15 09:35:56
(4 days ago)
phpunit rce on 159.69.202.189/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php — WellSpr.ing/NetSe ...
show more
phpunit rce on 159.69.202.189/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php — WellSpr.ing/NetSentinel civic-AI security layer
show less
Web App Attack
🇫🇷
zulzeen
2026-10-15 07:59:51
(4 days ago)
[incypit-web] Banned by Fail2ban (Jail: syswarden-secretshunter)
Hacking
Web App Attack
Bad Web Bot
Port Scan
🇷🇺
weke
2026-10-15 06:55:48
(4 days ago)
Low-interaction honeypot observation; observed_at=2026-10-15T06:55:48.507Z; window_ms=10000; connect ...
show more
Low-interaction honeypot observation; observed_at=2026-10-15T06:55:48.507Z; window_ms=10000; connections=1; traffic=237B-in/181B-out; destinations=80/http:1c,237B-in,181B-out; protocols=http; categories=21; indicators=secret-file-probe; http=GET /newsite/.env [ua=Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.4240.183 Safari/537.36]
show less
Web App Attack
🇩🇪
MusicLibrary
2026-10-15 06:01:09
(4 days ago)
Attempted access to sensitive configuration files (.env, .git, etc.)
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 05:18:40
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 194.32.120.125 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 194.32.120.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 01:18:10.069966 2026] [security2:error] [pid 28759:tid 28759] [client 194.32.120.125:61701] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.208"] [uri "/app/.env"] [unique_id "atBiEt5EAoe-G1l0hBYCAwAAADM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 04:48:50
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 194.32.120.125 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 194.32.120.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 00:48:24.434727 2026] [security2:error] [pid 25937:tid 25937] [client 194.32.120.125:39643] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.179"] [uri "/storage/.env"] [unique_id "atBbGGTulON7SGZ7e9fbnQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 03:24:54
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 194.32.120.125 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 194.32.120.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 23:24:27.435548 2026] [security2:error] [pid 26224:tid 26228] [client 194.32.120.125:39465] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.81"] [uri "/www/.env"] [unique_id "atBHa40Tiqc_C4d9CRc6FQAAAQI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 02:35:40
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 194.32.120.125 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 194.32.120.125 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 14 22:35:06.546492 2026] [security2:error] [pid 13138:tid 13138] [client 194.32.120.125:35739] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.75"] [uri "/app/.env"] [unique_id "atA72jFP3sB4TsYZQNejIQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
demonsword
2026-09-17 09:22:24
(1 month ago)
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ...
show more
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: www.expressapisv2.net:443
show less
Open Proxy
Port Scan
🇮🇹
VHosting
2026-08-28 17:30:04
(1 month ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
kosada.com
2026-07-20 05:38:53
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇮🇹
VHosting
2026-06-18 12:45:03
(4 months ago)
Detected WordPress attack from 4 different servers
Brute-Force
Web App Attack
🇫🇷
masterguru
2026-06-09 00:11:59
(4 months ago)
xmlrpc request blocked, no referer. Pattern match "xmlrpc.php" at REQUEST_URI. (88010-201)
Hacking
🇩🇪
big-cloud.nl
2026-05-07 00:57:27
(5 months ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
fortypoundhead
2026-04-10 06:52:52
(6 months ago)
Banned IP Address
Hacking
Web App Attack
