🇹🇷
neron
2026-08-26 19:00:50
(22 hours ago)
CrowdSec blocked: ssh:bruteforce detected via OPNsense firewall
Hacking
Web App Attack
🇺🇸
Rayulcifer
2026-08-26 12:44:46
(1 day ago)
20.106.182.199 - - [26/Aug/2026:07:44:45 -0500] "GET http://cachefly.cachefly.net/200mb.test HTTP/1. ...
show more
20.106.182.199 - - [26/Aug/2026:07:44:45 -0500] "GET http://cachefly.cachefly.net/200mb.test HTTP/1.1" 403 363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"
20.106.182.199 - - [26/Aug/2026:07:44:45 -0500] "GET http://speedtest.tele2.net/1MB.zip HTTP/1.1" 403 363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"
20.106.182.199 - - [26/Aug/2026:07:44:45 -0500] "GET http://ipv4.download.thinkbroadband.com/1MB.zip HTTP/1.1" 403 363 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36"
20.106.182.199 - - [26/Aug/2026:07:44:45 -0500] "CONNECT speed.hetzner.de:443 HTTP/1.1" 403 344 "-" "-"
20.106.182.199 - - [26/Aug/2026:07:44:45 -0500] "CONNECT speed.cloudflare.com:443 HTTP/1.1" 403 344 "-" "-"
...
show less
Open Proxy
Port Scan
Hacking
Web App Attack
SSH
🇯🇵
demonsword
2026-08-26 12:42:15
(1 day ago)
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ...
show more
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: speed.hetzner.de:443
show less
Open Proxy
Port Scan
2026-08-07 04:16:42
(2 weeks ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇷🇸
Scan
2026-08-07 00:15:15
(2 weeks ago)
MultiHost/MultiPort Probe, Scan, Hack -
Port Scan
Hacking
2026-08-07 00:04:35
(2 weeks ago)
denied traffic to a honeypot network. destination port 2095.
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-08-06 21:52:15
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 20.106.182.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 20.106.182.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 06 17:52:08.168036 2026] [security2:error] [pid 3343399:tid 3343399] [client 20.106.182.199:47176] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.139"] [uri "/.git/HEAD"] [unique_id "anUCCF9HstG0TGLikJozOwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
demonsword
2026-07-22 12:21:23
(1 month ago)
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ...
show more
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: voting-backend.shayan-farid-pc.workers.dev:443
show less
Open Proxy
Port Scan
🇬🇧
PeravixGroup
2026-06-02 14:19:21
(2 months ago)
Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. A ...
show more
Honeypot detection: Web application scanning / reconnaissance attempt on port 8080. Severity: LOW. Aaran.cloud
show less
Port Scan
Bad Web Bot
🇺🇸
TPI-Abuse
2026-06-02 12:10:08
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 20.106.182.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 20.106.182.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 08:10:04.643158 2026] [security2:error] [pid 24102:tid 24107] [client 20.106.182.199:6338] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.201"] [uri "/.git/HEAD"] [unique_id "ah7IHMwMjOMwtv2xsPVkPAAAAMI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Richie
2026-06-02 10:41:30
(2 months ago)
[HOST1] Port Scan detected
Port Scan
2026-06-02 09:06:30
(2 months ago)
Honeypot wireguard: source IP triggered 3+ blocked attempts in 24h (ports: 80/tcp (HTTP), 8080/tcp ( ...
show more
Honeypot wireguard: source IP triggered 3+ blocked attempts in 24h (ports: 80/tcp (HTTP), 8080/tcp (HTTP-alt), 8443/tcp (HTTPS-alt))
show less
Port Scan
🇺🇸
kosada.com
2026-06-02 08:16:15
(2 months ago)
Web vulnerability probing: /server-status (bogus vhost/SNI)
Web App Attack
🇺🇸
MPL
2026-06-02 07:09:09
(2 months ago)
tcp port scan (16 or more attempts)
Port Scan
🇺🇸
TPI-Abuse
2026-06-02 07:00:11
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 20.106.182.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 20.106.182.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 02 03:00:03.613570 2026] [security2:error] [pid 18905:tid 18905] [client 20.106.182.199:57932] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.235"] [uri "/.git/HEAD"] [unique_id "ah5_c1fLi4SPmJxOa1BjEQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack