🇺🇸
TPI-Abuse
2026-11-07 04:39:15
UTC ·
(34 minutes ago)
(mod_security) mod_security (id:210492) triggered by 24.199.117.0 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 23:39:07.340677 2026] [security2:error] [pid 4437:tid 4437] [client 24.199.117.0:46062] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 24.199.117.0 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 23:39:07.340677 2026] [security2:error] [pid 4437:tid 4437] [client 24.199.117.0:46062] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "altoshire.com"] [uri "/.env"] [unique_id "au6ra6X34gRXE3ongNJzZQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-11-07 04:16:15
UTC ·
(57 minutes ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
RonnieGas
2026-11-07 04:10:25
UTC ·
(1 hour ago)
Automated scanning of a public web platform for credential and configuration files: requests for a framework debug profiler endpoint, a phpinfo profiler endpoint and an environment file on a platform that runs none of them. Cloud-hosted client with a ...
show more
Automated scanning of a public web platform for credential and configuration files: requests for a framework debug profiler endpoint, a phpinfo profiler endpoint and an environment file on a platform that runs none of them. Cloud-hosted client with a spoofed desktop browser user-agent string.
show less
Web App Attack
Hacking
🇱🇻
radix
2026-11-07 00:07:04
UTC ·
(5 hours ago)
Automated probing for sensitive configuration files and environment leaks.
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 23:31:46
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 24.199.117.0 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:31:42.000623 2026] [security2:error] [pid 32334:tid 32334] [client 24.199.117.0:59062] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 24.199.117.0 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 18:31:42.000623 2026] [security2:error] [pid 32334:tid 32334] [client 24.199.117.0:59062] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aeongames.com"] [uri "/.env"] [unique_id "au5jXmaf-1VAxKQ2FT-IEQAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-11-06 22:59:02
UTC ·
(6 hours ago)
Auto-ban: >3000 req/min op 2026-11-06
Web App Attack
SSH
Hacking
🇫🇷
Quarks Solutions
2026-11-06 22:29:58
UTC ·
(6 hours ago)
crowdsecurity/appsec-vpatch
Web App Attack
🇳🇦
jacqueskruger
2026-11-06 22:28:19
UTC ·
(6 hours ago)
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 4 confirmed alerts / 4 triggering events. Detections: crowdsecurity/vpatch-symfony-profiler. Latest evidence UTC: 2026-11-06T22:24:52Z. Evidence: inline WAF rejection ...
show more
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 4 confirmed alerts / 4 triggering events. Detections: crowdsecurity/vpatch-symfony-profiler. Latest evidence UTC: 2026-11-06T22:24:52Z. Evidence: inline WAF rejection of exploit requests.
show less
Web App Attack
2026-11-06 22:06:08
UTC ·
(7 hours ago)
Trying to access config files
Web App Attack
🇩🇪
BlueWire Hosting
2026-11-06 21:39:47
UTC ·
(7 hours ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇵🇱
Budyn
2026-11-06 20:56:51
UTC ·
(8 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: admin.astropot.online | Path: /.env | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) ...
show more
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: admin.astropot.online | Path: /.env | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
2026-09-29 12:21:01
UTC ·
(1 month ago)
denied traffic to a honeypot network. destination port 3333.
Port Scan
Hacking
🇦🇷
Bruno
2026-07-16 15:51:58
UTC ·
(3 months ago)
Port Scanner: 24.199.117.0
Port Scan
🇳🇱
VMHeaven.io
2026-07-16 15:36:51
UTC ·
(3 months ago)
Blocked by UFW [1883/tcp]
Source port: 61011
TTL: 241
Packet length: 44
Port Scan
🇺🇸
MPL
2025-08-12 06:26:17
UTC ·
(1 year ago)
tcp/3000
Port Scan
