🇵🇱
Budyn
2026-11-07 16:24:56
UTC ·
(2 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: forum.teddypot.store | Path: /wp-admin/ | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWeb ...
show more
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: forum.teddypot.store | Path: /wp-admin/ | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.co... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-07 11:26:46
UTC ·
(7 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: panel.teddypot.store | Path: /backup.sql | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: panel.teddypot.store | Path: /backup.sql | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.co... | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 03:57:49
UTC ·
(15 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:3f:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 22:57:45.507363 2026] [security2:error] [pid 21005:tid 21005] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f806:3f:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 22:57:45.507363 2026] [security2:error] [pid 21005:tid 21005] [client 2a03:2880:f806:3f:::37242] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||natchezbicycle.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "natchezbicycle.com"] [uri "/natchezbicycle.com"] [unique_id "au6huZ7z9dbR0nj3iA4AHwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-05 11:48:48
UTC ·
(2 days ago)
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: vpn.goblinpot.tech | Path: /backup.sql | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x6 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: vpn.goblinpot.tech | Path: /backup.sql | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.co... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-04 13:52:33
UTC ·
(3 days ago)
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: cluster.astropot.space | Path: /wp-admin/ | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) ...
show more
[Budyn Honeypot Sinkhole] | Attack type: WP Path Scanning (Recon) | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: cluster.astropot.space | Path: /wp-admin/ | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.faceb... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
mawan
2026-11-03 14:02:42
UTC ·
(4 days ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
🇫🇷
abuseipdb.amaze321
2026-10-29 09:41:05
UTC ·
(1 week ago)
Automated reconnaissance: repeated requests for sensitive/non-existent paths.
Web App Attack
Bad Web Bot
🇵🇱
sefinek.net
2026-10-28 14:45:40
UTC ·
(1 week ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru/artist/%E3%81%84%E3%81%8B%E3%82%82 | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 S ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru/artist/%E3%81%84%E3%81%8B%E3%82%82 | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇷
WebServ
2026-10-28 13:31:47
UTC ·
(1 week ago)
Fail2Ban jail [nginx-noscript]: banned after 3 failed attempt(s). Probing for disallowed script extensions
Hacking
Web App Attack
🇵🇱
sefinek.net
2026-10-28 12:30:58
UTC ·
(1 week ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru/artist/crro | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (com ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru/artist/crro | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇵🇱
sefinek.net
2026-10-23 16:02:45
UTC ·
(2 weeks ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru/artist/okutiri | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 ( ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru/artist/okutiri | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇵🇱
sefinek.net
2026-10-21 23:49:14
UTC ·
(2 weeks ago)
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru/artist/%E3%81%86%E3%81%95%E3%81%BF%E3%81%93%E3%81%93%E3%81%82 | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, lik ...
show more
Triggered Cloudflare WAF (firewallManaged) from US.
Action: BLOCK | Protocol: HTTP/2 (GET) | Endpoint: /booru/artist/%E3%81%86%E3%81%95%E3%81%BF%E3%81%93%E3%81%93%E3%81%82 | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-externalagent/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇷
abuseipdb.amaze321
2026-10-15 06:37:45
UTC ·
(3 weeks ago)
Automated reconnaissance: repeated requests for sensitive/non-existent paths.
Web App Attack
Bad Web Bot
🇵🇱
mscode.pl
2026-10-12 11:58:14
UTC ·
(3 weeks ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
ASN: 32934 (Facebook, Inc.)
Protocol: HTTP/2 (GET method)
Zone: r2.selify.io
Endpoint: /
UA: facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-10 04:26:18
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2a03:2880:f806:3f:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 00:26:09.855669 2026] [security2:error] [pid 425:tid 425] [client 2a03:2880:f806 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a03:2880:f806:3f:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 00:26:09.855669 2026] [security2:error] [pid 425:tid 425] [client 2a03:2880:f806:3f:::35386] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "iotgardening.nextngnr.com"] [uri "/Hmklo4.htaccess"] [unique_id "asm-YS7Fvgw8V8eCsgXr3AAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack