๐ณ๐ฑ
debestelapp
2026-10-22 14:35:10
(1 hour ago)
Web App Attack
๐ฉ๐ช
Wolfgang
2026-10-22 13:15:00
(3 hours ago)
Yet another bad guy with a bunch of PHP requests. There is no PHP on my servers--and I know why.
Brute-Force
Web App Attack
๐ต๐ฑ
Budyn
2026-10-22 11:37:26
(4 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: admin.goblinpot.online | URI: /.git/config | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"HK","Cf-Connecting-Ip":"34.150.76.174","Cdn-Loop":"cloudflare; loops=1","Connection":"Keep-Alive","Cf-Ray":"a4e835c07c954639-HKG","Accept-Encoding":"gzip, br","Accept":"*\/*","Next-Action":"x","X-Nextjs-Reques
show less
Bad Web Bot
Web App Attack
๐บ๐ธ
1gz
2026-10-22 08:53:00
(7 hours ago)
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: CHALLENGE
Protocol: HTTP/1.1 (GET m ...
show more
Triggered Cloudflare WAF (firewallCustom) from HK.
Action taken: CHALLENGE
Protocol: HTTP/1.1 (GET method)
Endpoint: /firebase-key.json
UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
๐ช๐ธ
robotstxt
2026-10-22 07:58:39
(8 hours ago)
34.150.76.174 - - [22/Oct/2026:07:57:45 +0000] "GET /.env HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Window ...
show more
34.150.76.174 - - [22/Oct/2026:07:57:45 +0000] "GET /.env HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.150.76.174"
34.150.76.174 - - [22/Oct/2026:07:57:45 +0000] "GET /.env.local HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.150.76.174"
34.150.76.174 - - [22/Oct/2026:07:57:45 +0000] "GET /.env.production HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.150.76.174"
34.150.76.174 - - [22/Oct/2026:07:57:46 +0000] "GET /.env.staging HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.150.76.174"
34.150.76.174 - - [22/Oct/2026:07:57:46 +0000] "GET /.env.development HTTP/1.1" 403 208 "-" "Mozill
...
show less
Web App Attack
๐ฉ๐ช
jotoma.de
2026-10-22 07:41:20
(8 hours ago)
[Thu Oct 22 09:40:42.068057 2026] [authz_core:error] [pid 4016916:tid 4016962] [client 34.150.76.174 ...
show more
[Thu Oct 22 09:40:42.068057 2026] [authz_core:error] [pid 4016916:tid 4016962] [client 34.150.76.174:46342] AH01630: client denied by server configuration: /var/www/analytics.jotoma.de/config/.env
[Thu Oct 22 09:41:03.209785 2026] [authz_core:error] [pid 3724857:tid 3724929] [client 34.150.76.174:35210] AH01630: client denied by server configuration: /var/www/analytics.jotoma.de/tmp/.env
[Thu Oct 22 09:41:19.683277 2026] [authz_core:error] [pid 3724856:tid 3724905] [client 34.150.76.174:35870] AH01630: client denied by server configuration: /var/www/analytics.jotoma.de/config/app
...
show less
Web Spam
Brute-Force
๐ณ๐ฑ
Site.eu
2026-10-22 06:54:24
(9 hours ago)
Excessive multi-domain requests
Brute-Force
๐ซ๐ท
cydit.eu
2026-10-22 06:26:35
(9 hours ago)
phpMyAdmin attack detected by fail2ban on thor.cydit.eu
Web App Attack
๐ฉ๐ช
XICTRON
2026-10-22 06:20:05
(10 hours ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
๐ช๐ธ
robotstxt
2026-10-22 05:41:58
(10 hours ago)
34.150.76.174 - - [22/Oct/2026:05:41:47 +0000] "GET /.git/config HTTP/1.1" 403 208 "-" "Mozilla/5.0 ...
show more
34.150.76.174 - - [22/Oct/2026:05:41:47 +0000] "GET /.git/config HTTP/1.1" 403 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.150.76.174"
34.150.76.174 - - [22/Oct/2026:05:41:48 +0000] "GET /.git/config HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.150.76.174"
34.150.76.174 - - [22/Oct/2026:05:41:48 +0000] "GET /.env HTTP/1.1" 403 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.150.76.174"
34.150.76.174 - - [22/Oct/2026:05:41:48 +0000] "GET /.env.local HTTP/1.1" 403 208 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.150.76.174"
34.150.76.174 - - [22/Oct/2026:05:41:49 +0000] "GET /.env HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit
...
show less
Web App Attack
๐ช๐ธ
robotstxt
2026-10-22 04:36:16
(11 hours ago)
34.150.76.174 - - [22/Oct/2026:04:35:31 +0000] "GET /.env HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Window ...
show more
34.150.76.174 - - [22/Oct/2026:04:35:31 +0000] "GET /.env HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.150.76.174"
34.150.76.174 - - [22/Oct/2026:04:35:32 +0000] "GET /.env.local HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.150.76.174"
34.150.76.174 - - [22/Oct/2026:04:35:32 +0000] "GET /.env.production HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.150.76.174"
34.150.76.174 - - [22/Oct/2026:04:35:32 +0000] "GET /.env.staging HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.150.76.174"
34.150.76.174 - - [22/Oct/2026:04:35:33 +0000] "GET /.env.development HTTP/1.1" 403 208 "-" "Mozill
...
show less
Web App Attack
๐ฟ๐ฆ
conure.sh
2026-10-22 03:18:36
(13 hours ago)
csagent: score 20.7: 404 noise floor x3, secrets grab x2; 1 domain(s) in 2s
Web App Attack
๐ซ๐ท
masterguru
2026-10-22 00:31:31
(15 hours ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
๐ณ๐ฑ
Mangelot Hosting
2026-10-22 00:07:36
(16 hours ago)
(web_sensitive_file) srv101 Sensitive file probe (.env/.git/backup) 34.150.76.174 (HK/Hong Kong/174. ...
show more
(web_sensitive_file) srv101 Sensitive file probe (.env/.git/backup) 34.150.76.174 (HK/Hong Kong/174.76.150.34.bc.googleusercontent.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
๐ซ๐ท
masterguru
2026-10-22 00:01:34
(16 hours ago)
Restricted File Access Attempt. Matched phrase ".git/" at REQUEST_FILENAME. (930130-197)
Hacking
Web App Attack