🇨🇭
copestack
2026-11-12 02:30:12
UTC ·
(1 day ago)
Honeypot hit on ov-9acb4e (fail2ban jail: roridula-feed)
Port Scan
🇵🇱
Budyn
2026-11-11 15:37:22
UTC ·
(1 day ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: dev.definitelynotahoneypot.top | Path: /.git/config | User-Agent: Mozilla/5.0 (Macintosh; Int ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: dev.definitelynotahoneypot.top | Path: /.git/config | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇺🇸
antlac1
2026-11-11 13:24:48
UTC ·
(1 day ago)
CrowdSec detected malicious behaviour (scenario: crowdsecurity/http-sensitive-files)
Web App Attack
🇳🇱
[email protected]
2026-11-11 12:41:48
UTC ·
(1 day ago)
Detected by fail2ban (nginx-deny)
Web App Attack
🇩🇪
jbcrn
2026-11-11 11:56:19
UTC ·
(1 day ago)
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537. ...
show more
Blocked by iocaine (nam-shub-of-enki) tarpit. Classified as: Disguised bots, ruleset: faked-browser. Requested honeypot path: /. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-11 11:55:57
UTC ·
(1 day ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: dev.astropot.online | Path: /.git/config | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: dev.astropot.online | Path: /.git/config | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇺🇸
alecj.com
2026-11-11 03:47:19
UTC ·
(2 days ago)
This IP was detected by CrowdSec triggering crowdsecurity/appsec-vpatch
Web App Attack
🇵🇱
Budyn
2026-11-11 02:51:10
UTC ·
(2 days ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: jenkins.astropot.site | Path: /.git/config | User-Agent: Mozilla/5.0 (X11; Linux x86_64) Appl ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: jenkins.astropot.site | Path: /.git/config | User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇳🇱
Alt255
2026-11-11 02:36:10
UTC ·
(2 days ago)
[ti-01al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.175.193.173 - - [11/Nov/2026:03:36:02 +0100] "GET /.git/config HTTP/2.0" 403 83 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML ...
show more
[ti-01al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.175.193.173 - - [11/Nov/2026:03:36:02 +0100] "GET /.git/config HTTP/2.0" 403 83 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇧🇪
boxed-it
2026-11-10 05:40:41
UTC ·
(3 days ago)
GET /.git/config (Tarpitted for 1d9h48m35s, wasted 6.96MB)
Web App Attack
🇸🇪
vaia.cloud
2026-11-10 03:25:01
UTC ·
(3 days ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
Anonymous
2026-11-10 02:17:50
UTC ·
(3 days ago)
Web application attack: http sensitive files; Probing for exposed secret / credential files
Hacking
Web App Attack
🇨🇦
1gz
2026-11-09 23:01:07
UTC ·
(3 days ago)
Triggered Cloudflare WAF (firewallManaged) from ES.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /en
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
This rep ...
show more
Triggered Cloudflare WAF (firewallManaged) from ES.
Action taken: BLOCK
Protocol: HTTP/1.1 (POST method)
Endpoint: /en
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇮🇩
origrata
2026-11-09 21:41:07
UTC ·
(3 days ago)
[OGWAF] path_traversal attack blocked | severity: high | GET /.git/config | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Sa
Hacking
Web App Attack
🇧🇷
ICS Labs
2026-11-09 20:08:46
UTC ·
(3 days ago)
ICS Labs threat intelligence (ICS Feeds): Brute-Force. Last observed 2026-11-09 UTC.
Brute-Force