🇺🇸
Watto
2026-05-17 00:37:47
UTC ·
(5 months ago)
Honeypot caught web brute force / scanning from Germany; 62 events recorded by kiosk-watchtower (Cowrie + canary stack). Automated report from honeypot, please do not contact owner.
Bad Web Bot
Web App Attack
🇮🇳
evicky2002
2026-05-14 06:00:00
UTC ·
(6 months ago)
Confirmed malicious by STILWaters CTI platform (score=100, sources=1)
Hacking
Brute-Force
SSH
🇳🇱
homeshowdomain.nl
2026-05-10 22:00:35
UTC ·
(6 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-05-09.
Web App Attack
SSH
Hacking
🇨🇭
filou812
2026-05-10 06:39:45
UTC ·
(6 months ago)
url tried is "/.git/config"
Web App Attack
🇺🇸
TPI-Abuse
2026-05-10 03:30:25
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.32.10.180 (180.10.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 23:30:17.305420 2026] [security2:error] [pid 2555:tid 255 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.10.180 (180.10.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 23:30:17.305420 2026] [security2:error] [pid 2555:tid 2555] [client 34.32.10.180:44572] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "teguer.com"] [uri "/.git/config"] [unique_id "af_7ycwu7NvwvuaKsTWwZgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-05-10 01:47:18
UTC ·
(6 months ago)
730 requests with url.path */.git/config
Brute-Force
Bad Web Bot
2026-05-10 00:47:31
UTC ·
(6 months ago)
34.32.10.180 - - [10/May/2026:08:47:31 +0800] "GET /.git/config HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Linux; Android 9; ONEPLUS A6010) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.89 Mobile Safari/537.36"
...
Bad Web Bot
Web App Attack
🇺🇸
Watto
2026-05-10 00:36:29
UTC ·
(6 months ago)
Honeypot caught web brute force / scanning from Germany; 62 events recorded by kiosk-watchtower (Cowrie + canary stack). Automated report from honeypot, please do not contact owner.
Bad Web Bot
Web App Attack
🇩🇪
Ba-Yu
2026-05-10 00:35:32
UTC ·
(6 months ago)
General hacking/exploits/scanning
Web Spam
Hacking
Brute-Force
Exploited Host
Web App Attack
🇨🇭
4server
2026-05-10 00:35:08
UTC ·
(6 months ago)
[SunMay1002:35:05.2771092026][security2:error][pid849482:tid849510][client34.32.10.180:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\" ...
show more
[SunMay1002:35:05.2771092026][security2:error][pid849482:tid849510][client34.32.10.180:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".git\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"364\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"fimka-icp.com.81-17-25-250.cpanel.site\"][uri\"/.git/config\"][unique_id\"af_SuVG11fcTk6AWfEuRXAAAAJc\"]
show less
Hacking
Web App Attack
2026-05-10 00:26:02
UTC ·
(6 months ago)
Bot / scanning and/or hacking attempts: GET /.git/config HTTP/1.1
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-05-09 23:59:42
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.32.10.180 (180.10.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 19:59:39.953505 2026] [security2:error] [pid 32289:tid 32 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.10.180 (180.10.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 19:59:39.953505 2026] [security2:error] [pid 32289:tid 32289] [client 34.32.10.180:38468] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.crearetest.com.creartest.com"] [uri "/.git/config"] [unique_id "af_Ka_v1hJT1skWCKES5TwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-05-09 23:44:46
UTC ·
(6 months ago)
Try to access /.git/config
Web App Attack
🇺🇸
TPI-Abuse
2026-05-09 23:44:29
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.32.10.180 (180.10.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 19:44:22.373621 2026] [security2:error] [pid 12284:tid 12 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.10.180 (180.10.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 19:44:22.373621 2026] [security2:error] [pid 12284:tid 12284] [client 34.32.10.180:51472] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "glaswood.com"] [uri "/.git/config"] [unique_id "af_G1sd-BWf2LG8TFE0vwgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-09 23:20:17
UTC ·
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 34.32.10.180 (180.10.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 19:20:11.255637 2026] [security2:error] [pid 27426:tid 27 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.32.10.180 (180.10.32.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat May 09 19:20:11.255637 2026] [security2:error] [pid 27426:tid 27464] [client 34.32.10.180:44598] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mykfccares.com"] [uri "/.git/config"] [unique_id "af_BK2ujkfCd93AI9_-cPwAAAMk"]
show less
Brute-Force
Bad Web Bot
Web App Attack