|
🇳🇱
Site.eu
|
|
Scanning for secret files (.env, .git, credentials, config backups)
|
Bad Web Bot
Web App Attack
|
|
🇳🇱
homeshowdomain.nl
|
|
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-26.
|
Web App Attack
SSH
Hacking
|
|
Anonymous
|
|
34.32.42.52 - - [27/Oct/2026:20:48:48 +0200] "POST / HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.42.52 - - [27/Oct/2026:20:48:48 +0200] "POST / HT ...
show more
34.32.42.52 - - [27/Oct/2026:20:48:48 +0200] "POST / HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.42.52 - - [27/Oct/2026:20:48:48 +0200] "POST / HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.42.52 - - [27/Oct/2026:20:48:48 +0200] "POST / HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.42.52 - - [27/Oct/2026:20:48:48 +0200] "GET /.git/config HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.42.52 - - [27/Oct/2026:20:48:48 +0200] "GET /.env HTTP/1.1" 403 184 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.32.42.52
...
show less
|
Bad Web Bot
Web App Attack
|
|
🇫🇷
HerrWolf
|
|
CrowdSec Detection: crowdsecurity/http-admin-interface-probing
|
Web App Attack
|
|
🇧🇷
radardatelecom
|
|
Blocked by Radar da Telecom firewall — abuseipdb
|
Bad Web Bot
Web App Attack
|
|
🇪🇸
robotstxt
|
|
34.32.42.52 - - [27/Oct/2026:16:17:31 +0000] "POST /panel.php HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.32.42.52"
34.32.42.52 - - [27/Oct/2026: ...
show more
34.32.42.52 - - [27/Oct/2026:16:17:31 +0000] "POST /panel.php HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.32.42.52"
34.32.42.52 - - [27/Oct/2026:16:17:31 +0000] "POST /panel.php HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.32.42.52"
34.32.42.52 - - [27/Oct/2026:16:17:31 +0000] "GET /.git/config HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.32.42.52"
34.32.42.52 - - [27/Oct/2026:16:17:31 +0000] "GET /.env HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36" "-" edge="34.32.42.52"
34.32.42.52 - - [27/Oct/2026:16:17:32 +0000] "GET /.env.local HTTP/1.1" 403 208 "-" "Mozilla/5.0 (Windows NT 10.0; Win64;
...
show less
|
Web App Attack
|
|
🇩🇪
Dennis
|
|
34.32.42.52 has been banned for triggering http-sensitive-files (5 events over 865.982772ms).
|
Brute-Force
Web App Attack
|
|
🇵🇱
Budyn
|
|
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: panel.dont-eat-the-pudding.online | URI: /.git/co ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: panel.dont-eat-the-pudding.online | URI: /.git/config | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"34.32.42.52","Cdn-Loop":"cloudflare; loops=1","Connection":"Keep-Alive","Cf-Ray":"a512d43a0a5bef8b-WAW","Accept-Encoding":"gzip, br","Accept":"*\/*","Next-Action":"x","
show less
|
Bad Web Bot
Web App Attack
|
|
🇳🇦
jacqueskruger
|
|
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 19 confirmed alerts / 20 triggering events. Detections: crowdsecurity/vpatch-CVE-2025-55182, crowdsecurity/vpatch-env-access, high-confidence-scanner. Latest evidence ...
show more
Locally observed malicious HTTP activity on our reverse proxy in the last 24 hours. 19 confirmed alerts / 20 triggering events. Detections: crowdsecurity/vpatch-CVE-2025-55182, crowdsecurity/vpatch-env-access, high-confidence-scanner. Latest evidence UTC: 2026-10-27T14:35:54Z. Evidence: inline WAF rejection of exploit requests.
show less
|
Web App Attack
|
|
🇩🇰
Ha1fdan
|
|
Blocked by CrowdSec: crowdsecurity/http-sensitive-files
|
Brute-Force
Exploited Host
|
|
🇳🇱
debestelapp
|
|
|
Web App Attack
|
|
🇬🇧
venus.launch.bz
|
|
(wpscan) WordPress probe detected from 34.32.42.52 (DE/Germany/52.42.32.34.bc.googleusercontent.com)
|
Hacking
|
|
🇫🇮
Vaino Karppi
|
|
Honeypot triggered: Tried to access restricted page /admin/.env
|
Hacking
|
|
🇳🇱
Mangelot Hosting
|
|
(web_sensitive_file) srv101 Sensitive file probe (.env/.git/backup) 34.32.42.52 (DE/Germany/52.42.32.34.bc.googleusercontent.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
|
Web App Attack
|
|
🇳🇱
Savvii
|
|
20 attempts against mh-misbehave-ban on eris
|
Brute-Force
Bad Web Bot
Web App Attack
|
