🇵🇱
Budyn
2026-11-15 13:40:41
UTC ·
(4 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: radius.dont-eat-the-pudding.top | Path: /.env | User-Agent: Mozilla/5.0 (iPhone; CPU iPhone O ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: radius.dont-eat-the-pudding.top | Path: /.env | User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇺🇸
aldo
2026-11-15 11:52:10
UTC ·
(5 hours ago)
10 request(s) in 24h for 5 sensitive path(s) that do not exist on this site (e.g. /.env, /.env.backup, /.env.development). Automated report from a passive sensor: https://digimasi.com/en/research/methodology/
Web App Attack
Bad Web Bot
🇺🇸
mnsf
2026-11-15 10:05:11
UTC ·
(7 hours ago)
Scanning/Probing (179)
Request Overload (318)
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-11-15 07:45:17
UTC ·
(10 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: k8s.astropot.website | Path: /.env | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Ap ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: k8s.astropot.website | Path: /.env | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇩🇪
big-cloud.nl
2026-11-15 02:36:52
UTC ·
(15 hours ago)
Try to access /.env
Web App Attack
🇱🇻
GooddayGroup
2026-11-15 00:42:52
UTC ·
(17 hours ago)
Automated probing for sensitive configuration files and environment leaks.
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-11-14 21:41:08
UTC ·
(20 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: backup.astropot.space | Path: /.env | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: backup.astropot.space | Path: /.env | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇧🇷
radardatelecom
2026-11-14 16:56:05
UTC ·
(1 day ago)
Blocked by Radar da Telecom firewall — abuseipdb
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-14 16:23:41
UTC ·
(1 day ago)
[ti-26al] Web exploit scanning: 6 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.67.156.156 - - [14/Nov/2026:17:23:21 +0100] "GET /.env.production HTTP/1.1" 404 7846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi ...
show more
[ti-26al] Web exploit scanning: 6 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.67.156.156 - - [14/Nov/2026:17:23:21 +0100] "GET /.env.production HTTP/1.1" 404 7846 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.67.156.156 - - [14/Nov/2026:17:23:21 +0100] "GET /.env.local HTTP/1.1" 404 7846 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"
34.67.156.156 - - [14/Nov/2026:17:23:21 +0100] "GET /.env.test HTTP/1.1" 404 7814 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"
34.67.156.156 - - [14/Nov/2026:17:23:21 +0100] "GET /.env.development HTTP/1.1" 404 7814 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Ver
...
show less
Bad Web Bot
Web App Attack
🇫🇮
000rosiu
2026-11-14 16:12:16
UTC ·
(1 day ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /.composer/auth.json | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15 • ...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action: BLOCK | Protocol: HTTP/1.1 (GET) | Endpoint: /.composer/auth.json | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15 • Generated by: github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇬🇧
consul.to
2026-11-14 15:57:07
UTC ·
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
ConsulHosting
2026-11-14 10:00:25
UTC ·
(1 day ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇳🇱
Savvii
2026-11-14 08:16:27
UTC ·
(1 day ago)
20 attempts against mh-misbehave-ban on ec102966
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-11-14 08:08:36
UTC ·
(1 day ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-14 07:42:18
UTC ·
(1 day ago)
[topuurbd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 34.67.156.156 - - \[14/Nov/2026:08:42:01 +0100\] "GET /.env_dev HTTP/1.1" 200 16037 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.3 ...
show more
[topuurbd] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 34.67.156.156 - - \[14/Nov/2026:08:42:01 +0100\] "GET /.env_dev HTTP/1.1" 200 16037 "-" "Mozilla/5.0 \(Windows NT 10.0\; Win64\; x64\) AppleWebKit/537.36 \(KHTML, like Gecko\) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
