Anonymous
2026-11-06 15:34:01
UTC ·
(44 minutes ago)
34.7.110.171 - - [06/Nov/2026:16:34:00 +0100] "GET /.env HTTP/1.1" 301 169 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
Web App Attack
🇵🇱
Budyn
2026-11-06 14:56:33
UTC ·
(1 hour ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: apm.sweetpuddingtrap.xyz | Path: /.bfrt-1793976981681494073-404 | User-Agent: Mozilla/5.0 (Wi ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: apm.sweetpuddingtrap.xyz | Path: /.bfrt-1793976981681494073-404 | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
Anonymous
2026-11-06 11:34:00
UTC ·
(4 hours ago)
Excessive crawling/scraping. Vulnerable file probing.
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-11-06 09:26:46
UTC ·
(6 hours ago)
423 requests with url.path *.git/*
239 requests with url.path *.hg/*
230 requests with url.path *.svn/*
227 requests with url.path *config.json
135 requests with url.path *.gitmodules
121 requests with url.path *.aws/*
106 requests with url.pa ...
show more
423 requests with url.path *.git/*
239 requests with url.path *.hg/*
230 requests with url.path *.svn/*
227 requests with url.path *config.json
135 requests with url.path *.gitmodules
121 requests with url.path *.aws/*
106 requests with url.path *credentials.json
show less
Brute-Force
Bad Web Bot
🇳🇱
ConsulHosting
2026-11-06 08:10:51
UTC ·
(8 hours ago)
Automatically blocked due to distributed attack
Hacking
🇺🇸
Nodez3r0
2026-11-06 06:18:47
UTC ·
(9 hours ago)
WOPR honeypot nedry.wopr.systems: 67 path_probe, 2 git_svn_probe, 1 admin_probe (e.g. /.git/objects/do/cument.addeventlistener('contextmenu',, /.git/refs/tags/v1.0.0, /.git/refs/tags/latest); first seen 2026-11-06T06:16:20Z, last seen 2026-11-06T06:1 ...
show more
WOPR honeypot nedry.wopr.systems: 67 path_probe, 2 git_svn_probe, 1 admin_probe (e.g. /.git/objects/do/cument.addeventlistener('contextmenu',, /.git/refs/tags/v1.0.0, /.git/refs/tags/latest); first seen 2026-11-06T06:16:20Z, last seen 2026-11-06T06:18:47Z
show less
Web App Attack
Hacking
🇺🇸
Nodez3r0
2026-11-06 06:16:17
UTC ·
(10 hours ago)
WOPR honeypot nedry.wopr.systems: 31 path_probe, 2 git_svn_probe, 1 admin_probe (e.g. /.git/refs/heads/main, /.git/HEAD, /repo/.git/HEAD); first seen 2026-11-06T06:15:55Z, last seen 2026-11-06T06:16:17Z
Web App Attack
Hacking
🇳🇱
Alt255
2026-11-06 05:56:06
UTC ·
(10 hours ago)
[cb-13al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.7.110.171 - - [06/Nov/2026:06:55:48 +0100] "GET /.git/HEAD HTTP/1.1" 404 244236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537 ...
show more
[cb-13al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 34.7.110.171 - - [06/Nov/2026:06:55:48 +0100] "GET /.git/HEAD HTTP/1.1" 404 244236 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-11-06 05:51:49
UTC ·
(10 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
EmilGH
2026-11-06 04:13:43
UTC ·
(12 hours ago)
34.7.110.171 - - [06/Nov/2026:04:13:36 +0000] "GET /.vite/manifest.json HTTP/1.1" 404 4465 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.7.110.171 - - [06/Nov/2026:04:13:36 +0 ...
show more
34.7.110.171 - - [06/Nov/2026:04:13:36 +0000] "GET /.vite/manifest.json HTTP/1.1" 404 4465 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.7.110.171 - - [06/Nov/2026:04:13:36 +0000] "GET /.git/HEAD HTTP/1.1" 403 4468 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.7.110.171 - - [06/Nov/2026:04:13:36 +0000] "GET /robots.txt HTTP/1.1" 404 4465 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.7.110.171 - - [06/Nov/2026:04:13:36 +0000] "GET /webpack.json HTTP/1.1" 404 4466 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.7.110.171 - - [06/Nov/2026:04:13:36 +0000] "GET /asset-manifest.json HTTP/1.1" 404 4466 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 04:08:42
UTC ·
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 34.7.110.171 (171.110.7.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 23:08:36.442477 2026] [security2:error] [pid 185269:tid 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 34.7.110.171 (171.110.7.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 23:08:36.442477 2026] [security2:error] [pid 185269:tid 185402] [client 34.7.110.171:59762] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kettleofgold.com"] [uri "/.env"] [unique_id "au1SxP7HkbuwAF2xbk4j8QAAARQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 02:23:42
UTC ·
(13 hours ago)
(mod_security) mod_security (id:949110) triggered by 34.7.110.171 (171.110.7.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 21:23:34.669390 2026] [security2:error] [pid 15520:tid 15 ...
show more
(mod_security) mod_security (id:949110) triggered by 34.7.110.171 (171.110.7.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 21:23:34.669390 2026] [security2:error] [pid 15520:tid 15520] [client 34.7.110.171:34150] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "danchujkoassoc.com"] [uri "/.git/HEAD"] [unique_id "au06Jvi1ZG_gdjWweXEsbwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-11-06 01:18:01
UTC ·
(15 hours ago)
block ruleset WAF detection and high score on abuseIPDB 149EB1B42C242111FADBBC2EF8F90219570691E1
Bad Web Bot
Anonymous
2026-11-06 01:13:09
UTC ·
(15 hours ago)
suspicious behavior
Blog Spam
Brute-Force
Web App Attack
🇺🇸
dot.mg
2026-11-06 01:13:01
UTC ·
(15 hours ago)
Bad behaviour
Web Spam