🇷🇴
clauss
2026-11-09 04:18:54
UTC ·
(1 day ago)
34.88.181.12 - - [09/Nov/2026:06:18:53 +0200] "GET /static/config.json HTTP/2.0" 404 201 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.88.181.12 - - [09/Nov/2026:06:18:54 +020 ...
show more
34.88.181.12 - - [09/Nov/2026:06:18:53 +0200] "GET /static/config.json HTTP/2.0" 404 201 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.88.181.12 - - [09/Nov/2026:06:18:54 +0200] "GET /public/config.json HTTP/2.0" 404 201 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇩🇪
ger-stg-sifi1
2026-11-09 04:04:17
UTC ·
(1 day ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
🇵🇱
Budyn
2026-11-09 02:39:57
UTC ·
(1 day ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: gitlab.budyn.top | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) A ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: gitlab.budyn.top | Path: /.git/HEAD | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
2026-11-08 22:40:25
UTC ·
(2 days ago)
Probing for exposed secret / credential files
Hacking
Web App Attack
2026-11-08 21:59:02
UTC ·
(2 days ago)
34.88.181.12 - - [08/Nov/2026:21:59:01 +0000] "GET /webpack.json HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.88.181.12 - - [08/Nov/2026:21:59:01 +0000] "GE ...
show more
34.88.181.12 - - [08/Nov/2026:21:59:01 +0000] "GET /webpack.json HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.88.181.12 - - [08/Nov/2026:21:59:01 +0000] "GET /gtm.js HTTP/1.1" 404 564 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇲🇾
Rizzy
2026-11-08 21:53:58
UTC ·
(2 days ago)
Multiple WAF Violations
Brute-Force
Web App Attack
2026-11-08 18:37:11
UTC ·
(2 days ago)
IP matched detection query Detection of too many failed responses.
Brute-Force
Bad Web Bot
Hacking
🇺🇸
TPI-Abuse
2026-11-08 17:23:09
UTC ·
(2 days ago)
(mod_security) mod_security (id:248270) triggered by 34.88.181.12 (12.181.88.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 12:23:03.309785 2026] [security2:error] [pid 10560:tid 10 ...
show more
(mod_security) mod_security (id:248270) triggered by 34.88.181.12 (12.181.88.34.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 12:23:03.309785 2026] [security2:error] [pid 10560:tid 10560] [client 34.88.181.12:5068] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\$\\\\{jndi:(ldaps?|rmi|dns|iiop|nis|nds|corba|\\\\$\\\\{(?:lower|upper)):" at REQUEST_HEADERS:Referer. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "7626"] [id "248270"] [rev "1"] [msg "COMODO WAF: Remote code execution in Apache log4j||toepfer.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "toepfer.org"] [uri "/"] [unique_id "avCv93yPoU1oMsvu-9xBCAAAADg"], referer: ${jndi:ldap://127.0.0.1/bifrost-probe}
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-11-08 16:48:02
UTC ·
(2 days ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇨🇭
TheCoon
2026-11-08 15:41:26
UTC ·
(2 days ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇺🇸
IndigoRidge
2026-11-08 15:24:48
UTC ·
(2 days ago)
34.88.181.12 - - [08/Nov/2026:10:24:46 -0500] "GET /.git/HEAD HTTP/1.1" 404 6537 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.88.181.12 - - [08/Nov/2026:10:24:47 -0500] "POST ...
show more
34.88.181.12 - - [08/Nov/2026:10:24:46 -0500] "GET /.git/HEAD HTTP/1.1" 404 6537 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.88.181.12 - - [08/Nov/2026:10:24:47 -0500] "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1" 404 6537 "-" "Mozilla/5.0 (compatible; scanner/1.0)"
34.88.181.12 - - [08/Nov/2026:10:24:48 -0500] "POST /vendor/phpunit/phpunit/Util/PHP/eval-stdin.php HTTP/1.1" 404 6537 "-" "Mozilla/5.0 (compatible; scanner/1.0)"
34.88.181.12 - - [08/Nov/2026:10:24:48 -0500] "GET /.hg/requires HTTP/1.1" 404 6537 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
34.88.181.12 - - [08/Nov/2026:10:24:48 -0500] "GET /.svn/entries HTTP/1.1" 404 6537 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇫🇷
dynamix
2026-11-08 11:34:05
UTC ·
(2 days ago)
Multiple WAF Violations
Web App Attack
🇬🇧
consul.to
2026-11-08 11:16:55
UTC ·
(2 days ago)
Web attack/malicious scanning detected
Web App Attack
🇮🇹
VHosting
2026-11-08 10:50:05
UTC ·
(2 days ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇩🇪
LRob
2026-11-08 10:34:28
UTC ·
(2 days ago)
Secret file probe | method: GET | path: /.git/HEAD | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36
Hacking
Web App Attack
