🇵🇱
Budyn
2026-11-06 19:40:06
UTC ·
(1 week ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: auth.budyn.ovh | Path: /dist/.vite/manifest.json | User-Agent: Mozilla/5.0 (Windows NT 10.0; ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: auth.budyn.ovh | Path: /dist/.vite/manifest.json | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇫🇮
as211431.net
2026-11-06 16:45:00
UTC ·
(1 week ago)
Triggered Cloudflare WAF (firewallManaged) from TW.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /wp-config.php.swp
UA: Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)
This report was generated by:
https://github.co ...
show more
Triggered Cloudflare WAF (firewallManaged) from TW.
Action taken: BLOCK
Protocol: HTTP/2 (GET method)
Endpoint: /wp-config.php.swp
UA: Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇵🇱
Budyn
2026-11-06 16:23:10
UTC ·
(1 week ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: shop.budyn.ovh | Path: /dist/.vite/manifest.json | User-Agent: Mozilla/5.0 (Windows NT 10.0; ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: shop.budyn.ovh | Path: /dist/.vite/manifest.json | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
2026-11-06 15:39:09
UTC ·
(1 week ago)
IP matched detection query Detection of too many failed responses.
Brute-Force
Bad Web Bot
Hacking
🇬🇧
NotCool
2026-11-06 14:25:00
UTC ·
(1 week ago)
[7200] (DOTENVPROBE,CRAWLDELAY) Login failure/trigger from 35.189.173.178 (TW/Taiwan/178.173.189.35.bc.googleusercontent.com): 50 in the last 3600 secs
Brute-Force
🇺🇸
TPI-Abuse
2026-11-06 13:17:46
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 35.189.173.178 (178.173.189.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 08:17:39.697278 2026] [security2:error] [pid 17657:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 35.189.173.178 (178.173.189.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 08:17:39.697278 2026] [security2:error] [pid 17657:tid 17657] [client 35.189.173.178:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whm.nyemdr.org"] [uri "/apps/admin/.env"] [unique_id "au3Tc5EqDDeSlk60hW07nQAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
kie
2026-11-06 13:05:52
UTC ·
(1 week ago)
06-11-2026:13:05:24UTC [Nginx Web Server] Suspicious web request: path:/.env path:/wp-config path:/.git path:/.env,/.git path:/.aws/ (167 request(s)).
Bad Web Bot
Web App Attack
🇦🇺
obiahmar
2026-11-06 12:55:24
UTC ·
(1 week ago)
This IP was detected triggering crowdsecurity/http-probing
Web App Attack
Hacking
🇳🇱
Savvii
2026-11-06 10:59:22
UTC ·
(1 week ago)
20 attempts against mh-misbehave-ban on redirect
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-06 10:29:20
UTC ·
(1 week ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: git.budyn.ovh | Path: /dashboard%2F.env | User-Agent: Mozilla/5.0 (compatible; Hunyuan/1.0; + ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: git.budyn.ovh | Path: /dashboard%2F.env | User-Agent: Mozilla/5.0 (compatible; Hunyuan/1.0; +https://hunyuan.tencent.com/) | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇹🇷
pashait
2026-11-06 10:08:00
UTC ·
(1 week ago)
Auto-blocked by Seczar SecureOps — IPS Web Attack Signature (2 events in 5min) at 2026-11-06 10:08
Web App Attack
Bad Web Bot
🇩🇪
FeG Deutschland
2026-11-06 10:07:50
UTC ·
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇩🇰
HostingGroup
2026-11-06 09:31:54
UTC ·
(1 week ago)
Automated malicious activity (Honeypot Trap) detected and blocked at the CDN edge by NordicCDN Shield. Offenses: 14. First blocked: 2026-11-06.
Bad Web Bot
Web App Attack
🇬🇧
Steve
2026-11-06 08:58:35
UTC ·
(1 week ago)
Abuse of XMLRPC
Brute-Force
Web App Attack
🇩🇪
updown.io
2026-11-06 08:41:22
UTC ·
(1 week ago)
{"level":"info","ts":1793954480.6200771,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"35.189.173.178","remote_port":"58852","client_ip":"35.189.173.178","proto":"HTTP/2.0","method":"GET","host":"nyqy.status.updown.io ...
show more
{"level":"info","ts":1793954480.6200771,"logger":"http.log.access.log0","msg":"handled request","request":{"remote_ip":"35.189.173.178","remote_port":"58852","client_ip":"35.189.173.178","proto":"HTTP/2.0","method":"GET","host":"nyqy.status.updown.io","uri":"/laravel../.env","headers":{"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"X-Real-Ip":["192.168.134.183"],"True-Client-Ip":["192.168.134.183"],"X-Originating-Ip":["192.168.134.183"],"X-Proxyuser-Ip":["192.168.134.183"],"User-Agent":["Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)"],"X-Custom-Ip-Authorization":["192.168.134.183"],"X-Nextjs-Data":["1"],"Forwarded":["for=192.168.134.183"],"Accept-Encoding":["gzip"],"Accept":["*/*"],"Cookie":["REDACTED"],"X-Remote-Ip":["192.168.134.183"],"X-Forwarded-For":["192.168.134.183"],"X-Client-Ip":["192.168.134.183"],"X-Remote-Addr":["192.
...
show less
DDoS Attack
Web App Attack
