2026-11-06 09:26:00
UTC ·
(16 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 35.201.243.148 (TW/Taiwan/148.243.201.35.bc.googleusercontent.com)
SQL Injection
2026-11-06 09:09:34
UTC ·
(17 hours ago)
IP matched detection query more than 2 hosts and only bad rq long ban.
Brute-Force
Web App Attack
Hacking
🇵🇱
Budyn
2026-11-06 08:52:36
UTC ·
(17 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: budyn.ovh | Path: / | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.3 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: budyn.ovh | Path: / | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇺🇸
Mundo Bueno
2026-11-06 08:45:59
UTC ·
(17 hours ago)
[ISILIA Protection v2.3] Tentative d'accès: /.aws/credentials%3f.txt [RATE LIMITED - 1800s quarantine] | Pays: TW | UA: Mozilla/5.0 (compatible; Kimi-SearchBot/1.0; +https://kimi.ai/)
Hacking
Web App Attack
🇳🇱
middelkoopcc
2026-11-06 08:26:38
UTC ·
(17 hours ago)
2026-11-06 09:24:11 GET /wp-config.php~ [301] && 2026-11-06 09:24:11 GET /wp-config.php.swp [301] && 2026-11-06 09:24:11 GET /storage/.env [301] && 154 more within 20 minutes
Web App Attack
🇺🇸
jormaster3k
2026-11-06 08:25:55
UTC ·
(17 hours ago)
Attack against Apache (too many 404s)
Web App Attack
🇩🇪
rh24
2026-11-06 08:16:26
UTC ·
(17 hours ago)
(mod_security) mod_security triggered on hostname [redacted] 35.201.243.148 (TW/Taiwan/148.243.201.35.bc.googleusercontent.com): (CF_ENABLE)
SQL Injection
🇺🇸
LotPhantom
2026-11-06 07:09:24
UTC ·
(19 hours ago)
2026-11-06T07:09:23.472925+00:00 bridginggaps kernel: [UFW BLOCK] IN=eth0 OUT= MAC=2e:bc:64:1d:2c:e1:fe:00:00:00:01:01:08:00 SRC=35.201.243.148 DST=157.230.217.55 LEN=60 TOS=0x00 PREC=0x60 TTL=57 ID=51184 DF PROTO=TCP SPT=37168 DPT=8080 WINDOW=65320 ...
show more
2026-11-06T07:09:23.472925+00:00 bridginggaps kernel: [UFW BLOCK] IN=eth0 OUT= MAC=2e:bc:64:1d:2c:e1:fe:00:00:00:01:01:08:00 SRC=35.201.243.148 DST=157.230.217.55 LEN=60 TOS=0x00 PREC=0x60 TTL=57 ID=51184 DF PROTO=TCP SPT=37168 DPT=8080 WINDOW=65320 RES=0x00 SYN URGP=0
2026-11-06T07:09:23.473104+00:00 bridginggaps kernel: [UFW BLOCK] IN=eth0 OUT= MAC=2e:bc:64:1d:2c:e1:fe:00:00:00:01:01:08:00 SRC=35.201.243.148 DST=157.230.217.55 LEN=60 TOS=0x00 PREC=0x60 TTL=57 ID=36870 DF PROTO=TCP SPT=36534 DPT=8443 WINDOW=65320 RES=0x00 SYN URGP=0
...
show less
Port Scan
Hacking
🇺🇸
grassyloki
2026-11-06 07:09:00
UTC ·
(19 hours ago)
Web scanner sent requests matching the Next.js middleware authorization-bypass exploit signature against a public web service, then continued probing after being cut off.
Target: HTTP 80, GET / with Next.js middleware bypass headers (CVE-2025-29927 s ...
show more
Web scanner sent requests matching the Next.js middleware authorization-bypass exploit signature against a public web service, then continued probing after being cut off.
Target: HTTP 80, GET / with Next.js middleware bypass headers (CVE-2025-29927 signature); also probed 8080
Seen: 2026-11-06 02:09-04:32 EST
- 04:31:04 EST IDS signature ET WEB_SERVER Next.js Middleware Authorization Bypass (CVE-2025-29927) fired on TCP 35.201.243.148:60834 to public port 80
- 04:31:03 EST GET / HTTP/1.1 with a desktop Edge user-agent to the public web service was answered 444 (connection closed without response)
- 04:31:04-04:32:22 EST eight subsequent TCP packets from the same source port were blocked at the edge
- 02:09:11 EST the same source probed port 8080 and was blocked
show less
Web App Attack
Port Scan
🇦🇹
Pingger Shikkoken
2026-11-06 07:08:16
UTC ·
(19 hours ago)
2026-11-06T07:08:16+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=35.201.243.148 DST=10.1.1.11 LEN=60 TOS=0x00 PREC=0x60 TTL=54 ID=48967 DF PROTO=TCP SPT=39884 DPT=8443 ...
show more
2026-11-06T07:08:16+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=35.201.243.148 DST=10.1.1.11 LEN=60 TOS=0x00 PREC=0x60 TTL=54 ID=48967 DF PROTO=TCP SPT=39884 DPT=8443 WINDOW=65320 RES=0x00 SYN URGP=0 2026-11-06T07:08:16+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=35.201.243.148 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x60 TTL=55 ID=36065 DF PROTO=TCP SPT=43002 DPT=80 WINDOW=65320 RES=0x00 SYN URGP=0 2026-11-06T07:08:16+00:00 iskariot kernel: AbuseIPDB-Blacklist-Dropped: IN=ens3 OUT=ServerBridge MAC=b6:ab:74:e6:2e:14:2c:dd:e9:13:03:d9:08:00 SRC=35.201.243.148 DST=10.1.1.2 LEN=60 TOS=0x00 PREC=0x60 TTL=54 ID=6376 DF PROTO=TCP SPT=57304 DPT=443 WINDOW=65320 RES=0x00 SYN URGP=0 ...
show less
Hacking
Bad Web Bot
Port Scan
🇪🇸
el-brujo
2026-11-06 03:58:43
UTC ·
(22 hours ago)
Cloudflare WAF: Request Path: /.env.ses Request Query: Host: wiki.elhacker.net userAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/a ...
show more
Cloudflare WAF: Request Path: /.env.ses Request Query: Host: wiki.elhacker.net userAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Safari/605.1.15 (Applebot/0.1; +http://www.apple.com/go/applebot) Action: block Source: firewallCustom ASN Description: Google LLC Country: TW Method: GET Timestamp: 2026-11-06T03:58:43Z ruleId: 6b2d48d0415e4adb9f099d85f54d1de6.
show less
Hacking
SQL Injection
Web App Attack
🇧🇪
cmbplf
2026-11-06 03:10:58
UTC ·
(23 hours ago)
6.888 requests from abuseipdb.com blacklisted IP (1w6d23h)
Brute-Force
Bad Web Bot
🇩🇪
ger-stg-sifi1
2026-11-06 03:08:40
UTC ·
(23 hours ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack
2026-11-06 02:10:35
UTC ·
(1 day ago)
(mod_security) mod_security triggered on hostname [redacted] 35.201.243.148 (TW/Taiwan/148.243.201.35.bc.googleusercontent.com)
SQL Injection
🇫🇷
mail.avx.gr
2026-11-06 01:52:02
UTC ·
(1 day ago)
plesk-rapid-ban env-second-probe host=mail.tropic.gr
Hacking
