🇩🇪
hotzmatic
2026-10-26 10:29:19
(1 hour ago)
None (366 events observed on private honeypot sensor)
Hacking
🇩🇪
updown.io
2026-10-26 10:00:08
(2 hours ago)
{"level":"info","ts":1793008805.6689885,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1793008805.6689885,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.231.91.162","remote_port":"37680","client_ip":"35.231.91.162","proto":"HTTP/2.0","method":"GET","host":"status.equinox.lightquark.network","uri":"/manifest.json","headers":{"Accept":["text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8"],"Sec-Ch-Ua-Mobile":["?0"],"Priority":["u=0, i"],"Accept-Encoding":["gzip, deflate, br, zstd"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"],"Sec-Fetch-Dest":["document"],"X-Nextjs-Data":["1"],"Sec-Fetch-Site":["none"],"Sec-Ch-Ua":["\"Chromium\";v=\"152\", \"Not?A_Brand\";v=\"24\", \"Brave\";v=\"152\""],"Sec-Ch-Ua-Platform":["\"Win
...
show less
DDoS Attack
Web App Attack
🇳🇱
Mangelot Hosting
2026-10-26 09:26:18
(2 hours ago)
(modsec_attack) srv103 ModSecurity attack 35.231.91.162 (US/United States/162.91.231.35.bc.googleuse ...
show more
(modsec_attack) srv103 ModSecurity attack 35.231.91.162 (US/United States/162.91.231.35.bc.googleusercontent.com): 3 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
2026-10-26 09:13:52
(3 hours ago)
Multiple web server 400 error codes from same source ip
Web App Attack
🇳🇱
Alt255
2026-10-26 09:13:19
(3 hours ago)
[cb-09al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apac ...
show more
[cb-09al] Excessive 404 errors (web scanning): 25 suspicious requests detected by fail2ban jail apache-404. Example: 35.231.91.162 - - [26/Oct/2026:10:13:07 +0100] "GET /members HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
35.231.91.162 - - [26/Oct/2026:10:13:07 +0100] "GET /manage HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
35.231.91.162 - - [26/Oct/2026:10:13:07 +0100] "GET /playground HTTP/2.0" 404 1855 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36"
35.231.91.162 - - [26/Oct/2026:10:13:07 +0100] "GET /integrations HTTP/2.0" 404 1855
...
show less
Bad Web Bot
Web App Attack
🇫🇮
KTSTechnology
2026-10-26 09:06:55
(3 hours ago)
Web vulnerability scanning detected by our ISP firewall
Web App Attack
🇬🇧
consul.to
2026-10-26 09:04:18
(3 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
Matthew Ping
2026-10-26 01:45:01
(10 hours ago)
Excessive connections (DDoS/flood) blocked by CSF CT_LIMIT on wp3.
DDoS Attack
Brute-Force
🇺🇸
TPI-Abuse
2026-10-25 23:58:32
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.231.91.162 (162.91.231.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.231.91.162 (162.91.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 19:58:27.350185 2026] [security2:error] [pid 8168:tid 8168] [client 35.231.91.162:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.bbproductionsonline.com"] [uri "/build/.env"] [unique_id "at6Xo-kNLr6ArRnmGUK1kQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
VHosting
2026-10-25 20:35:05
(15 hours ago)
Detected WordPress attack from different servers
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 19:15:53
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.231.91.162 (162.91.231.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.231.91.162 (162.91.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 15:15:46.985168 2026] [security2:error] [pid 12073:tid 12096] [client 35.231.91.162:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.billgiegold.com"] [uri "/.env.old"] [unique_id "at5VYkS05B-sTKR6vwFkNQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 18:34:18
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.231.91.162 (162.91.231.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.231.91.162 (162.91.231.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 14:34:14.850644 2026] [security2:error] [pid 29995:tid 29995] [client 35.231.91.162:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.backlogica.com"] [uri "/@fs/app/.env.local"] [unique_id "at5LpjnRr8x5Col6msEgnQAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇿🇦
conure.sh
2026-10-25 17:01:17
(19 hours ago)
csagent: score 16.6: spoofed crawler UA x1, secrets grab x1; 2 domain(s) in 1m11s
Web App Attack
🇩🇪
schuh
2026-10-24 06:17:09
(2 days ago)
24-10-2026:06:16:39UTC [Caddy] Suspicious web request: uri:/appearance/../../.env,/static//.env,/fil ...
show more
24-10-2026:06:16:39UTC [Caddy] Suspicious web request: uri:/appearance/../../.env,/static//.env,/files../.env,/build../.env,/media../.env (185 requests) tcp:443
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-24 03:59:55
(2 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: panel.budyn.wtf | URI: /.aws/credentials | UA: Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot | BODY: [Empty / GET Request] | HEADERS: {"Cookie":"XSRF-TOKEN=eyJpdiI6IjdaN0dQdGsvQVdnQ20zSzJaeGpKa3c9PSIsInZhbHVlIjoieVNSdzNkekJ2azVQUElNOHUrUmlPb3JtVFprWkVBRThIdXplajVyMFBQMndHb2NHMi9wTE9Mei91VHh3V1NMVGNRUTVQYStFOHQxSmkzQVYvUjNGcGlzVnBXRWtOSENTRWFsU002ckxiVW9CVnJGZk5EZXQ5cFBsYXB2dGxFOHAiLCJtYWMiOiJkM2FjNWM4N2U3NTI2N2QzOWE4MDY2N2QyOTE1N
show less
Bad Web Bot
Web App Attack
