🇫🇷
dynamix
2026-11-13 21:18:15
UTC ·
(3 hours ago)
Multiple WAF Violations
Web App Attack
🇩🇪
updown.io
2026-11-13 20:25:25
UTC ·
(4 hours ago)
{"level":"info","ts":1794601525.6489127,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.232.192.195","remote_port":"35190","client_ip":"35.232.192.195","proto":"HTTP/1.1","method":"GET","host":"dev.www.sxooxwww.159. ...
show more
{"level":"info","ts":1794601525.6489127,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.232.192.195","remote_port":"35190","client_ip":"35.232.192.195","proto":"HTTP/1.1","method":"GET","host":"dev.www.sxooxwww.159.89.98.98.nip.io","uri":"/appsettings.json","headers":{"Accept":["*/*"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"]}},"bytes_read":0,"user_id":"","duration":0.000064894,"size":0,"status":308,"resp_headers":{"Server":["Caddy"],"Connection":["close"],"Location":["https://dev.www.sxooxwww.159.89.98.98.nip.io/appsettings.json"],"Content-Type":[]}}
{"level":"info","ts":1794601525.6492522,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.232.192.195","remote_port":"35184","client_ip":"35.232.192.195","proto":"HTTP/1.1","method":"GET","host":"dev.www.sxooxwww.159.89.98.98.nip.io","uri":"/appsettings.Production.json","headers":{"User-Agent":["Mozilla/5.0 (Macintos
...
show less
DDoS Attack
Web App Attack
🇫🇷
Stara
2026-11-13 19:55:35
UTC ·
(5 hours ago)
Automated block - Joomla/WordPress/OpenCart vulnerability scanner exploitation detected (Mala Kineskinja)
Hacking
Brute-Force
Web App Attack
🇳🇱
Site.eu
2026-11-13 19:23:28
UTC ·
(5 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇫🇷
Stara
2026-11-13 18:59:54
UTC ·
(6 hours ago)
Massive 403 errors - scanning for .env, configuration files, or directory traversal
Brute-Force
Hacking
Web App Attack
🇵🇱
Budyn
2026-11-13 17:28:50
UTC ·
(7 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: test.goblinpot.tech | Path: /.env.old | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: test.goblinpot.tech | Path: /.env.old | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇩🇪
Dominik Lysiak
2026-11-13 16:57:16
UTC ·
(8 hours ago)
35.232.192.195 - - [13/Nov/2026:17:57:15 +0100] "GET /.env.local HTTP/1.1" 401 172 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"
35.232.192.195 - - [13/Nov/2026:17:57:15 +0100] "GET /.env.old HTTP/1.1" 401 172 "-" "Mozi ...
show more
35.232.192.195 - - [13/Nov/2026:17:57:15 +0100] "GET /.env.local HTTP/1.1" 401 172 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"
35.232.192.195 - - [13/Nov/2026:17:57:15 +0100] "GET /.env.old HTTP/1.1" 401 172 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"
35.232.192.195 - - [13/Nov/2026:17:57:15 +0100] "GET /wp-config.php.bak HTTP/1.1" 401 172 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"
...
show less
Web App Attack
🇸🇪
vaia.cloud
2026-11-13 16:50:01
UTC ·
(8 hours ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-11-13 14:18:31
UTC ·
(10 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: test.goblinpot.space | Path: /.env | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_ ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: test.goblinpot.space | Path: /.env | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
2026-11-13 14:07:08
UTC ·
(10 hours ago)
rule caddy-scan, 3 hits from 2026-11-13T14:07:08Z to 2026-11-13T14:07:08Z
Web App Attack
🇨🇦
CentiDevOps
2026-11-13 13:18:35
UTC ·
(11 hours ago)
Web app scan: 32 requests in 10 min across 2 domains (301/404). Paths: /.env, /fr/.env, /.env.local (+6 more). Sample: 2026-11-13T13:18:35Z "GET /.env" 301
Hacking
Web App Attack
🇸🇪
vaia.cloud
2026-11-13 11:35:01
UTC ·
(13 hours ago)
crowdsecurity/http-sensitive-files
Brute-Force
Web App Attack
🇩🇪
sebham03
2026-11-13 08:00:14
UTC ·
(17 hours ago)
Automated sensitive-file/web application probing observed from 2026-11-13T06:55:14+00:00 to 2026-11-13T08:00:14+00:00 UTC.
Web App Attack
🇩🇪
paissangroup
2026-11-13 06:58:11
UTC ·
(18 hours ago)
Multiple WAF Violations
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 06:39:44
UTC ·
(18 hours ago)
(mod_security) mod_security (id:210730) triggered by 35.232.192.195 (195.192.232.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 01:39:38.698955 2026] [security2:error] [pid 18574:ti ...
show more
(mod_security) mod_security (id:210730) triggered by 35.232.192.195 (195.192.232.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 01:39:38.698955 2026] [security2:error] [pid 18574:tid 18574] [client 35.232.192.195:51008] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||test.larryyang.net|F|2"] [data ".env.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "test.larryyang.net"] [uri "/.env.backup"] [unique_id "avawqsZPwsTk7OepCMy78gAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
