🇵🇱
Budyn
2026-10-26 13:49:52
(14 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: cdn.budyn.wtf | URI: / | UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36 EdgA/152.0.0.0 | BODY: [Empty / GET Request] | HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"35.234.108.97","Cdn-Loop":"cloudflare; loops=1","Sec-Ch-Ua-Mobile":"?1","X-Middleware-Subrequest":"src\/middleware:nowaf:src\/middleware:src\/middleware:src\/middle
show less
Hacking
Web App Attack
2026-10-26 12:19:53
(15 hours ago)
[Mon Oct 26 13:19:47.667981 2026] [authz_core:error] [pid 823249] [client 35.234.108.97:37776] AH016 ...
show more
[Mon Oct 26 13:19:47.667981 2026] [authz_core:error] [pid 823249] [client 35.234.108.97:37776] AH01630: client denied by server configuration: /var/www/html/portfolio/public/
[Mon Oct 26 13:19:48.521013 2026] [authz_core:error] [pid 823249] [client 35.234.108.97:37776] AH01630: client denied by server configuration: /var/www/html/portfolio/public/robots.txt
[Mon Oct 26 13:19:49.613566 2026] [authz_core:error] [pid 823249] [client 35.234.108.97:37776] AH01630: client denied by server configuration: /var/www/html/portfolio/public/sitemap.xml
[Mon Oct 26 13:19:52.045038 2026] [authz_core:error] [pid 823249] [client 35.234.108.97:37776] AH01630: client denied by server configuration: /var/www/html/portfolio/public/sitemap_index.xml
[Mon Oct 26 13:19:52.198257 2026] [authz_core:error] [pid 823249] [client 35.234.108.97:37776] AH01630: client denied by server configuration: /var/www/html/portfolio/public/users
...
show less
Web App Attack
🇺🇸
zcampbell
2026-10-26 12:13:50
(15 hours ago)
Web vulnerability scanning: probing for exposed sensitive files (service-account). Detected and bloc ...
show more
Web vulnerability scanning: probing for exposed sensitive files (service-account). Detected and blocked automatically.
show less
Web App Attack
Bad Web Bot
🇵🇱
Budyn
2026-10-26 11:44:05
(16 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: por.budyn.wtf | URI: /.env.supabase | UA: Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler) | BODY: [Empty / GET Request] | HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"35.234.108.97","Cdn-Loop":"cloudflare; loops=1","X-Middleware-Subrequest":"src\/middleware:nowaf:src\/middleware:src\/middleware:src\/middleware:src\/middleware:middl
show less
Bad Web Bot
Web App Attack
🇩🇪
dpsbs
2026-10-26 11:20:10
(16 hours ago)
multiple ips intrustions detected
Hacking
2026-10-26 11:19:41
(16 hours ago)
35.234.108.97 - - [26/Oct/2026:11:19:40 +0000] "GET /.env.supabase HTTP/1.1" 404 6872 "-" "Mozilla/5 ...
show more
35.234.108.97 - - [26/Oct/2026:11:19:40 +0000] "GET /.env.supabase HTTP/1.1" 404 6872 "-" "Mozilla/5.0 (compatible; ChatGLM-Spider/1.0; +https://zhipuai.cn/)"
...
show less
Brute-Force
Web App Attack
🇩🇪
Blexyel
2026-10-26 11:19:04
(16 hours ago)
35.234.108.97 - - [26/Oct/2026:12:19:03 +0100] "GET /.git/config HTTP/1.1" 200 265 "-" "Mozilla/5.0 ...
show more
35.234.108.97 - - [26/Oct/2026:12:19:03 +0100] "GET /.git/config HTTP/1.1" 200 265 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)" "pingusmc.org"
...
show less
Brute-Force
Web App Attack
🇸🇪
vaia.cloud
2026-10-26 11:00:03
(17 hours ago)
crowdsecurity/http-admin-interface-probing
Brute-Force
Web App Attack
🇳🇱
Savvii
2026-10-26 10:52:44
(17 hours ago)
20 attempts against mh-misbehave-ban on orcus
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
sweplox.se
2026-10-26 10:51:58
(17 hours ago)
Ip 35.234.108.97 performed 'crowdsecurity/appsec-vpatch' (2 events over 2.70988752s) at 2026-10-26 1 ...
show more
Ip 35.234.108.97 performed 'crowdsecurity/appsec-vpatch' (2 events over 2.70988752s) at 2026-10-26 10:51:57.220232129 +0000 UTC
show less
Hacking
🇩🇪
updown.io
2026-10-26 10:09:02
(17 hours ago)
{"level":"info","ts":1793009340.7482731,"logger":"http.log.access.log1","msg":"handled request","req ...
show more
{"level":"info","ts":1793009340.7482731,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.234.108.97","remote_port":"47942","client_ip":"35.234.108.97","proto":"HTTP/2.0","method":"GET","host":"status.stellar.study","uri":"/.env?.svg?.wasm?init","headers":{"User-Agent":["Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-AdsBot/1.0; +https://openai.com/adsbot"],"Accept":["*/*"],"X-Middleware-Subrequest":["src/middleware:nowaf:src/middleware:src/middleware:src/middleware:src/middleware:middleware:middleware:nowaf:middleware:middleware:middleware:pages/_middleware"],"Accept-Encoding":["gzip"],"X-Nextjs-Data":["1"]},"tls":{"resumed":false,"version":772,"cipher_suite":4865,"proto":"h2","server_name":"status.stellar.study","ech":false}},"bytes_read":0,"user_id":"","duration":0.000148283,"size":0,"status":429,"resp_headers":{"Server":["Caddy"],"Alt-Svc":["h3=\":443\"; ma=2592000"],"Retry-After":["1"]}}
{"level":"info","ts":1793009340.754699,"
...
show less
DDoS Attack
Web App Attack
🇬🇧
consul.to
2026-10-26 09:58:53
(18 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇳🇱
Site.eu
2026-10-26 09:49:09
(18 hours ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
2026-10-26 08:52:51
(19 hours ago)
35.234.108.97 - - [26/Oct/2026:10:52:49 +0200] "GET / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Linux; And ...
show more
35.234.108.97 - - [26/Oct/2026:10:52:49 +0200] "GET / HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.234.108.97 - - [26/Oct/2026:10:52:49 +0200] "GET /sitemap.xml HTTP/1.1" 403 124 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
35.234.108.97 - - [26/Oct/2026:10:52:49 +0200] "GET /sitemap_index.xml HTTP/1.1" 403 124 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
35.234.108.97 - - [26/Oct/2026:10:52:49 +0200] "GET /dashboard/settings HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.234.108.97 - - [26/Oct/2026:10:52:50 +0200] "GET /signin HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Mobile Safari/537.36"
35.234.108.97 - - [26/Oct/2026:10:52:50 +0200] "GET /admin HTTP/1.1" 403 183 "-" "Mozilla/5.
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 05:29:57
(22 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.234.108.97 (97.108.234.35.bc.googleuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 35.234.108.97 (97.108.234.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 01:29:52.979444 2026] [security2:error] [pid 29971:tid 29971] [client 35.234.108.97:42720] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.firewoodart.com"] [uri "/.env.production.local"] [unique_id "at7lUFgZ7JM2tXFjoFE8xAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack