🇳🇱
homeshowdomain.nl
2026-11-14 22:59:09
UTC ·
(7 minutes ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-11-13.
Web App Attack
SSH
Hacking
🇵🇱
Budyn
2026-11-14 16:29:06
UTC ·
(6 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: dev.budyn.xyz | Path: /docker-compose.yml | User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:13 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: dev.budyn.xyz | Path: /docker-compose.yml | User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇳🇱
ConsulHosting
2026-11-14 09:31:55
UTC ·
(13 hours ago)
Excessive failed CAPTCHA attempts (CAPTCHA DoS)
Web App Attack
🇵🇱
Budyn
2026-11-14 08:50:42
UTC ·
(14 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: docker.astropot.site | Path: /.env | User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Ge ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: docker.astropot.site | Path: /.env | User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 07:52:32
UTC ·
(15 hours ago)
(mod_security) mod_security (id:210492) triggered by 35.255.147.209 (209.147.255.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 02:52:25.536690 2026] [security2:error] [pid 10993:ti ...
show more
(mod_security) mod_security (id:210492) triggered by 35.255.147.209 (209.147.255.35.bc.googleusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 02:52:25.536690 2026] [security2:error] [pid 10993:tid 10993] [client 35.255.147.209:37940] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eileensharaga.com"] [uri "/web.config"] [unique_id "avgTOfmjTZbMl2p8042_vQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-11-14 06:51:13
UTC ·
(16 hours ago)
[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.255.147.209 - - [14/Nov/2026:07:51:10 +0100] "GET /.env.backup HTTP/1.1" 301 6301 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWeb ...
show more
[mx01aln] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.255.147.209 - - [14/Nov/2026:07:51:10 +0100] "GET /.env.backup HTTP/1.1" 301 6301 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15"
...
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-11-14 04:52:08
UTC ·
(18 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: dev.astropot.space | Path: /config.json | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x6 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: dev.astropot.space | Path: /config.json | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
2026-11-14 01:04:40
UTC ·
(22 hours ago)
(mod_security) mod_security triggered on hostname [redacted])
SQL Injection
🇫🇷
dynamix
2026-11-13 18:24:54
UTC ·
(1 day ago)
Automated web vulnerability and path enumeration scan with excessive 404 requests
Bad Web Bot
Web App Attack
🇳🇱
Site.eu
2026-11-13 16:34:23
UTC ·
(1 day ago)
Scanning for secret files (.env, .git, credentials, config backups)
Bad Web Bot
Web App Attack
🇩🇪
updown.io
2026-11-13 12:21:53
UTC ·
(1 day ago)
{"level":"info","ts":1794572513.199028,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.255.147.209","remote_port":"58552","client_ip":"35.255.147.209","proto":"HTTP/1.1","method":"GET","host":"dev.www.ww.www.159.89. ...
show more
{"level":"info","ts":1794572513.199028,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.255.147.209","remote_port":"58552","client_ip":"35.255.147.209","proto":"HTTP/1.1","method":"GET","host":"dev.www.ww.www.159.89.98.98.nip.io","uri":"/.env.template","headers":{"Accept":["*/*"],"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0"]}},"bytes_read":0,"user_id":"","duration":0.00003139,"size":0,"status":308,"resp_headers":{"Content-Type":[],"Server":["Caddy"],"Connection":["close"],"Location":["https://dev.www.ww.www.159.89.98.98.nip.io/.env.template"]}}
{"level":"info","ts":1794572513.199185,"logger":"http.log.access.log1","msg":"handled request","request":{"remote_ip":"35.255.147.209","remote_port":"58336","client_ip":"35.255.147.209","proto":"HTTP/1.1","method":"GET","host":"dev.www.ww.www.159.89.98.98.nip.io","uri":"/.continue/config.json","headers":{"User-Agent":["Mozilla/5.0 (Windows NT 10.0; Win64; x64)
...
show less
DDoS Attack
Web App Attack
🇳🇱
Alt255
2026-11-13 05:13:17
UTC ·
(1 day ago)
[ti-22al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.255.147.209 - - [13/Nov/2026:06:13:05 +0100] "GET /.env.save HTTP/1.1" 404 7375 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 ...
show more
[ti-22al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 35.255.147.209 - - [13/Nov/2026:06:13:05 +0100] "GET /.env.save HTTP/1.1" 404 7375 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0"
...
show less
Bad Web Bot
Web App Attack
2026-11-13 04:27:15
UTC ·
(1 day ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-11-13 04:04:44
UTC ·
(1 day ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: billing.budyn.ovh | Path: /.env | User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Ma ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: billing.budyn.ovh | Path: /.env | User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Mobile/15E148 Safari/604.1 | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
2026-11-13 03:50:12
UTC ·
(1 day ago)
Bot / seems abusive / Apache connections: 111
DDoS Attack
Web Spam
Bad Web Bot
Web App Attack
