Anonymous
2026-10-24 22:16:44
(14 hours ago)
Trying to access config files
Web App Attack
๐ต๐ฑ
Budyn
2026-10-23 08:39:23
(2 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: budyn.ovh | URI: /.env | UA: python-requests/2.34.2 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"NL","Cf-Connecting-Ip":"45.156.87.14","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a4ef6e52ca6b7a96-AMS","Connection":"Keep-Alive","Accept-Encoding":"gzip, br","Accept":"*\/*","X-Forwarded-For":"45.156.87.14","X-Waf-Trigger":"1"}
show less
Hacking
Web App Attack
๐ซ๐ฎ
paissangroup
2026-10-23 06:09:34
(2 days ago)
Multiple WAF Violations
Web App Attack
๐บ๐ธ
TPI-Abuse
2026-10-22 22:19:38
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 45.156.87.14 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 45.156.87.14 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 18:19:21.502086 2026] [security2:error] [pid 10231:tid 10231] [client 45.156.87.14:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "autodiscover.apushistoryexamprep.com"] [uri "/.env"] [unique_id "atqL6RwNai8IAKQKcUhU4gAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2026-10-22 22:06:05
(2 days ago)
Trying to access config files
Web App Attack
๐ณ๐ฑ
Site.eu
2026-10-22 20:00:35
(2 days ago)
Excessive 404/403 errors
Brute-Force
๐ณ๐ฑ
Alt255
2026-10-22 19:50:06
(2 days ago)
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[cb-01vi] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 45.156.87.14 - - [22/Oct/2026:21:49:56 +0200] "GET /.env HTTP/1.1" 404 2069 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
๐บ๐ธ
0tsystems
2026-10-22 19:06:23
(2 days ago)
Automated scan detected on 0t.systems: /.env
Web App Attack
Anonymous
2026-10-22 15:23:42
(2 days ago)
IP matched detection query bad paths many.
Brute-Force
Web App Attack
๐บ๐ธ
ambor
2026-10-01 08:29:44
(3 weeks ago)
L0ss Honeypot: Environment file access attempt. Path: /.env
Web App Attack
๐ฉ๐ช
ramazan
2026-10-01 08:29:20
(3 weeks ago)
Fail2Ban: nginx-4xx | Failures: 10 | Log: / /.env.production /.gitlab-ci.yml /WEB-INF/web.xml /backe ...
show more
Fail2Ban: nginx-4xx | Failures: 10 | Log: / /.env.production /.gitlab-ci.yml /WEB-INF/web.xml /backend/.env
show less
Web App Attack
Hacking
๐บ๐ธ
1gz
2026-10-01 08:26:52
(3 weeks ago)
Triggered Cloudflare WAF (firewallManaged) from NL.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET meth ...
show more
Triggered Cloudflare WAF (firewallManaged) from NL.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /wp-config.php.backup
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
๐ณ๐ฑ
johntps
2026-09-28 17:16:19
(3 weeks ago)
Automated honeypot defense: host probed a decoy/trap endpoint (/.aws/credentials) on a monitored web ...
show more
Automated honeypot defense: host probed a decoy/trap endpoint (/.aws/credentials) on a monitored web server; confirmed malicious and blocked.
show less
Web App Attack
Bad Web Bot
Hacking
๐ฉ๐ช
ramazan
2026-09-28 17:08:05
(3 weeks ago)
Fail2Ban: nginx-4xx | Failures: 10 | Log: /_profiler/phpinfo /_profiler/phpinfo.php /info /phpinfo / ...
show more
Fail2Ban: nginx-4xx | Failures: 10 | Log: /_profiler/phpinfo /_profiler/phpinfo.php /info /phpinfo /phpinfo.php
show less
Web App Attack
Hacking
๐บ๐ธ
ambor
2026-09-28 17:07:19
(3 weeks ago)
L0ss Honeypot: Environment file access attempt. Path: /.env
Web App Attack