🇳🇱
Alt255
2026-11-09 06:02:15
UTC ·
(1 day ago)
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 65.111.1.49 - - [09/Nov/2026:07:01:53 +0100] "GET /wp-config.php.old HTTP/1.1" 301 7335 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKi ...
show more
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 65.111.1.49 - - [09/Nov/2026:07:01:53 +0100] "GET /wp-config.php.old HTTP/1.1" 301 7335 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
2026-10-25 11:28:35
UTC ·
(2 weeks ago)
GlobalProtect brute force attempt.
Brute-Force
Web App Attack
🇫🇷
masterguru
2026-10-21 07:06:58
UTC ·
(2 weeks ago)
(modsec_5080) ModSec 5080: Infrastructure subdomain probe from 65.111.1.49 (US/United States/-): 1 in the last 3600 secs (0-195)
Hacking
🇳🇱
Alt255
2026-10-20 01:17:57
UTC ·
(3 weeks ago)
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 65.111.1.49 - - [20/Oct/2026:03:17:39 +0200] "GET /phpinfo.php~ HTTP/2.0" 301 326 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537. ...
show more
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 65.111.1.49 - - [20/Oct/2026:03:17:39 +0200] "GET /phpinfo.php~ HTTP/2.0" 301 326 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36"
...
show less
Bad Web Bot
Web App Attack
2026-10-08 05:22:09
UTC ·
(1 month ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇺🇸
craudiovizai
2026-10-03 06:30:46
UTC ·
(1 month ago)
Automated honeypot detection. honeypot against a Next.js application. Paths: /wp-login.php. Blocked at the edge.
Web App Attack
Bad Web Bot
🇬🇷
setupgr
2026-09-18 15:51:35
UTC ·
(1 month ago)
(wplogin_block) Blocked WP-Login Access Attempt 65.111.1.49 (US/United States/Virginia/Ashburn/-/[AS200373 3xK Tech GmbH]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 65.111.1.49 - - [18/Sep/2026:18:36:04 + ...
show more
(wplogin_block) Blocked WP-Login Access Attempt 65.111.1.49 (US/United States/Virginia/Ashburn/-/[AS200373 3xK Tech GmbH]): 1 in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 65.111.1.49 - - [18/Sep/2026:18:36:04 +0300] "GET /wp-login.php HTTP/2.0" 403 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15"
show less
Port Scan
🇨🇿
lp
2026-09-18 03:26:57
UTC ·
(1 month ago)
Unauthorized VPN login attempts: 4 attempts were recorded from 65.111.1.49
2026-09-18T04:39:13+02:00 vpn Access-Reject 'lupita' station: 65.111.1.49 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2 ...
show more
Unauthorized VPN login attempts: 4 attempts were recorded from 65.111.1.49
2026-09-18T04:39:13+02:00 vpn Access-Reject 'lupita' station: 65.111.1.49 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-18T04:40:43+02:00 vpn Access-Reject 'quantum' station: 65.111.1.49 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-18T04:42:20+02:00 vpn Access-Reject 'josue' station: 65.111.1.49 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-18T04:44:01+02:00 vpn Access-Reject 'fernando' station: 65.111.1.49 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇩🇪
4server
2026-09-18 00:35:48
UTC ·
(1 month ago)
[FriSep1802:35:44.9553862026][security2:error][pid2862134:tid2862227][client65.111.1.49:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"96 ...
show more
[FriSep1802:35:44.9553862026][security2:error][pid2862134:tid2862227][client65.111.1.49:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"www.eimeko.ch\"][uri\"/xmlrpc.php\"][unique_id\"aqyHYE3l17SCfWtPDWOkDQAAAMc\"]
show less
Port Scan
Brute-Force
Web App Attack
🇫🇷
Sklurk
2026-09-05 13:56:52
UTC ·
(2 months ago)
Web App Attack
Web App Attack
🇩🇪
NxtGenIT
2026-09-04 12:48:26
UTC ·
(2 months ago)
CiscoASA Honeypot hit, Payload: "GET /+CSCOE+/logon.html?fcadbadd=1 HTTP/1.1" 200 -,
Brute-Force
🇺🇸
drewf.ink
2026-09-01 13:13:13
UTC ·
(2 months ago)
[13:13] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon)
Web App Attack
🇫🇷
Sklurk
2026-09-01 05:51:28
UTC ·
(2 months ago)
Web App Attack
Web App Attack
🇺🇸
drewf.ink
2026-08-31 16:01:16
UTC ·
(2 months ago)
[16:01] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon)
Web App Attack
🇺🇸
drewf.ink
2026-08-29 10:25:33
UTC ·
(2 months ago)
[10:25] Attempted HTTPS access to the GlobalProtect prelogin endpoint on the web honeypot (VPN gateway fingerprinting/recon)
Web App Attack
