🇬🇧
sc user
2026-10-29 04:25:58
(1 hour ago)
Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy.
Bad Web Bot
Web App Attack
Port Scan
🇬🇧
sc user
2026-10-27 20:55:46
(1 day ago)
Fail2Ban nginx: repeated suspicious HTTP requests consistent with automated probing, scanning or bad bot behaviour. Technical log details and local server identifiers intentionally omitted for privacy.
Bad Web Bot
Web App Attack
Port Scan
🇳🇱
Site.eu
2026-10-27 14:01:55
(1 day ago)
Web shell access (POST to a PHP file in wp-includes or wp-content/uploads)
Hacking
Web App Attack
🇳🇱
Alt255
2026-10-26 21:28:06
(2 days ago)
[ti-tinov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 89.58.42.118 - - [23/Oct/2026:10:21:49 +0200] "GET /.env.local HTTP/1.1" 404 7207 "-" "Mozilla/5.0 (Linux; Android 14; SM-S921B) AppleWebKit/537.36 (KHT ...
show more
[ti-tinov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 89.58.42.118 - - [23/Oct/2026:10:21:49 +0200] "GET /.env.local HTTP/1.1" 404 7207 "-" "Mozilla/5.0 (Linux; Android 14; SM-S921B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.122 Mobile Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇮🇩
adi s
2026-10-26 04:37:22
(3 days ago)
2026-10-26T11:37:21.846641+07:00 nice.iptelemedia.id dovecot[1817408]: imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 2 secs) (auth_failed): user=<[email protected] >, method=PLAIN, rip=89.58.42.118, lip=49.156.57.58, TLS, ...
show more
2026-10-26T11:37:21.846641+07:00 nice.iptelemedia.id dovecot[1817408]: imap-login: Login aborted: Connection closed (auth failed, 1 attempts in 2 secs) (auth_failed): user=<[email protected] >, method=PLAIN, rip=89.58.42.118, lip=49.156.57.58, TLS, session=<QOOX4rZe0OpZOip2>
...
show less
Brute-Force
2026-10-25 22:50:16
(3 days ago)
Brute-Force
🇦🇺
FireGuard Server
2026-10-25 21:15:03
(3 days ago)
Blocked by os-abuseipdb; 8 hits, proto=tcp, ports=143
Port Scan
Hacking
🇳🇱
Alt255
2026-10-25 13:46:53
(3 days ago)
[ti-tinov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 89.58.42.118 - - [23/Oct/2026:10:21:49 +0200] "GET /.env.local HTTP/1.1" 404 7207 "-" "Mozilla/5.0 (Linux; Android 14; SM-S921B) AppleWebKit/537.36 (KHT ...
show more
[ti-tinov] Web exploit scanning: 1 suspicious requests detected by fail2ban jail <name>. Example: 89.58.42.118 - - [23/Oct/2026:10:21:49 +0200] "GET /.env.local HTTP/1.1" 404 7207 "-" "Mozilla/5.0 (Linux; Android 14; SM-S921B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.122 Mobile Safari/537.36"
...
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-25 12:15:40
(3 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: git.sweetpuddingtrap.xyz | URI: /.env | UA: Mozil ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: git.sweetpuddingtrap.xyz | URI: /.env | UA: Mozilla/5.0 (Linux; Android 14; SM-S921B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.122 Mobile Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"89.58.42.118","Cdn-Loop":"cloudflare; loops=1","Connection":"Keep-Alive","Cf-Ray":"a50125e26838131b-HAM","Accept":"text\/plain,text\/html,application\/xhtml+xml,application\/xml;
show less
Bad Web Bot
Web App Attack
🇺🇸
Rip
2026-10-25 10:34:15
(3 days ago)
Restricted File Access Attempts
Port Scan
Web App Attack
🇵🇱
Budyn
2026-10-25 09:23:38
(3 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: auth.astropot.tech | URI: /.env | UA: Mozilla/5.0 ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: auth.astropot.tech | URI: /.env | UA: Mozilla/5.0 (Linux; Android 14; SM-S921B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.6478.122 Mobile Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"89.58.42.118","Cdn-Loop":"cloudflare; loops=1","Connection":"Keep-Alive","Cf-Ray":"a50029e4d881d681-HAM","Accept":"text\/plain,text\/html,application\/xhtml+xml,application\/xml;q=0.9,
show less
Bad Web Bot
Web App Attack
2026-10-25 09:21:58
(3 days ago)
Port scan and brute force attack
Port Scan
Brute-Force
🇺🇸
AEITS
2026-10-25 08:37:02
(3 days ago)
Fail2Ban WebMail
Bad Web Bot
Web App Attack
🇿🇦
maximonline.co.za
2026-10-25 06:30:49
(3 days ago)
Brute Force IMAP AUTH Attack
Brute-Force
🇺🇸
craudiovizai
2026-10-25 06:30:32
(3 days ago)
Automated honeypot detection. blocked ip against a Next.js application. Paths: /.env, /.env.local. Blocked at the edge.
Bad Web Bot
