🇺🇸
kosada.com
2026-08-22 10:05:43
(5 hours ago)
Web vulnerability probing: /actuator/env
Web App Attack
🇿🇦
conure.sh
2026-08-22 06:14:13
(9 hours ago)
csagent: score 24.6: 404 noise floor x7, secrets grab x2, php 404 x2; 1 domain(s) in 1m0s
Web App Attack
🇫🇷
masterguru
2026-08-22 05:43:50
(10 hours ago)
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .b ...
show more
URL file extension is restricted by policy. String match within ".ani/ .asa/ .asax/ .ascx/ .back/ .backup/ .bak/ .bck/ .bk/ .bkp/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .cnf/ .com/ .compositefont/ .config/ .conf/ .copy/ .crt/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dist/ .dll/ .dos/ .dpkg-dist/ .drv/ .gadget/ .hta/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .inf/ .ini/ .jks/ .jse/ .key/ .licx/ .lnk/ .log/ .mdb/ .msc/ .ocx/ .old/ .pass/ .pdb/ .pfx/ .pif/ .pem/ .pol/ .prf/ .printer/ .pwd/ .rdb/ .rdp/ .reg/ .resources/ .resx/ .sav/ .save/ .scr/ .sct/ .sh/ .shs/ .sql/ .sqlite/ .sqlite3/ .swap/ .swo/ .swp/ .sys/ .temp/ .tfstate/ .tlb/ .tmp/ .vb/ .vbe/ .vbs/ .vbproj/ .vsdisco/ .vxd/ .webinfo/ .ws/ .wsc/ .wsf/ .wsh/ .xsd/ .xsx/" at TX:extension. (920440-193)
show less
Hacking
🇬🇧
consul.to
2026-08-22 04:36:23
(11 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇵🇱
Budyn
2026-08-22 02:39:10
(13 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: grafana.astropot.site | URI: /.env.development | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-08-21 21:32:34
(18 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: grafana.goblinpot.store | URI: /.env.dev | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇩🇪
wpadm4
2026-08-21 21:21:14
(18 hours ago)
(wordpress) Failed login wp-login.php or xmlrpc.php
Web App Attack
🇨🇭
4server
2026-08-21 16:52:02
(23 hours ago)
[FriAug2118:51:59.3299552026][security2:error][pid2720852:tid2721064][client91.92.41.174:0]ModSecuri ...
show more
[FriAug2118:51:59.3299552026][security2:error][pid2720852:tid2721064][client91.92.41.174:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Matchedphrase\".env\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"465\"][id\"960720\"][msg\"Forbiddenfileaccess\"][hostname\"pro2green.ch.81-17-25-250.cpanel.site\"][uri\"/.env.prod\"][unique_id\"aoiCLwieSXs0mRe2jWDyegAAAYA\"]
show less
Hacking
Web App Attack
🇺🇸
InfraGuardAPI
2026-08-21 09:52:56
(1 day ago)
InfraGuard API: sonda honeypot em /api/.env
Hacking
Bad Web Bot
🇵🇱
Budyn
2026-08-21 09:06:33
(1 day ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: pma.budyn.ovh | URI: /.env.dev | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇫🇷
largo-it.net
2026-08-21 04:49:02
(1 day ago)
Aug 21 06:47:39 vps-9f3cdc33 haproxy[2975930]: 91.92.41.174:39752 [21/Aug/2026:06:47:39.397] www_fro ...
show more
Aug 21 06:47:39 vps-9f3cdc33 haproxy[2975930]: 91.92.41.174:39752 [21/Aug/2026:06:47:39.397] www_frontend~ finance_cluster/finance1_test1_https 0/0/10/311/321 404 514 - - ---- 75/28/0/0/0 0/0 "HEAD /wp-json/ HTTP/1.1"
Aug 21 06:47:52 vps-9f3cdc33 haproxy[2975930]: 91.92.41.174:44858 [21/Aug/2026:06:47:51.790] www_frontend~ finance_cluster/finance1_test1_https 0/0/11/319/330 404 3252 - - ---- 63/16/0/0/0 0/0 "GET /wp-config.php~ HTTP/1.1"
Aug 21 06:47:53 vps-9f3cdc33 haproxy[2975930]: 91.92.41.174:44828 [21/Aug/2026:06:47:53.666] www_frontend~ finance_cluster/finance1_test1_https 0/0/11/310/321 404 3252 - - ---- 62/15/0/0/0 0/0 "GET /mail/config/config.inc.php HTTP/1.1"
Aug 21 06:48:01 vps-9f3cdc33 haproxy[2975930]: 91.92.41.174:53192 [21/Aug/2026:06:48:00.734] www_frontend~ finance_cluster/finance1_test1_https 0/0/11/313/324 404 3252 - - ---- 70/23/0/0/0 0/0 "GET /squirrelmail/config/conf.pl HTTP/1.1"
Aug 21 06:48:02 vps-9f3cdc33 haproxy[2975930]: 91.92.41.174:53174 [21/Aug/2026:06:48:
...
show less
Hacking
Bad Web Bot
Web App Attack
🇻🇪
LUISE
2026-08-21 02:00:23
(1 day ago)
Vulnerability scanning for Web files on server 5-9VE.
Hacking
Bad Web Bot
🇮🇩
Burayot
2026-08-21 01:09:27
(1 day ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 91.92.41.174 (BG/Bulgaria/-): 2 in t ...
show more
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 91.92.41.174 (BG/Bulgaria/-): 2 in the last 3600 secs
show less
Web App Attack
🇫🇷
masterguru
2026-08-20 14:54:20
(2 days ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 91.92.41.174 (BG/Bulgaria/-): 1 in the last 36 ...
show more
(modsec_5015) ModSec 5015: Suspicious User-Agent from 91.92.41.174 (BG/Bulgaria/-): 1 in the last 3600 secs (0-195)
show less
Hacking
🇩🇪
ger-stg-sifi1
2026-08-20 13:15:51
(2 days ago)
(wordpress) Failed wordpress login using wp-login.php or xmlrpc.php
Web App Attack