🇺🇸
13.140.233.153
30 Oct 2026
Direct IP access.
13.140.233.153 - - [30/Oct/2026:15:50:55 +0100] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e ...
show more
Direct IP access.
13.140.233.153 - - [30/Oct/2026:15:50:55 +0100] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 392 "-" "libredtail-http" "REDACTED:80" "-"
13.140.233.153 - - [30/Oct/2026:15:50:55 +0100] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 400 392 "-" "libredtail-http" "REDACTED:80" "-"
...
show less
Port Scan
Web App Attack
🇵🇰
203.128.10.43
30 Oct 2026
Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 203.128.10.43; ...
show more
Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 203.128.10.43; usernames=["telnet" "admin" "Admin" "root" "Manager"]; passwords sha1 prefix=["22e9f568" "c13ec639" "12dea96f" "5d3342dd" "8df2ae06" "e69867ca" "39ef9aae" "94f2272c" "bf7b70bf"]
show less
Port Scan
Brute-Force
IoT Targeted
🇳🇱
195.178.110.228
30 Oct 2026
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 195.178.110.228; ...
show more
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 195.178.110.228; usernames=["root"]; passwords sha1 prefix=["3d4f2bf0" "601f1889" "4d9012b4" "7110eda4" "7c4a8d09" "20eabe5d" "01b307ac" "360e46f1" "e7d537e1" "4be30d98"]
show less
Brute-Force
SSH
🇯🇵
35.200.111.180
30 Oct 2026
Bad Bot.
35.200.111.180 - - [30/Oct/2026:13:50:28 +0100] "GET /.env.supabase HTTP/1.1" 402 1780 "-" ...
show more
Bad Bot.
35.200.111.180 - - [30/Oct/2026:13:50:28 +0100] "GET /.env.supabase HTTP/1.1" 402 1780 "-" "DuckAssistBot/1.1 (https://duckduckgo.com/duckassistbot)"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
164.30.17.82
30 Oct 2026
SSH aggressive port ping.
{"destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":" ...
show more
SSH aggressive port ping.
{"destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":"info","msg":"SSH connection","product":"ssh-auth-logger","spt":"12654","src":"164.30.17.82","time":"2026-10-30T11:38:11Z"}
{"abuseConfidenceScore":100,"countryCode":"DE","destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":"info","msg":"SSH connection","product":"ssh-auth-logger","spt":"15682","src":"164.30.17.82","time":"2026-10-30T11:41:30Z","totalReports":6464}
{"abuseConfidenceScore":100,"countryCode":"DE","destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":"info","msg":"SSH connection","product":"ssh-auth-logger","spt":"17860","src":"164.30.17.82","time":"2026-10-30T11:44:48Z","totalReports":6464}
{"abuseConfidenceScore":100,"countryCode":"DE","destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":"info","msg":"SSH connection","product":"ssh-auth-logger","spt":"42752","src":"164.30.17.82","time":"2026-10-30T11:48:07Z","totalReports":6464}
{"abuseC
...
show less
Brute-Force
Port Scan
🇳🇱
185.242.226.105
30 Oct 2026
Direct IP access.
185.242.226.105 - - [30/Oct/2026:13:30:34 +0100] "GET / HTTP/1.0" 400 651 "-" "-" ...
show more
Direct IP access.
185.242.226.105 - - [30/Oct/2026:13:30:34 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" "-"
185.242.226.105 - - [30/Oct/2026:13:31:17 +0100] "GET / HTTP/1.1" 402 4832 "-" "Python/3.7 aiohttp/3.8.1" "REDACTED" ""
...
show less
Port Scan
Web App Attack
🇩🇪
164.30.17.82
30 Oct 2026
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 164.30.17.82; use ...
show more
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 164.30.17.82; usernames=["root"]; passwords sha1 prefix=["3a52ce78" "9781103e" "976fee98" "bec75d2e" "7e4649ba" "eeed3db7" "370194ff" "3d3dc153" "4e9754cc" "6cfeca3f"]
show less
Brute-Force
SSH
🇺🇸
71.6.134.204
30 Oct 2026
Direct IP access.
71.6.134.204 - - [30/Oct/2026:13:08:44 +0100] "GET / HTTP/1.1" 402 2752 "-" "Mozil ...
show more
Direct IP access.
71.6.134.204 - - [30/Oct/2026:13:08:44 +0100] "GET / HTTP/1.1" 402 2752 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36" "REDACTED" ""
71.6.134.204 - - [30/Oct/2026:13:11:00 +0100] "GET /favicon.ico HTTP/1.1" 402 2734 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36" "REDACTED" ""
...
show less
Port Scan
Web App Attack
🇳🇱
109.160.32.105
30 Oct 2026
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 109.160.32.105; u ...
show more
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 109.160.32.105; usernames=["user4" "mapingyuan" "root" "user" "admin" "appuser" "park"]; passwords sha1 prefix=["06e6eef6" "54114a62" "3dbb000d" "8cb2237d" "7b902e6f" "ab4154a7" "aebc3ebe" "dc76e9f0" "3c331507" "ce4151ff"]
show less
Brute-Force
SSH
🇺🇸
66.132.195.89
30 Oct 2026
Direct IP access.
66.132.195.89 - - [30/Oct/2026:12:48:38 +0100] "\x16\x03\x01\x05\xba\x01" 400 392 ...
show more
Direct IP access.
66.132.195.89 - - [30/Oct/2026:12:48:38 +0100] "\x16\x03\x01\x05\xba\x01" 400 392 "-" "-" "-" "-"
66.132.195.89 - - [30/Oct/2026:12:48:42 +0100] "GET / HTTP/1.1" 402 2730 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" "REDACTED" ""
...
show less
Port Scan
Web App Attack
🇯🇵
35.221.111.212
30 Oct 2026
Direct IP access.
35.221.111.212 - - [30/Oct/2026:12:46:56 +0100] "GET / HTTP/2.0" 402 2703 "-" "Moz ...
show more
Direct IP access.
35.221.111.212 - - [30/Oct/2026:12:46:56 +0100] "GET / HTTP/2.0" 402 2703 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36" "service.REDACTED" ""
35.221.111.212 - - [30/Oct/2026:12:47:00 +0100] "GET /robots.txt HTTP/2.0" 402 2556 "-" "Mozilla/5.0 (compatible; MoonshotBot/1.0; +https://kimi.ai/)" "service.REDACTED" ""
...
show less
Port Scan
Web App Attack
🇺🇸
66.132.172.97
30 Oct 2026
Direct IP access.
66.132.172.97 - - [30/Oct/2026:12:31:38 +0100] "GET / HTTP/1.1" 402 4867 "-" "Mozi ...
show more
Direct IP access.
66.132.172.97 - - [30/Oct/2026:12:31:38 +0100] "GET / HTTP/1.1" 402 4867 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" "REDACTED" ""
66.132.172.97 - - [30/Oct/2026:12:32:20 +0100] "GET /phpinfo.php HTTP/1.1" 402 4820 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" "REDACTED" ""
...
show less
Port Scan
Web App Attack
🇸🇮
176.65.134.73
30 Oct 2026
Direct IP access.
176.65.134.73 - - [30/Oct/2026:12:24:05 +0100] "GET / HTTP/1.1" 402 2743 "-" "Mozi ...
show more
Direct IP access.
176.65.134.73 - - [30/Oct/2026:12:24:05 +0100] "GET / HTTP/1.1" 402 2743 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" "REDACTED" ""
176.65.134.73 - - [30/Oct/2026:12:24:06 +0100] "GET /favicon.ico HTTP/1.1" 402 818 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" "REDACTED" ""
...
show less
Port Scan
Web App Attack
🇵🇰
160.250.114.145
30 Oct 2026
Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 160.250.114.14 ...
show more
Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 160.250.114.145; usernames=["admin" "default" "root" "e8telnet" "super"]; passwords sha1 prefix=["8cb2237d" "7505d64a" "70352f41" "74913f5c" "b0faceaa" "bdb985a5" "34816210" "d32ff024" "7110eda4"]
show less
Port Scan
Brute-Force
IoT Targeted
🇯🇵
35.200.85.13
30 Oct 2026
Bad Bot.
35.200.85.13 - - [30/Oct/2026:12:21:24 +0100] "GET /.env.production.local HTTP/1.1" 402 179 ...
show more
Bad Bot.
35.200.85.13 - - [30/Oct/2026:12:21:24 +0100] "GET /.env.production.local HTTP/1.1" 402 1792 "-" "Mozilla/5.0 (compatible; Bravebot/1.0; +https://brave.com/search/)"
...
show less
Bad Web Bot
Web App Attack
🇨🇭
170.231.237.214
30 Oct 2026
Direct IP access.
170.231.237.214 - - [30/Oct/2026:12:09:13 +0100] "GET / HTTP/1.1" 402 2725 "-" "Mo ...
show more
Direct IP access.
170.231.237.214 - - [30/Oct/2026:12:09:13 +0100] "GET / HTTP/1.1" 402 2725 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.164 YaBrowser/21.6.4.693 Yowser/2.5 Safari/537.36" "REDACTED" ""
170.231.237.214 - - [30/Oct/2026:12:09:30 +0100] "GET /robots.txt HTTP/1.1" 402 2826 "-" "ApcosysBot/1.0 (+https://apcosys.net)" "REDACTED" ""
...
show less
Port Scan
Web App Attack
🇧🇷
45.140.193.140
30 Oct 2026
Direct IP access.
45.140.193.140 - - [30/Oct/2026:12:02:34 +0100] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e ...
show more
Direct IP access.
45.140.193.140 - - [30/Oct/2026:12:02:34 +0100] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 2354 "-" "libredtail-http" "REDACTED:443" "-"
45.140.193.140 - - [30/Oct/2026:12:02:39 +0100] "POST /cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh HTTP/1.1" 400 2354 "-" "libredtail-http" "REDACTED:443" "-"
...
show less
Port Scan
Web App Attack
🇷🇴
193.46.255.86
30 Oct 2026
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 193.46.255.86; us ...
show more
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 193.46.255.86; usernames=["user" "administrator" "admin" "ftpuser"]; passwords sha1 prefix=["3f8117c1" "adf00188" "7110eda4" "642e8267" "b3aca92c" "b39dffa7" "7b902e6f" "7c4a8d09" "c6f1e1be" "5f8e36de" "7616bb87" "7c222fb2"]
show less
Brute-Force
SSH
🇺🇸
184.105.247.254
30 Oct 2026
Bad Bot.
184.105.247.254 - - [30/Oct/2026:11:43:59 +0100] "GET /.git/config HTTP/1.1" 402 3674 "-" " ...
show more
Bad Bot.
184.105.247.254 - - [30/Oct/2026:11:43:59 +0100] "GET /.git/config HTTP/1.1" 402 3674 "-" "Mozilla/5.0 (Windows NT 10.0.0; Win64; x64; ) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.156 Not(A:Brand/24 YaBrowser/24.4.1.899 Yowser/2.5 Safari/537.36" "REDACTED" ""
...
show less
Bad Web Bot
Web App Attack
🇺🇸
136.111.240.223
30 Oct 2026
Bad Bot.
136.111.240.223 - - [30/Oct/2026:11:43:44 +0100] "GET /.env HTTP/1.1" 301 1077 "-" "Mozilla ...
show more
Bad Bot.
136.111.240.223 - - [30/Oct/2026:11:43:44 +0100] "GET /.env HTTP/1.1" 301 1077 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15"
...
show less
Bad Web Bot
Web App Attack
🇫🇷
213.32.122.82
30 Oct 2026
Direct IP access.
213.32.122.82 - - [30/Oct/2026:11:41:07 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "- ...
show more
Direct IP access.
213.32.122.82 - - [30/Oct/2026:11:41:07 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" "-"
213.32.122.82 - - [30/Oct/2026:11:41:06 +0100] "GET / HTTP/1.1" 402 2364 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" "REDACTED" ""
...
show less
Port Scan
Web App Attack
🇧🇬
46.55.162.29
30 Oct 2026
Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 46.55.162.29; ...
show more
Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 46.55.162.29; usernames=["admin" "root" "ZXDSL" "user" "supervisor" "nobody"]; passwords sha1 prefix=["49c5b964" "047c146c" "7c4a8d09" "d38d6f00" "9d7cc4f4" "0f4d09e4" "7110eda4" "1e17fd88" "5baa61e4"]
show less
Port Scan
Brute-Force
IoT Targeted
🇧🇩
103.159.2.113
30 Oct 2026
SSH aggressive port ping.
{"destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":" ...
show more
SSH aggressive port ping.
{"destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":"info","msg":"SSH connection","product":"ssh-auth-logger","spt":"40218","src":"103.159.2.113","time":"2026-10-30T07:44:26Z"}
{"abuseConfidenceScore":100,"countryCode":"BD","destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":"info","msg":"SSH connection","product":"ssh-auth-logger","spt":"54694","src":"103.159.2.113","time":"2026-10-30T07:48:11Z","totalReports":17286}
{"abuseConfidenceScore":100,"countryCode":"BD","destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":"info","msg":"SSH connection","product":"ssh-auth-logger","spt":"48320","src":"103.159.2.113","time":"2026-10-30T07:51:47Z","totalReports":17286}
{"abuseConfidenceScore":100,"countryCode":"BD","destinationServicename":"sshd","dpt":"2222","dst":"REDACTED.2","level":"info","msg":"SSH connection","product":"ssh-auth-logger","spt":"48390","src":"103.159.2.113","time":"2026-10-30T07:55:22Z","totalReports":17286}
{
...
show less
Brute-Force
Port Scan
🇷🇴
92.118.39.76
30 Oct 2026
Direct IP access.
92.118.39.76 - - [30/Oct/2026:09:28:03 +0100] "GET / HTTP/2.0" 402 2701 "-" "Mozil ...
show more
Direct IP access.
92.118.39.76 - - [30/Oct/2026:09:28:03 +0100] "GET / HTTP/2.0" 402 2701 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" "REDACTED" ""
92.118.39.76 - - [30/Oct/2026:09:28:04 +0100] "GET /favicon.ico HTTP/2.0" 402 503 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/140.0.0.0 Safari/537.36" "REDACTED" ""
...
show less
Port Scan
Web App Attack
🇧🇩
103.159.2.113
30 Oct 2026
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 103.159.2.113; us ...
show more
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 103.159.2.113; usernames=["oneadmin" "mapr" "user1" "validator" "vyos" "fun" "ftpuser" "ubuntu" "lighthouse" "gitlab-runner"]; passwords sha1 prefix=["7bc8559a" "1cb72f9a" "09aeacd5" "03a182f7" "09420ed7" "c84c50d5" "c6f1e1be" "24bf68e3" "7c4a8d09" "5f891025"]
show less
Brute-Force
SSH