|
🇨🇳
27.153.130.141
|
|
Knock-Knock TNET honeypot activity; time=2026-11-04 12:01:39; username=default
|
Brute-Force
|
|
🇧🇷
34.39.148.255
|
|
[04/Nov/2026:07:02:50.193832 --0500] ause6Jn0SqNqkjDcgaJVzAAAABM 34.39.148.255 49774 205.233.18.17 7 ...
show more
[04/Nov/2026:07:02:50.193832 --0500] ause6Jn0SqNqkjDcgaJVzAAAABM 34.39.148.255 49774 205.233.18.17 7081
[04/Nov/2026:07:02:51.572753 --0500] ause6xZNLeBblCtjzJdC2AAAAQw 34.39.148.255 50060 205.233.18.17 7081
[04/Nov/2026:07:02:51.693070 --0500] ause631fr0rHNrQteGm1ngAAAMk 34.39.148.255 50108 205.233.18.17 7081
[04/Nov/2026:07:02:51.694323 --0500] ause65n0SqNqkjDcgaJVzgAAABI 34.39.148.255 50076 205.233.18.17 7081
[04/Nov/2026:07:02:51.696108 --0500] ause631fr0rHNrQteGm1nwAAAMU 34.39.148.255 50168 205.233.18.17 7081
...
show less
|
Hacking
|
|
🇺🇸
57.141.6.16
|
|
[Wed Nov 04 06:55:09.569709 2026] [authz_core:error] [pid 2431893:tid 140554725738240] [client 57.14 ...
show more
[Wed Nov 04 06:55:09.569709 2026] [authz_core:error] [pid 2431893:tid 140554725738240] [client 57.141.6.16:0] AH01630: client denied by server configuration: /var/www/vhosts/livingdownsouth.com/error_docs/forbidden.html, referer: https://properties.livingdownsouth.com/
[Wed Nov 04 06:55:09.793899 2026] [authz_core:error] [pid 2431893:tid 140555272861440] [client 57.141.6.16:0] AH01630: client denied by server configuration: /var/www/vhosts/livingdownsouth.com/httpdocs/wp-includes/js/jquery/ui/core.min.js, referer: https://properties.livingdownsouth.com/
[Wed Nov 04 06:55:09.793960 2026] [authz_core:error] [pid 2431893:tid 140555272861440] [client 57.141.6.16:0] AH01630: client denied by server configuration: /var/www/vhosts/livingdownsouth.com/error_docs/forbidden.html, referer: https://properties.livingdownsouth.com/
[Wed Nov 04 07:02:29.594124 2026] [authz_core:error] [pid 2432200:tid 140553945609984] [client 57.141.6.16:0] AH01630: client denied by server configuration: /var/www/vho
...
show less
|
Web App Attack
|
|
🇺🇸
57.141.6.20
|
|
[Wed Nov 04 06:55:46.669472 2026] [authz_core:error] [pid 3057527:tid 139953328948992] [client 57.14 ...
show more
[Wed Nov 04 06:55:46.669472 2026] [authz_core:error] [pid 3057527:tid 139953328948992] [client 57.141.6.20:0] AH01630: client denied by server configuration: /var/www/vhosts/upcountryhistory.org/error_docs/forbidden.html
[Wed Nov 04 06:59:25.914477 2026] [authz_core:error] [pid 3057302:tid 139953103165184] [client 57.141.6.20:0] AH01630: client denied by server configuration: /var/www/vhosts/upcountryhistory.org/httpdocs/event
[Wed Nov 04 06:59:25.914538 2026] [authz_core:error] [pid 3057302:tid 139953103165184] [client 57.141.6.20:0] AH01630: client denied by server configuration: /var/www/vhosts/upcountryhistory.org/error_docs/forbidden.html
[Wed Nov 04 07:02:13.722269 2026] [authz_core:error] [pid 3057302:tid 139952406898432] [client 57.141.6.20:0] AH01630: client denied by server configuration: /var/www/vhosts/bkpressurewash.com/httpdocs/
[Wed Nov 04 07:02:13.722615 2026] [authz_core:error] [pid 3057302:tid 139952406898432] [client 57.141.6.20:0] AH01630: client denied by server co
...
show less
|
Web App Attack
|
|
🇲🇦
41.251.3.37
|
|
[04/Nov/2026:07:01:36.212173 --0500] auseoJn0SqNqkjDcgaJU9QAAAAQ 41.251.3.37 48586 205.233.18.17 708 ...
show more
[04/Nov/2026:07:01:36.212173 --0500] auseoJn0SqNqkjDcgaJU9QAAAAQ 41.251.3.37 48586 205.233.18.17 7081
[04/Nov/2026:07:01:37.852289 --0500] auseoRZNLeBblCtjzJdB3AAAAQA 41.251.3.37 49132 205.233.18.17 7081
[04/Nov/2026:07:01:51.790368 --0500] auser5n0SqNqkjDcgaJVMQAAABQ 41.251.3.37 53440 205.233.18.17 7081
[04/Nov/2026:07:01:52.496028 --0500] ausesH1fr0rHNrQteGm0rgAAAMw 41.251.3.37 53452 205.233.18.17 7081
[04/Nov/2026:07:01:53.394975 --0500] ausesX1fr0rHNrQteGm0sQAAANU 41.251.3.37 53490 205.233.18.17 7081
...
show less
|
Hacking
|
|
🇻🇳
58.186.116.19
|
|
58.186.116.19 - - [04/Nov/2026:07:01:42 -0500] "GET /wp-json/wp/v2/users?_fields=slug&per_page=100&p ...
show more
58.186.116.19 - - [04/Nov/2026:07:01:42 -0500] "GET /wp-json/wp/v2/users?_fields=slug&per_page=100&page=1 HTTP/1.1" 403 5752 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
58.186.116.19 - - [04/Nov/2026:07:01:45 -0500] "GET /?author=1&feed=rss2 HTTP/1.1" 301 4844 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
58.186.116.19 - - [04/Nov/2026:07:01:46 -0500] "GET /?author=2&feed=rss2 HTTP/1.1" 301 4853 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
58.186.116.19 - - [04/Nov/2026:07:01:48 -0500] "GET /?author=3&feed=rss2 HTTP/1.1" 301 4853 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Safari/537.36"
58.186.116.19 - - [04/Nov/2026:07:01:49 -0500] "GET /?author=4&feed=rss2 HTTP/1.1" 301 4853 "-" "Mozilla/5.0 (Windows NT 10.0;
...
show less
|
Web App Attack
|
|
🇸🇬
152.42.219.54
|
|
152.42.219.54 - - [04/Nov/2026:06:59:27 -0500] "POST /xmlrpc.php HTTP/1.1" 200 5270 "-" "Mozilla/5.0 ...
show more
152.42.219.54 - - [04/Nov/2026:06:59:27 -0500] "POST /xmlrpc.php HTTP/1.1" 200 5270 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36 Edg/119.0.2151.97"
152.42.219.54 - - [04/Nov/2026:06:59:31 -0500] "GET /?author=0 HTTP/1.1" 200 67311 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.6167.85 Safari/537.36"
152.42.219.54 - - [04/Nov/2026:06:59:34 -0500] "GET /?author=1 HTTP/1.1" 301 4905 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.130 Safari/537.36"
152.42.219.54 - - [04/Nov/2026:06:59:37 -0500] "GET /author/admin/ HTTP/1.1" 200 66224 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.6099.130 Safari/537.36"
152.42.219.54 - - [04/Nov/2026:06:59:40 -0500] "GET /?author=2 HTTP/1.1" 301 4910 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 11_7_2) AppleWebKit/605.1.15 (KHTML, like Gecko)
...
show less
|
Web App Attack
|
|
🇷🇺
45.91.64.10
|
|
Knock-Knock HTTP honeypot activity; time=2026-11-04 11:57:45; http_method=GET; http_path=/server-sta ...
show more
Knock-Knock HTTP honeypot activity; time=2026-11-04 11:57:45; http_method=GET; http_path=/server-status; http_purpose=config_exposure; http_exploit=Apache mod_status Exposure; http_user_agent=Go-http-client/1.1
show less
|
Web App Attack
|
|
🇯🇵
8.216.5.178
|
|
Knock-Knock HTTP honeypot activity; time=2026-11-04 11:56:52; http_method=<cryptic binary>; http_pat ...
show more
Knock-Knock HTTP honeypot activity; time=2026-11-04 11:56:52; http_method=<cryptic binary>; http_path=<cryptic binary>; http_purpose=protocol_probe
show less
|
Web App Attack
|
|
🇺🇸
45.45.238.81
|
|
Knock-Knock RDP honeypot activity; time=2026-11-04 11:53:00; username=administrator; domain=WIN-01NJ ...
show more
Knock-Knock RDP honeypot activity; time=2026-11-04 11:53:00; username=administrator; domain=WIN-01NJO7IH0FR; rdp_workstation=WIN-01NJO7IH0FR
show less
|
Brute-Force
|
|
🇷🇺
176.192.218.148
|
|
Knock-Knock SSH honeypot activity; time=2026-11-04 11:53:51; username=oracle
|
Brute-Force
SSH
|
|
🇷🇺
195.19.126.222
|
|
Knock-Knock TNET honeypot activity; time=2026-11-04 11:54:05; username=default
|
Brute-Force
|
|
🇩🇪
80.86.187.103
|
|
80.86.187.103 - - [04/Nov/2026:06:52:07 -0500] "POST /wp-login.php HTTP/1.1" 200 14059 "-" "Mozilla/ ...
show more
80.86.187.103 - - [04/Nov/2026:06:52:07 -0500] "POST /wp-login.php HTTP/1.1" 200 14059 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
80.86.187.103 - - [04/Nov/2026:06:54:23 -0500] "POST /wp-login.php HTTP/1.1" 200 14055 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
80.86.187.103 - - [04/Nov/2026:06:54:44 -0500] "POST /wp-login.php HTTP/1.1" 200 14053 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
80.86.187.103 - - [04/Nov/2026:06:56:43 -0500] "POST /wp-login.php HTTP/1.1" 200 14059 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
80.86.187.103 - - [04/Nov/2026:06:57:57 -0500] "POST /wp-login.php HTTP/1.1" 200 14059 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/
...
show less
|
Web App Attack
|
|
🇺🇸
57.141.6.46
|
|
[Wed Nov 04 06:55:09.840760 2026] [authz_core:error] [pid 2432200:tid 140553928824576] [client 57.14 ...
show more
[Wed Nov 04 06:55:09.840760 2026] [authz_core:error] [pid 2432200:tid 140553928824576] [client 57.141.6.46:0] AH01630: client denied by server configuration: /var/www/vhosts/livingdownsouth.com/error_docs/forbidden.html, referer: https://properties.livingdownsouth.com/
[Wed Nov 04 06:56:17.237479 2026] [authz_core:error] [pid 2431893:tid 140554188867328] [client 57.141.6.46:0] AH01630: client denied by server configuration: /var/www/vhosts/livingdownsouth.com/httpdocs/wp-content/plugins/idx-broker-platinum/assets/js/bootstrap-5.1.3.min.js, referer: https://properties.livingdownsouth.com/
[Wed Nov 04 06:56:17.237563 2026] [authz_core:error] [pid 2431893:tid 140554188867328] [client 57.141.6.46:0] AH01630: client denied by server configuration: /var/www/vhosts/livingdownsouth.com/error_docs/forbidden.html, referer: https://properties.livingdownsouth.com/
[Wed Nov 04 06:57:48.083843 2026] [authz_core:error] [pid 2431893:tid 140554717345536] [client 57.141.6.46:0] AH01630: client denied by
...
show less
|
Web App Attack
|
|
🇵🇦
194.165.16.122
|
|
Knock-Knock RDP honeypot activity; time=2026-11-04 11:56:07; username=domain
|
Brute-Force
|
|
🇹🇼
34.81.103.190
|
|
34.81.103.190 - - [04/Nov/2026:06:57:19 -0500] "GET /public../.env HTTP/1.1" 403 4966 "https://weste ...
show more
34.81.103.190 - - [04/Nov/2026:06:57:19 -0500] "GET /public../.env HTTP/1.1" 403 4966 "https://westernupstatemls.com/public../.env" "Mozilla/5.0 (compatible; Meta-WebIndexer/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.81.103.190 - - [04/Nov/2026:06:57:19 -0500] "GET /assets../.env HTTP/1.1" 403 4966 "https://westernupstatemls.com/assets../.env" "Mozilla/5.0 (compatible; Meta-ExternalAgent/1.0; +https://developers.facebook.com/docs/sharing/webmasters/crawler)"
34.81.103.190 - - [04/Nov/2026:06:57:19 -0500] "GET /css../.env HTTP/1.1" 404 61080 "https://westernupstatemls.com/css../.env" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; Claude-User/1.0; [email protected])"
...
show less
|
Web App Attack
|
|
🇺🇸
57.141.6.49
|
|
[Wed Nov 04 06:55:09.595008 2026] [authz_core:error] [pid 2431893:tid 140554750916352] [client 57.14 ...
show more
[Wed Nov 04 06:55:09.595008 2026] [authz_core:error] [pid 2431893:tid 140554750916352] [client 57.141.6.49:0] AH01630: client denied by server configuration: /var/www/vhosts/livingdownsouth.com/error_docs/forbidden.html, referer: https://properties.livingdownsouth.com/
[Wed Nov 04 06:55:09.925522 2026] [authz_core:error] [pid 973888:tid 140555205719808] [client 57.141.6.49:0] AH01630: client denied by server configuration: /var/www/vhosts/livingdownsouth.com/httpdocs/wp-content/themes/livingdownsouth/inc/lib/js/lightslider.min.js, referer: https://properties.livingdownsouth.com/
[Wed Nov 04 06:55:09.925595 2026] [authz_core:error] [pid 973888:tid 140555205719808] [client 57.141.6.49:0] AH01630: client denied by server configuration: /var/www/vhosts/livingdownsouth.com/error_docs/forbidden.html, referer: https://properties.livingdownsouth.com/
[Wed Nov 04 06:56:38.744055 2026] [authz_core:error] [pid 1253684:tid 140554708952832] [client 57.141.6.49:0] AH01630: client denied by server co
...
show less
|
Web App Attack
|
|
🇺🇸
136.87.137.100
|
|
136.87.137.100 - - [04/Nov/2026:06:55:19 -0500] "GET /apps/admin/.env HTTP/1.1" 404 6018 "-" "Mozill ...
show more
136.87.137.100 - - [04/Nov/2026:06:55:19 -0500] "GET /apps/admin/.env HTTP/1.1" 404 6018 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot"
136.87.137.100 - - [04/Nov/2026:06:55:19 -0500] "GET /packages/.env HTTP/1.1" 404 6018 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
136.87.137.100 - - [04/Nov/2026:06:55:19 -0500] "GET /apps/dashboard/.env HTTP/1.1" 404 6018 "-" "Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; OAI-SearchBot/1.0; +https://openai.com/searchbot"
...
show less
|
Web App Attack
|
|
🇷🇴
193.46.255.86
|
|
Knock-Knock SSH honeypot activity; time=2026-11-04 11:19:22; username=probe
|
Brute-Force
SSH
|
|
🇻🇳
103.9.204.35
|
|
Knock-Knock RDP honeypot activity; time=2026-11-04 11:48:24; username=administrator; rdp_workstation ...
show more
Knock-Knock RDP honeypot activity; time=2026-11-04 11:48:24; username=administrator; rdp_workstation=workstation
show less
|
Brute-Force
|
|
🇵🇰
153.117.68.57
|
|
Knock-Knock HTTP honeypot activity; time=2026-11-04 11:48:16; http_method=GET; http_path=/boaform/ad ...
show more
Knock-Knock HTTP honeypot activity; time=2026-11-04 11:48:16; http_method=GET; http_path=/boaform/admin/formLogin?username=user&psd=user; http_purpose=rce; http_exploit=Fiberhome Router RCE (CVE-2021-27973)
show less
|
Web App Attack
|
|
🇺🇸
66.132.195.109
|
|
Knock-Knock HTTP honeypot activity; time=2026-11-04 11:50:12; http_method=GET; http_path=/; http_pur ...
show more
Knock-Knock HTTP honeypot activity; time=2026-11-04 11:50:12; http_method=GET; http_path=/; http_purpose=research_scanner; http_exploit=Censys; http_user_agent=Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)
show less
|
Web App Attack
|
|
🇻🇪
186.92.120.171
|
|
Knock-Knock SMB honeypot activity; time=2026-11-04 11:50:22; smb_action=PROBE; smb_version=SMB1
|
Hacking
Brute-Force
|
|
🇸🇬
109.123.238.248
|
|
Knock-Knock RDP honeypot activity; time=2026-11-04 11:47:44; username=administrator; rdp_workstation ...
show more
Knock-Knock RDP honeypot activity; time=2026-11-04 11:47:44; username=administrator; rdp_workstation=workstation
show less
|
Brute-Force
|
|
🇰🇷
43.133.90.155
|
|
Knock-Knock RDP honeypot activity; time=2026-11-04 11:44:43; username=administrator; rdp_workstation ...
show more
Knock-Knock RDP honeypot activity; time=2026-11-04 11:44:43; username=administrator; rdp_workstation=workstation
show less
|
Brute-Force
|