🇫🇷
j-tap
2026-10-22 17:14:16
(1 hour ago)
WordPress honeypot: automated scanner (xmlrpc / installer / .env / direct login POST)
Web App Attack
🇵🇱
Budyn
2026-10-21 18:11:18
(1 day ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: login.goblinpot.space | URI: /.env | UA: Mozilla/5.0 (iPhone; CPU iPhone OS 17_4_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4 Mobile/15E148 Safari/604.1 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"RU","Cf-Connecting-Ip":"45.8.88.236","Cdn-Loop":"cloudflare; loops=1","Connection":"Keep-Alive","Cf-Ray":"a4e239567a1b1c85-FRA","Accept":"text\/plain,text\/html,application\/xhtml+xml,applica
show less
Bad Web Bot
Web App Attack
🇬🇧
abivia
2026-10-21 16:18:14
(1 day ago)
Abivia WAF trigger: Rule scriptKiddies: Dot file access. uri: /.env.local
Hacking
🇺🇸
TPI-Abuse
2026-10-21 14:43:10
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 45.8.88.236 (-): 1 in the last 300 secs; Ports: ...
show more
(mod_security) mod_security (id:210492) triggered by 45.8.88.236 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 10:43:04.731546 2026] [security2:error] [pid 22345:tid 22345] [client 45.8.88.236:62706] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "anthonyjoseph.us"] [uri "/.env"] [unique_id "atjPeOjVXEHUmWfcJR121AAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
SentinalX by uzumaru
2026-10-17 05:22:30
(5 days ago)
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was ...
show more
Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: xbadm.ru:443
show less
Open Proxy
Port Scan
🇵🇱
MatStef132
2026-10-09 19:45:14
(1 week ago)
MatShield L7: blocked on fivevault.net (sec-fetch-dest-root-subresource)
DDoS Attack
🇭🇺
Lacika555
2026-10-08 07:40:15
(2 weeks ago)
RdpGuard detected brute-force attempt on SMTP
Brute-Force
🇬🇧
Silly Development
2026-10-05 22:59:58
(2 weeks ago)
Malicious activity detected from 43991 Voronezh Telecom LLC towards host sillydev.co.uk (GET HTTP/2) ...
show more
Malicious activity detected from 43991 Voronezh Telecom LLC towards host sillydev.co.uk (GET HTTP/2) @ 2026-10-05T22:59:58Z (1 occurrences)
show less
DDoS Attack
Exploited Host
🇵🇱
MatStef132
2026-10-05 19:26:43
(2 weeks ago)
MatShield L7: blocked on fivevault.net (sec-fetch-navigate-method)
DDoS Attack
🇨🇿
unhfree.net
2026-10-05 16:43:17
(2 weeks ago)
Oct 5 09:36:07 canopus postfix/smtpd[3489471]: NOQUEUE: reject: RCPT from unknown[45.8.88.236]: 554 ...
show more
Oct 5 09:36:07 canopus postfix/smtpd[3489471]: NOQUEUE: reject: RCPT from unknown[45.8.88.236]: 554 5.7.1 Service unavailable; Client host [45.8.88.236] blocked using zen.spamhaus.org; Listed by XBL, see https://check.spamhaus.org/query/ip/45.8.88.236; from=<[email protected] > to=<[email protected] > proto=ESMTP helo=<45.8.88.236>
Oct 5 13:39:05 canopus postfix/smtpd[3501296]: NOQUEUE: reject: RCPT from unknown[45.8.88.236]: 554 5.7.1 <[email protected] >: Sender address rejected: Access denied; from=<[email protected] > to=<[email protected] > proto=ESMTP helo=<1gf4i695ye5jfdgq8>
Oct 5 13:39:05 canopus postfix/smtpd[3501296]: NOQUEUE: reject: RCPT from unknown[45.8.88.236]: 554 5.7.1 <[email protected] >: Sender address rejected: Access denied; from=<[email protected] > to=<[email protected] > proto=ESMTP helo=<1gf4i695ye5jfdgq8>
Oct 5 14:18:35 canopus postfix/smtpd[3503808]: NOQUEUE: reject: RCPT from unknown[45.8.88.236]: 554 5.7.1 Service unavailable; Client hos
...
show less
Brute-Force
Exploited Host
🇹🇷
neron
2026-10-05 08:30:51
(2 weeks ago)
CrowdSec blocked: local/ssh-bruteforce detected via OPNsense firewall
Hacking
Web App Attack
🇩🇪
edgeshield
2026-10-01 02:53:51
(3 weeks ago)
Automated web request flooding / DDoS (EdgeShield WAF).
DDoS Attack
🇵🇱
MatStef132
2026-09-30 18:07:57
(3 weeks ago)
MatShield L7: blocked on fivevault.net (sec-fetch-dest-root-subresource)
DDoS Attack
🇮🇩
xveil
2026-09-30 15:02:12
(3 weeks ago)
2026-09-30T22:02:10.037563 mail-honeypot postfix/submission/smtpd[6980]: warning: unknown[45.8.88.23 ...
show more
2026-09-30T22:02:10.037563 mail-honeypot postfix/submission/smtpd[6980]: warning: unknown[45.8.88.236]: SASL PLAIN authentication failed: authentication failure
...
show less
Brute-Force
🇺🇸
copyyy
2026-09-23 18:13:03
(4 weeks ago)
Repeated attempts to retrieve environment/configuration files.
Evidence (UTC):
2026-09-23T18:13:02.7 ...
show more
Repeated attempts to retrieve environment/configuration files.
Evidence (UTC):
2026-09-23T18:13:02.775163Z path=/.env
show less
Web App Attack