🇵🇱
MatStef132
2026-10-22 09:57:53
(20 hours ago)
MatShield L7: blocked on fivevault.net (suspicious behaviour)
DDoS Attack
🇳🇴
cyruz
2026-10-22 08:34:07
(21 hours ago)
Email login Brute force
Hacking
Brute-Force
🇳🇱
homeshowdomain.nl
2026-10-21 21:59:58
(1 day ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on ...
show more
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-10-20.
show less
Web App Attack
SSH
Hacking
🇩🇰
powerhostingdk
2026-10-21 16:52:45
(1 day ago)
[mailserver] CrowdSec detected crowdsecurity/postscreen-rbl (1 events). Automated abuse report.
Email Spam
Brute-Force
2026-10-21 16:50:37
(1 day ago)
fail2ban: brute-force/credential spraying against mail (IMAP/POP/webmail) — rmnet.it
Brute-Force
🇵🇱
Budyn
2026-10-21 16:28:02
(1 day ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: docker.teddypot.website | URI: /.env.local | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Edge/125.0.2535.51 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"US","Cf-Connecting-Ip":"52.128.241.106","Cdn-Loop":"cloudflare; loops=1","Connection":"Keep-Alive","Cf-Ray":"a4e1a21168f52ae3-LAX","Accept":"text\/plain,text\/html,application\/xhtml+xml,application\/xml;
show less
Hacking
Web App Attack
🇫🇷
ingroscart.it
2026-10-21 09:52:15
(1 day ago)
(imapd) Failed IMAP login from 52.128.241.106 (US/United States/California/-/-/[redacted])
Brute-Force
🇩🇪
tsZero
2026-10-21 06:19:32
(1 day ago)
Scan example: path=/.env status=302
Hacking
🇳🇱
Alt255
2026-10-21 01:38:09
(2 days ago)
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-24al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 52.128.241.106 - - [21/Oct/2026:03:38:01 +0200] "GET /.env HTTP/1.1" 301 6317 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0"
...
show less
Bad Web Bot
Web App Attack
🇳🇱
homeshowdomain.nl
2026-10-20 21:59:56
(2 days ago)
Auto-ban: >3000 req/min op 2026-10-20
Web App Attack
SSH
Hacking
🇵🇱
Budyn
2026-10-20 21:27:48
(2 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: sql.teddypot.store | URI: /.env | UA: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-20 15:22:19
(2 days ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: status.astropot.site | URI: /.env | UA: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-10-20 15:05:14
(2 days ago)
Abuse Detected (49)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 10:48:49
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 52.128.241.106 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 52.128.241.106 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 06:48:40.347238 2026] [security2:error] [pid 18659:tid 18659] [client 52.128.241.106:31065] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "solar.catking.net"] [uri "/.env.local"] [unique_id "atdHCN5sLYnkdbIOt55BKwAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇴
clauss
2026-10-20 04:28:29
(3 days ago)
IP reached maximum auth failures for a one day block
Brute-Force