🇨🇭
TheCoon
2026-10-21 07:04:10
(2 days ago)
Automated: Credential theft attempt - JSON bomb served
Web App Attack
Hacking
🇵🇱
Budyn
2026-10-10 13:33:58
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: gitlab.budyn.top | URI: /.env | UA: Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇳🇱
Alt255
2026-10-10 12:34:26
(1 week ago)
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Exam ...
show more
[ti-17al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 91.92.41.115 - - [10/Oct/2026:14:34:25 +0200] "GET /.env HTTP/1.1" 301 574 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
...
show less
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-10-10 11:19:46
(1 week ago)
[10/Oct/2026:14:19:45 +0300] -- 91.92.41.115 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /. ...
show more
[10/Oct/2026:14:19:45 +0300] -- 91.92.41.115 Ban reason: Scanner [SENSITIVE_FILES] | Request: GET /.env HTTP/1.1
show less
Bad Web Bot
Web App Attack
🇩🇪
Klompenzijncool
2026-10-10 11:03:47
(1 week ago)
Web scanning/probing blocked by Fail2Ban.
Port Scan
Bad Web Bot
🇺🇸
nationaleventpros.com
2026-10-10 10:36:19
(1 week ago)
vulnerability scan
Web App Attack
🇺🇸
TPI-Abuse
2026-10-10 09:56:54
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 91.92.41.115 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 91.92.41.115 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 10 05:56:49.416782 2026] [security2:error] [pid 13564:tid 13564] [client 91.92.41.115:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.thectegroup.net"] [uri "/.env"] [unique_id "asoL4fj25a3xU0f0p-GVZgAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
on-com
2026-10-10 09:35:12
(1 week ago)
URL scan
Brute-Force
Web App Attack
🇵🇱
Budyn
2026-10-10 09:13:20
(1 week ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scan ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: Enterprise & Framework Recon Scanner. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: gitlab.astropot.online | URI: /.env | UA: Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 | BODY: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇬🇧
gurnip
2026-10-10 08:41:40
(1 week ago)
Vulnerability probe of page /.env, not found on server.
Brute-Force
Web App Attack
🇵🇱
srebrakowski.com
2026-10-10 08:14:41
(1 week ago)
crowdsec/crowdsecurity/appsec-vpatch
Brute-Force
🇩🇪
ecs.ge
2026-10-10 08:10:24
(1 week ago)
Automatic Fail2Ban report from jail plesk-modsecurity: multiple matching events detected.
Web App Attack
Hacking
🇩🇪
maxpower
2026-10-10 06:47:05
(1 week ago)
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 91.92.41.115 (BG/Bulgaria/-): 1 in the l ...
show more
(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 91.92.41.115 (BG/Bulgaria/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 91.92.41.115 - - [10/Oct/2026:08:47:00 +0200] "GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/2.0" 403 146 "-" "python-requests/2.34.2" "91.92.41.115" host=notaiopanella.it
show less
Port Scan
2026-10-10 05:05:34
(1 week ago)
(mod_security) mod_security triggered on hostname [redacted] 91.92.41.115 (BG/Bulgaria/-)
SQL Injection
🇩🇪
Gwyneth Llewelyn
2026-10-10 04:11:39
(1 week ago)
2026/10/10 05:11:37 [error] 4060693#4060693: *1676646 access forbidden by rule, client: 91.92.41.115 ...
show more
2026/10/10 05:11:37 [error] 4060693#4060693: *1676646 access forbidden by rule, client: 91.92.41.115, server: betatechnologies.info, request: "GET /.env HTTP/1.1", host: "freeswitch.betatechnologies.info"
91.92.41.115 - - [10/Oct/2026:05:11:36 +0100] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
91.92.41.115 - - [10/Oct/2026:05:11:37 +0100] "GET /.env HTTP/1.1" 403 1178 "-" "Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30"
show less
Brute-Force
Web App Attack