XCOM Honeypot — Attack Map 2026

Campaigns

C1 — Rotterdam curl kill-chain · 178.230.108.215 · AS31615

346 alerts in one 2.5h session (Mar 14). Escalating credential stuffing 5→7→15→19→23, 11× POST /api/login with captured creds, 26 distinct secret paths, tools curl/nuclei/python-requests. All 14 canary Bearer-token replays in the export trace to this IP.

C2 — Hong Kong gambling-app API hunters · AS135377

306 alerts in 26 min (May 10), 5 rotating IPs, POSTs to /join_room, /instatll, /biz/server/config, /relayApi/api/notice/site_setting + storefront dirs /wap /h5 /im /vip. Mobile UAs, accept-language: zh. Typosquatted routes suggest a leaked platform SDK route list.

C3 — KPN IPv6 residential actor · 2001:1c00:7b03:9800::/64 · AS33915

Recurring Aug 12 → Sep 6 over 4 rotating IPv6 hosts. sqlmap/1.8, curl/8.14.1, LLM-bait probing (/api/tags, /v1/chat/completions). Fired the AWS credential canary ×3 — signed real SigV4 sts/s3 requests with decoy /.env keys (Aug 27).

C4 — Azure WordPress-shell hunters · AS8075

US/BR/CA IPs sweeping for pre-dropped shells: /3PJcpMFsD8B.php, /bthil.php, /bc.php, /mifta.php, /wp-admin/css/bolt.php, /.well-known/about.php. Indication the honeypot sits on a compromised-host candidate list.

C5 — French /login/ bruteforcer · 179.61.227.59 · AS399486

73 alerts, all POST /login/ with credentials captured, across 6 days over 3 months. Slow, patient, Chrome/141 UA.

C6 — Google Cloud env-hunters · AS396982

Low-and-slow /.env harvesting from GCP FR; GPTBot UA fetching /.git/config from AS399244 — AI-recon infrastructure.

ASNs

ASN	alerts
AS31615 — Ziggo NL	346
AS135377 — UCLOUD HK	306
AS33915 — KPN NL	~280
AS14061	86
AS8075	80
AS396982	68
AS48090	42
AS219502	15
AS16509	14
AS33915	13
AS398324	13
AS41608	11
AS214472	11
AS14618	9
AS398722	8

Countries

CC	alerts
US	184
NL	126
DE	46
FR	26
SG	24
HK	22
CA	22
TR	13
ID	12
CH	10
BR	9
SE	9
GB	8
IT	8
RO	6

Top 40 attacker profiles

IP	Geo/ASN	alerts	exploit	creds	canary	max score	top paths	window	UA
178.230.108.215	NL AS31615	346	11	11	14	100	/.env ×63 /api/login ×36 /login ×22 /.git/config ×17	2026-03-14 → 2026-03-14 1 day(s)	curl/8.18.0…
2001:1c00:7b03:9800:2cc1:feb7:5f74:d6f3	NL AS33915	251	18	4		100	/api/tags ×12 /api/v1/chat/completions ×11 /login ×9 /.env ×9	2026-08-12 → 2026-09-06 4 day(s)	curl/8.14.1…
62.163.145.88	NL AS33915	106	16	2		100	/ ×63 /nmaplowercheck1784616882 ×4 /sdk ×4 /robots.txt ×4	2026-04-16 → 2026-07-21 4 day(s)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/…
179.61.227.59	FR AS399486	73	69	69		100	/login/ ×73	2026-05-07 → 2026-08-14 6 day(s)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36…
176.65.132.42	NL AS51396	70	2	1		100	/.env ×4 / ×2 /.git/config ×2 /login/ ×1	2026-05-07 → 2026-05-09 3 day(s)	python-requests/2.33.1…
5.255.122.197	NL AS60404	64	0			75	/ ×1	2026-06-07 → 2026-06-07 1 day(s)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/…
195.178.110.159	NL AS48090	61	0			64	/.env ×8 /.env.backup ×8 /.git/HEAD ×5 /.git/config ×4	2026-07-08 → 2026-09-05 10 day(s)	Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l…
165.154.42.86	HK AS135377	55	5			90	/join_room ×2 /login ×1 /homes/ ×1 /html/ ×1	2026-05-10 → 2026-05-10 1 day(s)	Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) Apple…
130.49.215.90	PL AS212835	54	0			40	/ ×39 /login ×13 /wp-login.php ×1 /wp-admin/ ×1	2026-09-02 → 2026-09-02 1 day(s)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36…
88.151.33.237	NL AS41608	51	0			75	/boaform/admin/formLogin ×1 /dist/.vite/manifest.json ×1 /phpinfo.php ×1	2026-05-22 → 2026-05-22 1 day(s)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36…
2.57.122.13	RO AS47890	48	0			75	/.git/ ×2 /.git/objects/info/packs ×2 /.git/config ×2 /.git/index ×1	2026-03-30 → 2026-03-30 1 day(s)	Go-http-client/1.1…
154.58.229.12	US AS400810	48	1			90	/graphql ×2 /.git/config ×1 /swagger.json ×1 /actuator/heapdump ×1	2026-08-11 → 2026-08-29 2 day(s)	Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.…
152.32.170.40	HK AS135377	44	0			75	/7/ ×1	2026-05-10 → 2026-05-10 1 day(s)	Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) Apple…
66.187.5.228	US AS399804	44	1			90	/.env ×1 /openapi.json ×1 /server.log ×1 /_profiler/open_file ×1	2026-08-27 → 2026-08-27 1 day(s)	Mozilla/5.0 (compatible; Applebot/0.1; +http://www.apple.com…
165.154.24.162	HK AS135377	43	4			90	/join_room ×2 /api ×1 /mms-api/coins/hot/tickers ×1 /site/api/v1/site/vipExclusiveDomain/getGuestDomain ×1	2026-05-10 → 2026-05-10 1 day(s)	Mozilla/5.0 (Android 10; Mobile; rv:128.2.0) Gecko/128.2.0 F…
2607:ff68:7:6f:258:7bff:fe73:c43f	US AS46475	42	0			75	/.git/config ×5 / ×1	2026-05-29 → 2026-06-21 6 day(s)	Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deeps…
34.125.139.41	US AS396982	42	0			40	/.env ×8 /@fs/..%252f..%252f..%252f..%252f..%252froot/.env ×2 /@fs/..%252f..%252f..%252f..%252f..%252fapp/.env ×2 /@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ ×2	2026-09-03 → 2026-09-03 1 day(s)	Mozilla/5.0 (Macintosh; Intel Mac OS X 15_0) AppleWebKit/605…
165.154.64.24	HK AS135377	41	4			90	/join_room ×2 /relayApi/api/notice/site_setting ×2 /7/ ×1	2026-05-10 → 2026-05-10 1 day(s)	Mozilla/5.0 (Linux; Android 8; SM-G950F; Build/OPM2.230204.1…
91.148.245.81	NL AS34343	38	2			90	/ ×8 /storage/logs/laravel.log ×1 /.ssh/id_ed25519 ×1 /backup.zip ×1	2026-07-04 → 2026-07-05 2 day(s)	Go-http-client/1.1…
5.255.126.112	NL AS60404	37	0			75	/boaform/admin/formLogin ×1 /.ssh/id_ed25519 ×1	2026-05-07 → 2026-05-07 1 day(s)	Mozilla/5.0 (Macintosh; Intel Mac OS X 14.7; rv:133.0) Gecko…
165.154.64.7	HK AS135377	37	0			75	/vip/ ×1 /wap ×1 /pc/ ×1	2026-05-10 → 2026-05-10 1 day(s)	Mozilla/5.0 (Linux; Android 8; SM-G9308; Build/OPR1.220624.1…
195.178.110.103	NL AS48090	37	30			90	/wp/index.php ×7 /wp/ ×6 / ×5 /wp/wp-json/batch/v1 ×4	2026-09-03 → 2026-09-03 1 day(s)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36…
45.45.237.77	US AS400529	34	0			50	/.git/config ×3 /.env ×3 /.env.local ×3 /.env.production ×3	2026-09-03 → 2026-09-07 3 day(s)	CCBot/2.0 (https://commoncrawl.org/faq/)…
165.154.63.58	HK AS135377	33	4			90	/join_room ×2 /index/login ×1 /a/ ×1 /biz/server/config ×1	2026-05-10 → 2026-05-10 1 day(s)	Mozilla/5.0 (Android 15; Mobile; rv:115.0.1) Gecko/115.0.1 F…
91.148.244.131	NL AS34343	33	1			90	/ ×3 /database.sql ×1 /.ssh/id_ecdsa ×1 /storage/logs/laravel.log ×1	2026-07-09 → 2026-07-09 1 day(s)	Go-http-client/1.1…
64.227.70.2	NL AS14061	32	9			90	/server-status ×5 /graphql ×3 /api ×3 /graphql/api ×3	2026-06-15 → 2026-09-01 4 day(s)	Mozilla/5.0 (l9scan/2.0.33e27393e2431313e2838313; +https://l…
146.70.189.123	IE AS9009	32	8	5		100	/cpanel ×7 /login/ ×5 /.env ×3 /adminer.php ×2	2026-07-02 → 2026-07-02 1 day(s)	Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36…
45.148.10.120	NL AS48090	30	0			50	/.git/config ×15 /pms ×1 /.env ×1	2026-05-07 → 2026-08-24 12 day(s)	python-requests/2.34.2…
5.255.122.176	NL AS60404	30	0			75	/.env ×1	2026-05-21 → 2026-05-21 1 day(s)	Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) Apple…
81.171.72.135	NL AS34343	29	1			90	/ ×4 /storage/logs/laravel.log ×1 /dump.sql ×1 /wp-admin/setup-config.php ×1	2026-09-01 → 2026-09-01 1 day(s)	Go-http-client/1.1…
23.234.81.93	US AS11878	29	1	1		100	/.env ×7 /login ×7 / ×4 /login/otp ×3	2026-09-06 → 2026-09-07 2 day(s)	curl/8.7.1…
34.124.209.182	SG AS396982	28	0			75	/.git/config ×1	2026-06-15 → 2026-06-15 1 day(s)	Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20120724 Debi…
165.154.23.117	HK AS135377	27	4			90	/join_room ×2 /wap/ ×1 /1/1 ×1 /imei/ ×1	2026-05-10 → 2026-05-10 1 day(s)	Mozilla/5.0 (Android 8; Mobile; rv:129.0.0) Gecko/129.0.0 Fi…
5.255.124.153	NL AS60404	27	0			75	/dist/.vite/manifest.json ×1	2026-05-13 → 2026-05-13 1 day(s)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/…
38.248.95.248	US AS46475	27	0			75	/.git/config ×2	2026-06-22 → 2026-06-28 2 day(s)	CCBot/2.0 (https://commoncrawl.org/faq/)…
45.249.246.240	HK AS135377	26	4			90	/join_room ×2 /wap ×1 /xy/ ×1 /h5/ ×1	2026-05-10 → 2026-05-10 1 day(s)	Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) Apple…
159.89.127.165	CA AS14061	24	3			90	/server-status ×3 /v2/_catalog ×2 /.env ×2 /config.json ×2	2026-07-23 → 2026-09-02 2 day(s)	Mozilla/5.0 (l9scan/2.0.33e27393e2431313e2838313; +https://l…
154.58.229.20	US AS400810	24	1			90	/.well-known/security.txt ×1 /graphql ×1	2026-07-25 → 2026-07-25 1 day(s)	Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatibl…
68.155.159.216	MX AS8075	23	0			90	/wp-admin/about.php ×1 /NewFile.php/ ×1 /wp-content/uploads/makeasmtp.php ×1 /1.php ×1	2026-08-30 → 2026-08-30 1 day(s)	unknown…
43.225.189.141	US AS203020	23	8	1		100	/.env ×4 / ×3 /.git/config ×1 /openid_connect/cpanelid ×1	2026-08-30 → 2026-08-30 1 day(s)	Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/…

Geo/ASN

alerts

exploit

creds

canary

max score

top paths

window

178.230.108.215

NL
AS31615

346

100

/.env ×63
/api/login ×36
/login ×22
/.git/config ×17

2026-03-14 → 2026-03-14
1 day(s)

curl/8.18.0…

2001:1c00:7b03:9800:2cc1:feb7:5f74:d6f3

NL
AS33915

251

100

/api/tags ×12
/api/v1/chat/completions ×11
/login ×9
/.env ×9

2026-08-12 → 2026-09-06
4 day(s)

curl/8.14.1…

62.163.145.88

NL
AS33915

106

100

/ ×63
/nmaplowercheck1784616882 ×4
/sdk ×4
/robots.txt ×4

2026-04-16 → 2026-07-21
4 day(s)

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/…

179.61.227.59

FR
AS399486

100

/login/ ×73

2026-05-07 → 2026-08-14
6 day(s)

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36…

176.65.132.42

NL
AS51396

100

/.env ×4
/ ×2
/.git/config ×2
/login/ ×1

2026-05-07 → 2026-05-09
3 day(s)

python-requests/2.33.1…

5.255.122.197

NL
AS60404

/ ×1

2026-06-07 → 2026-06-07
1 day(s)

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/…

195.178.110.159

NL
AS48090

/.env ×8
/.env.backup ×8
/.git/HEAD ×5
/.git/config ×4

2026-07-08 → 2026-09-05
10 day(s)

Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, l…

165.154.42.86

HK
AS135377

/join_room ×2
/login ×1
/homes/ ×1
/html/ ×1

2026-05-10 → 2026-05-10
1 day(s)

Mozilla/5.0 (iPhone; CPU iPhone OS 18_1 like Mac OS X) Apple…

130.49.215.90

PL
AS212835

/ ×39
/login ×13
/wp-login.php ×1
/wp-admin/ ×1

2026-09-02 → 2026-09-02
1 day(s)

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36…

88.151.33.237

NL
AS41608

/boaform/admin/formLogin ×1
/dist/.vite/manifest.json ×1
/phpinfo.php ×1

2026-05-22 → 2026-05-22
1 day(s)

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36…

2.57.122.13

RO
AS47890

/.git/ ×2
/.git/objects/info/packs ×2
/.git/config ×2
/.git/index ×1

2026-03-30 → 2026-03-30
1 day(s)

Go-http-client/1.1…

154.58.229.12

US
AS400810

/graphql ×2
/.git/config ×1
/swagger.json ×1
/actuator/heapdump ×1

2026-08-11 → 2026-08-29
2 day(s)

Mozilla/5.0 (compatible; Baiduspider/2.0; +http://www.baidu.…

152.32.170.40

HK
AS135377

/7/ ×1

2026-05-10 → 2026-05-10
1 day(s)

Mozilla/5.0 (iPhone; CPU iPhone OS 17_4 like Mac OS X) Apple…

66.187.5.228

US
AS399804

/.env ×1
/openapi.json ×1
/server.log ×1
/_profiler/open_file ×1

2026-08-27 → 2026-08-27
1 day(s)

Mozilla/5.0 (compatible; Applebot/0.1; +http://www.apple.com…

165.154.24.162

HK
AS135377

/join_room ×2
/api ×1
/mms-api/coins/hot/tickers ×1
/site/api/v1/site/vipExclusiveDomain/getGuestDomain ×1

2026-05-10 → 2026-05-10
1 day(s)

Mozilla/5.0 (Android 10; Mobile; rv:128.2.0) Gecko/128.2.0 F…

2607:ff68:7:6f:258:7bff:fe73:c43f

US
AS46475

/.git/config ×5
/ ×1

2026-05-29 → 2026-06-21
6 day(s)

Mozilla/5.0 (compatible; DeepSeekBot/1.0; +https://www.deeps…

34.125.139.41

US
AS396982

/.env ×8
/@fs/..%252f..%252f..%252f..%252f..%252froot/.env ×2
/@fs/..%252f..%252f..%252f..%252f..%252fapp/.env ×2
/@fs/..%252f..%252f..%252f..%252f..%252fproc/self/environ ×2

2026-09-03 → 2026-09-03
1 day(s)

Mozilla/5.0 (Macintosh; Intel Mac OS X 15_0) AppleWebKit/605…

165.154.64.24

HK
AS135377

/join_room ×2
/relayApi/api/notice/site_setting ×2
/7/ ×1

2026-05-10 → 2026-05-10
1 day(s)

Mozilla/5.0 (Linux; Android 8; SM-G950F; Build/OPM2.230204.1…

91.148.245.81

NL
AS34343

/ ×8
/storage/logs/laravel.log ×1
/.ssh/id_ed25519 ×1
/backup.zip ×1

2026-07-04 → 2026-07-05
2 day(s)

Go-http-client/1.1…

5.255.126.112

NL
AS60404

/boaform/admin/formLogin ×1
/.ssh/id_ed25519 ×1

2026-05-07 → 2026-05-07
1 day(s)

Mozilla/5.0 (Macintosh; Intel Mac OS X 14.7; rv:133.0) Gecko…

165.154.64.7

HK
AS135377

/vip/ ×1
/wap ×1
/pc/ ×1

2026-05-10 → 2026-05-10
1 day(s)

Mozilla/5.0 (Linux; Android 8; SM-G9308; Build/OPR1.220624.1…

195.178.110.103

NL
AS48090

/wp/index.php ×7
/wp/ ×6
/ ×5
/wp/wp-json/batch/v1 ×4

2026-09-03 → 2026-09-03
1 day(s)

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36…

45.45.237.77

US
AS400529

/.git/config ×3
/.env ×3
/.env.local ×3
/.env.production ×3

2026-09-03 → 2026-09-07
3 day(s)

CCBot/2.0 (https://commoncrawl.org/faq/)…

165.154.63.58

HK
AS135377

/join_room ×2
/index/login ×1
/a/ ×1
/biz/server/config ×1

2026-05-10 → 2026-05-10
1 day(s)

Mozilla/5.0 (Android 15; Mobile; rv:115.0.1) Gecko/115.0.1 F…

91.148.244.131

NL
AS34343

/ ×3
/database.sql ×1
/.ssh/id_ecdsa ×1
/storage/logs/laravel.log ×1

2026-07-09 → 2026-07-09
1 day(s)

Go-http-client/1.1…

64.227.70.2

NL
AS14061

/server-status ×5
/graphql ×3
/api ×3
/graphql/api ×3

2026-06-15 → 2026-09-01
4 day(s)

Mozilla/5.0 (l9scan/2.0.33e27393e2431313e2838313; +https://l…

146.70.189.123

IE
AS9009

100

/cpanel ×7
/login/ ×5
/.env ×3
/adminer.php ×2

2026-07-02 → 2026-07-02
1 day(s)

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36…

45.148.10.120

NL
AS48090

/.git/config ×15
/pms ×1
/.env ×1

2026-05-07 → 2026-08-24
12 day(s)

python-requests/2.34.2…

5.255.122.176

NL
AS60404

/.env ×1

2026-05-21 → 2026-05-21
1 day(s)

Mozilla/5.0 (iPhone; CPU iPhone OS 18_4 like Mac OS X) Apple…

81.171.72.135

NL
AS34343

/ ×4
/storage/logs/laravel.log ×1
/dump.sql ×1
/wp-admin/setup-config.php ×1

2026-09-01 → 2026-09-01
1 day(s)

Go-http-client/1.1…

23.234.81.93

US
AS11878

100

/.env ×7
/login ×7
/ ×4
/login/otp ×3

2026-09-06 → 2026-09-07
2 day(s)

curl/8.7.1…

34.124.209.182

SG
AS396982

/.git/config ×1

2026-06-15 → 2026-06-15
1 day(s)

Mozilla/5.0 (X11; Linux x86_64; rv:15.0) Gecko/20120724 Debi…

165.154.23.117

HK
AS135377

/join_room ×2
/wap/ ×1
/1/1 ×1
/imei/ ×1

2026-05-10 → 2026-05-10
1 day(s)

Mozilla/5.0 (Android 8; Mobile; rv:129.0.0) Gecko/129.0.0 Fi…

5.255.124.153

NL
AS60404

/dist/.vite/manifest.json ×1

2026-05-13 → 2026-05-13
1 day(s)

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/…

38.248.95.248

US
AS46475

/.git/config ×2

2026-06-22 → 2026-06-28
2 day(s)

CCBot/2.0 (https://commoncrawl.org/faq/)…

45.249.246.240

HK
AS135377

/join_room ×2
/wap ×1
/xy/ ×1
/h5/ ×1

2026-05-10 → 2026-05-10
1 day(s)

Mozilla/5.0 (iPhone; CPU iPhone OS 17_2 like Mac OS X) Apple…

159.89.127.165

CA
AS14061

/server-status ×3
/v2/_catalog ×2
/.env ×2
/config.json ×2

2026-07-23 → 2026-09-02
2 day(s)

Mozilla/5.0 (l9scan/2.0.33e27393e2431313e2838313; +https://l…

154.58.229.20

US
AS400810

/.well-known/security.txt ×1
/graphql ×1

2026-07-25 → 2026-07-25
1 day(s)

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatibl…

68.155.159.216

MX
AS8075

/wp-admin/about.php ×1
/NewFile.php/ ×1
/wp-content/uploads/makeasmtp.php ×1
/1.php ×1

2026-08-30 → 2026-08-30
1 day(s)

unknown…

43.225.189.141

US
AS203020

100

/.env ×4
/ ×3
/.git/config ×1
/openid_connect/cpanelid ×1

2026-08-30 → 2026-08-30
1 day(s)

Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/…

Target map — most requested paths

path	hits	rel.
/	423	100
/.env	361	100
/.git/config	199	55
/graphql	129	35
/login/	95	26
/api	95	26
/server-status	94	26
/graphql/api	94	26
/login	55	15
/.vscode/sftp.json	44	12
/.env.production	43	11
/config.json	38	10
/info.php	37	10
/api/login	36	9
/.env.backup	36	9
/phpinfo.php	33	9
/.env.local	32	8
/v1/graphql	29	8
/swagger.json	25	6
/backup.zip	24	6
/debug/default/view	24	6
/this_is_a_new_hello_world.php	21	5
/.git/HEAD	20	5
/wp-login.php	19	5
/.htpasswd	18	4
/v2/_catalog	18	4
/telescope/requests	18	4
/wp-config.php	16	4
/actuator/env	16	4
/database.yml	14	3

Tooling

Unknown1139 curl280 Go/Scanner215 sqlmap123 Nmap NSE86 python-requests85 Censys21 httpx14 CommonCrawl12 Nuclei8 python-urllib3 aiohttp3

Named scanner UAs

nuclei/2.9.01 nuclei/3.01 nuclei/3.1.01 Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about…1 Mozilla/5.0 (l9scan/2.0.33e27393e2431313e2838313; +https:/…1 Mozilla/5.0 (compatible; GitFinder/1.0)1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compati…1 Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compati…1 nuclei - ProjectDiscovery Nuclei1 masscan/1.3 (https://github.com/robertdavidgraham/masscan)1 masscan/1.31 Nuclei - Open-source project (github.com/projectdiscovery/…1 sqlmap/1.8#stable (http://sqlmap.org)1 Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.3…1 sqlmap/1.51

Threat labels

XSS1 RCE40

Injection probes

traversal27 XSS2 SQLi1

HTTP methods

POST846 HEAD53 GET1951 OPTIONS27

Canary tokens

Bearer hp_deadbeef…14

Severity mix — CRITICAL 673 · HIGH 1622 · MEDIUM 154 · LOW 221.

Daily waves (days with ≥8 alerts)

day	alerts
2026-03-14	350
2026-03-15	19
2026-03-20	14
2026-03-21	14
2026-03-30	52
2026-04-16	12
2026-04-17	13
2026-04-19	17
2026-04-26	18
2026-04-30	19
2026-05-02	30
2026-05-06	16
2026-05-07	60
2026-05-08	16
2026-05-09	80
2026-05-10	310
2026-05-12	11
2026-05-13	28
2026-05-15	27
2026-05-16	15
2026-05-20	8
2026-05-21	71
2026-05-22	58
2026-05-23	35
2026-05-24	31
2026-05-27	16
2026-05-28	10
2026-05-29	21
2026-05-30	22
2026-05-31	11
2026-06-01	24
2026-06-02	8
2026-06-03	15
2026-06-07	67
2026-06-08	12
2026-06-09	25
2026-06-10	9
2026-06-11	8
2026-06-15	47
2026-06-16	14
2026-06-17	12
2026-06-22	17
2026-06-23	25
2026-06-25	13
2026-06-26	10
2026-06-27	37
2026-06-28	21
2026-06-29	20
2026-06-30	38
2026-07-01	24
2026-07-02	44
2026-07-04	49
2026-07-05	23
2026-07-06	20
2026-07-08	12
2026-07-09	54
2026-07-11	8
2026-07-13	8
2026-07-15	26
2026-07-16	10
2026-07-19	17
2026-07-20	14
2026-07-21	124
2026-07-22	35
2026-07-23	29
2026-07-24	21
2026-07-25	34
2026-07-26	14
2026-07-27	27
2026-07-28	11
2026-07-29	14
2026-07-30	27
2026-07-31	10
2026-08-01	30
2026-08-02	16
2026-08-03	10
2026-08-04	42
2026-08-05	23
2026-08-06	19
2026-08-07	25
2026-08-08	11
2026-08-09	22
2026-08-10	11
2026-08-11	100
2026-08-12	62
2026-08-13	23
2026-08-14	30
2026-08-15	20
2026-08-16	38
2026-08-17	10
2026-08-18	12
2026-08-19	8
2026-08-20	25
2026-08-21	20
2026-08-22	35
2026-08-23	52
2026-08-24	20
2026-08-26	27
2026-08-27	282
2026-08-28	43
2026-08-29	64
2026-08-30	87
2026-08-31	45
2026-09-01	98
2026-09-02	155
2026-09-03	159
2026-09-04	96
2026-09-05	53
2026-09-06	97
2026-09-07	55

day

alerts

2026-03-14

350

2026-03-15

2026-03-20

2026-03-21

2026-03-30

2026-04-16

2026-04-17

2026-04-19

2026-04-26

2026-04-30

2026-05-02

2026-05-06

2026-05-07

2026-05-08

2026-05-09

2026-05-10

310

2026-05-12

2026-05-13

2026-05-15

2026-05-16

2026-05-20

2026-05-21

2026-05-22

2026-05-23

2026-05-24

2026-05-27

2026-05-28

2026-05-29

2026-05-30

2026-05-31

2026-06-01

2026-06-02

2026-06-03

2026-06-07

2026-06-08

2026-06-09

2026-06-10

2026-06-11

2026-06-15

2026-06-16

2026-06-17

2026-06-22

2026-06-23

2026-06-25

2026-06-26

2026-06-27

2026-06-28

2026-06-29

2026-06-30

2026-07-01

2026-07-02

2026-07-04

2026-07-05

2026-07-06

2026-07-08

2026-07-09

2026-07-11

2026-07-13

2026-07-15

2026-07-16

2026-07-19

2026-07-20

2026-07-21

124

2026-07-22

2026-07-23

2026-07-24

2026-07-25

2026-07-26

2026-07-27

2026-07-28

2026-07-29

2026-07-30

2026-07-31

2026-08-01

2026-08-02

2026-08-03

2026-08-04

2026-08-05

2026-08-06

2026-08-07

2026-08-08

2026-08-09

2026-08-10

2026-08-11

100

2026-08-12

2026-08-13

2026-08-14

2026-08-15

2026-08-16

2026-08-17

2026-08-18

2026-08-19

2026-08-20

2026-08-21

2026-08-22

2026-08-23

2026-08-24

2026-08-26

2026-08-27

282

2026-08-28

2026-08-29

2026-08-30

2026-08-31

2026-09-01

2026-09-02

155

2026-09-03

159

2026-09-04

2026-09-05

2026-09-06

2026-09-07

🛡️ XCOM Honeypot — Attack MapTelegram export ChatExport_2026-09-07 · 2026-03-14 → 2026-09-07 · sensor xcom-admin-honeypot (admin.xcom.dev)

Campaigns

C1 — Rotterdam curl kill-chain · 178.230.108.215 · AS31615

C2 — Hong Kong gambling-app API hunters · AS135377

C3 — KPN IPv6 residential actor · 2001:1c00:7b03:9800::/64 · AS33915

C4 — Azure WordPress-shell hunters · AS8075

C5 — French /login/ bruteforcer · 179.61.227.59 · AS399486

C6 — Google Cloud env-hunters · AS396982

Top attacking infrastructure

ASNs

Countries

Top 40 attacker profiles

Target map — most requested paths

Tooling

Named scanner UAs

Threat labels

Injection probes

HTTP methods

Canary tokens

Daily waves (days with ≥8 alerts)