Server Security Dashboard

Generated at 2026-08-27 08:30:02

Warning: Some paths are not readable:
🛡️ Honeypot Hits (Last 24 Hours)
22
Based on honeypot.log timestamps
👥 Total Honeypot Offenders
250
Distinct IPs in last 500 honeypot lines
🚫 Honeypot Hardkills (Last 24 Hours)
18
Counted by HARDKILL_HIT honeypot events
⚠️ 404 Errors (Last 24 Hours)
0
Based on access log timestamps

Top Honeypot Offenders (by IP)

IPHits
93.123.109.178 15
193.36.225.82 8
77.83.39.94 8
37.140.223.36 7
77.83.39.6 6
172.210.156.226 6
37.140.223.37 6
37.140.223.107 6
193.36.225.79 6
37.140.223.86 6

Top Honeypot URIs

URIHits
/honeypot-trap.php 263
/.env 49
/.git/config 42
/1.php 23
/login 23
/.git/HEAD 15
/api/auth/signin 7
/config.json 6
/api/mcp 5
/developmentserver/metadatauploader 5

Recent Honeypot Events

Date/Time IP URI Reason Event User Agent Extra
2026-08-26 21:14:49 159.223.40.14 /login.php GENERIC_HONEYPOT_HIT SOFT_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 METHOD=GET | REF=-
2026-08-26 19:09:08 77.83.39.6 /.env CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.98 Safari/537.36 METHOD=GET | REF=-
2026-08-26 19:08:05 77.83.39.6 /.env CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Linux; U; Android 6.0; zh-CN; KNT-UL10 Build/HUAWEIKNT-UL10) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/57.0.2987.108 Quark/3.0.2.943 Mobile Safari/537.36 METHOD=GET | REF=-
2026-08-26 18:51:04 172.191.149.99 /1.php BACKDOOR_PROBE HARDKILL_HIT - METHOD=GET | REF=-
2026-08-26 18:40:35 66.132.195.75 /login SENSITIVE_ENDPOINT_PROBE SOFT_HIT Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) METHOD=GET | REF=-
2026-08-26 18:28:13 84.17.60.236 /vendor/ GENERIC_HONEYPOT_HIT HARDKILL_HIT - METHOD=GET | REF=-
2026-08-26 18:28:01 84.17.60.236 /vendor/phpunit/phpunit/src/Util/PHP/ GENERIC_HONEYPOT_HIT HARDKILL_HIT - METHOD=GET | REF=-
2026-08-26 18:27:48 84.17.60.236 /honeypot-trap.php GENERIC_HONEYPOT_HIT HARDKILL_HIT - METHOD=GET | REF=-
2026-08-26 18:02:19 172.71.122.240 /.git/HEAD CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 METHOD=GET | REF=-
2026-08-26 18:02:18 172.71.122.241 /.git/config CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 METHOD=GET | REF=-
2026-08-26 17:51:36 65.49.1.172 /.git/config CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 METHOD=GET | REF=-
2026-08-26 17:45:39 104.23.160.72 /.git/config CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0 METHOD=GET | REF=-
2026-08-26 17:45:37 104.23.160.72 /.git/HEAD CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0 METHOD=GET | REF=-
2026-08-26 17:15:56 195.63.31.48 /remote/login SENSITIVE_ENDPOINT_PROBE SOFT_HIT what-vpn-go/0.1 METHOD=GET | REF=-
2026-08-26 16:45:19 185.242.3.191 /.env CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 METHOD=GET | REF=-
2026-08-26 16:05:11 213.209.159.154 /.env CONFIG_PROBE HARDKILL_HIT Opera/9.80 (Linux mips; ) Presto/2.12.407 Version/12.51 MB97/0.0.39.18 (BUSH, Mxl661L32, wireless) VSTVB_MB97 SmartTvA/3.0.0 METHOD=GET | REF=-
2026-08-26 15:34:31 4.184.149.161 /1.php?p= GENERIC_HONEYPOT_HIT HARDKILL_HIT - METHOD=GET | REF=-
2026-08-26 10:58:27 169.58.234.137 /honeypot-trap.php GENERIC_HONEYPOT_HIT SOFT_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 METHOD=GET | REF=-
2026-08-26 10:08:44 84.17.60.236 /vendor/ GENERIC_HONEYPOT_HIT HARDKILL_HIT - METHOD=GET | REF=-
2026-08-26 10:08:20 84.17.60.236 /vendor/phpunit/phpunit/src/Util/PHP/ GENERIC_HONEYPOT_HIT HARDKILL_HIT - METHOD=GET | REF=-
2026-08-26 10:08:07 84.17.60.236 /honeypot-trap.php GENERIC_HONEYPOT_HIT HARDKILL_HIT - METHOD=GET | REF=-
2026-08-26 09:04:18 34.68.160.176 /.git/config CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 METHOD=GET | REF=-
2026-08-26 07:11:14 216.219.89.86 /.env CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36 METHOD=GET | REF=-
2026-08-26 05:06:59 45.154.244.176 /api/sonicos/ui-info GENERIC_HONEYPOT_HIT SOFT_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36 METHOD=GET | REF=-
2026-08-25 23:50:43 103.59.160.131 /tmp/ GENERIC_HONEYPOT_HIT SOFT_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36 METHOD=GET | REF=https://www.google.com/
2026-08-25 22:34:15 45.148.10.246 /login SENSITIVE_ENDPOINT_PROBE SOFT_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0 METHOD=POST | REF=-
2026-08-25 21:25:40 45.142.193.24 /login SENSITIVE_ENDPOINT_PROBE SOFT_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203 METHOD=GET | REF=-
2026-08-25 21:25:36 45.142.193.24 /remote/login SENSITIVE_ENDPOINT_PROBE SOFT_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203 METHOD=GET | REF=-
2026-08-25 20:49:37 185.93.89.147 /.git/config CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (compatible; GitFinder/1.0) METHOD=GET | REF=-
2026-08-25 20:49:31 185.93.89.147 /.git/config CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (compatible; GitFinder/1.0) METHOD=GET | REF=-
2026-08-25 19:28:51 45.142.193.239 /api/sonicos/is-sslvpn-enabled GENERIC_HONEYPOT_HIT SOFT_HIT Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 METHOD=GET | REF=-
2026-08-25 18:01:42 160.250.129.42 /.env CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 METHOD=GET | REF=-
2026-08-25 17:47:40 65.49.1.142 /.git/config CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/116.0 METHOD=GET | REF=-
2026-08-25 17:33:55 66.132.172.196 /login SENSITIVE_ENDPOINT_PROBE SOFT_HIT Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) METHOD=GET | REF=-
2026-08-25 16:28:29 20.25.136.74 /.env CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Linux; U; Android 4.4.2; en-US; HM NOTE 1W Build/KOT49H) AppleWebKit/534.30 (KHTML, like Gecko) Version/4.0 UCBrowser/11.0.5.850 U3/0.8.0 Mobile Safari/534.30 METHOD=GET | REF=-
2026-08-25 11:19:46 74.207.251.189 /honeypot-trap.php GENERIC_HONEYPOT_HIT SOFT_HIT Mozilla/5.0 (iPhone; CPU iPhone OS 17_5 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Mobile/15E148 Safari/604.1 METHOD=HEAD | REF=http://optimumyouth.com/old/
2026-08-25 11:06:44 91.122.53.173 /.git/HEAD CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 METHOD=GET | REF=-
2026-08-25 10:55:13 94.154.43.84 /.env CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/147.0.0.0 Safari/537.36 METHOD=GET | REF=-
2026-08-25 10:03:03 34.68.149.34 /.git/config CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 METHOD=GET | REF=-
2026-08-25 07:14:23 52.173.121.69 /wp-content/uploads/gravity_forms/b/d/e/g/dfylbgoahqt.php GENERIC_HONEYPOT_HIT HARDKILL_HIT - METHOD=GET | REF=-
2026-08-25 07:14:14 52.173.121.69 /honeypot-trap.php GENERIC_HONEYPOT_HIT HARDKILL_HIT - METHOD=GET | REF=-
2026-08-25 06:10:52 80.94.95.19 /remote/login?lang=en GENERIC_HONEYPOT_HIT SOFT_HIT Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 Chrome/120.0.0.0 Safari/537.36 METHOD=GET | REF=-
2026-08-25 06:07:17 20.151.9.151 /1.php BACKDOOR_PROBE HARDKILL_HIT - METHOD=GET | REF=-
2026-08-25 01:24:11 172.202.122.207 /developmentserver/metadatauploader DEV_METADATA_PROBE HARDKILL_HIT Mozilla/5.0 zgrab/0.x METHOD=GET | REF=-
2026-08-25 00:57:47 162.35.100.166 /remote/login SENSITIVE_ENDPOINT_PROBE SOFT_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36 Edg/115.0.1901.203 METHOD=GET | REF=-
2026-08-24 22:38:48 195.3.220.7 /wp-content/cache/index.php GENERIC_HONEYPOT_HIT SOFT_HIT Mozilla/5.0 (Linux; Android 7.0; SM-G892A Build/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Mobile Safari/537.36 METHOD=GET | REF=-
2026-08-24 22:00:07 168.62.48.100 /wp-content/uploads/gravity_forms/b/d/e/g/dfylbgoahqt.php GENERIC_HONEYPOT_HIT HARDKILL_HIT - METHOD=GET | REF=-
2026-08-24 21:59:55 168.62.48.100 /honeypot-trap.php GENERIC_HONEYPOT_HIT HARDKILL_HIT - METHOD=GET | REF=-
2026-08-24 20:46:19 64.62.156.202 /.git/config CONFIG_PROBE HARDKILL_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/108.0.0.0 Safari/537.36 METHOD=GET | REF=-
2026-08-24 18:52:08 37.140.223.11 /honeypot-trap.php GENERIC_HONEYPOT_HIT SOFT_HIT Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.85 Safari/537.36 METHOD=GET | REF=https://optimumyouth.com/wp-admin/

Honeypot Reason Legend

PHPUNIT_RCE_PROBE Probes for phpunit eval-stdin RCE to execute arbitrary PHP code.
THINKPHP_RCE_PROBE ThinkPHP invokefunction-based RCE scanning.
AUTO_PREPEND_RCE Attempts to use auto_prepend_file=php://input or similar to run injected PHP.
DOCKER_API_PROBE Tries to access Docker Engine API endpoints like /containers/json.
BACKDOOR_PROBE Classic webshells and backdoor files (wso, r57, c99, upl.php, etc.).
CONFIG_PROBE Attempts to read config/secret files like wp-config.php, .git/config, .env.
PATH_TRAVERSAL Directory traversal patterns (../../) aiming to escape the webroot.
DEV_METADATA_PROBE Dev-only endpoints like /developmentserver/metadatauploader.
SMTP_PROBE Probes for mail config files (smtp_config.json, smtp.php, mail_config.php).
SENSITIVE_ENDPOINT_PROBE Scanning login/XML-RPC/wp-admin and similar access points.
SCANNER_PROBE Fingerprinting URIs such as /geoip/ or /wsman.
GENERIC_HONEYPOT_HIT Caught by honeypot, but not mapped to a specific exploit type.

Sensitive Endpoint Traffic (Recent Log Sample)

Monitoring hits to wp-login.php, xmlrpc.php, wp-admin, wp-json, and other high-value URLs from the last 20000 log lines.

IP Address Hits Endpoints First Seen Last Seen UA Samples
216.73.161.175 3 /wp-admin/css/admin.php, /wp-admin/css/goods.php, /wp-admin/css/colors/wp-login.php 2026-08-27 05:31:46 2026-08-27 05:32:05
Go-http-client/1.1
36.255.97.156 1 /xmlrpc.php 2026-08-27 04:31:17 2026-08-27 04:31:17
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
5.39.218.200 1 /wp-login.php 2026-08-27 03:36:53 2026-08-27 03:36:53
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
5.253.84.92 193 /wp-login.php, /wp-json/wp/v2/users, /wp-admin/index.php, /wp-admin/profile.php, /wp-admin/edit.php … 2026-08-27 02:33:53 2026-08-27 02:43:20
Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15
Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
172.191.149.99 2 /admin.php, /adminfuns.php 2026-08-27 01:50:47 2026-08-27 01:50:59
-
84.17.60.236 34 /admin/uploads/, /admin/, /admin/editor/, /wp-admin/css/, /wp-admin/maint/ … 2026-08-26 17:07:58 2026-08-27 01:29:02
-
62.60.130.182 1 /wp-login.php 2026-08-26 19:18:39 2026-08-26 19:18:39
Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36
169.58.234.137 11 /wp-admin/css/, /wp-admin/css/colors/, /wp-admin/css/colors/blue/, /wp-admin/includes/, /wp-admin/maint/ … 2026-08-26 17:56:02 2026-08-26 17:58:20
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
20.63.64.130 3 /admin.php/vaza.php, /wp-admin/js/index.php, /wp-admin/js/ 2026-08-26 16:06:51 2026-08-26 16:06:54
-

Top 404 Offenders (by IP)

IP404 Count

Top 404 URLs

URL404 Count

Recent 404 "Page Not Found" Errors

Date/Time IP Method Reason URL Referrer User Agent

Copy 404 Data for ChatGPT Analysis

Select all (Ctrl+A / Cmd+A) inside this box, copy, and paste into ChatGPT.