cyberzone.hu
6 406
unsolicited attempts in the last 24 hours, over SSH and on empty parked pages like this one
- One arrives every 13 seconds on average.
- The fastest scanner fired 176 requests in a single second.
- 61% of web scanners pretend to be an ordinary browser.
- At this rate that is roughly 2 338 000 attempts a year (projected from today).
This domain got its certificate at 2026-10-18 15:15. The first scanner showed up 58 minutes later. 47 204 attempts have targeted cyberzone.hu by name since.
-24hpeak: 6 590/hnow
- SSH login attempts
- 0
- web scanning
- 5 448
- knocks on the fake SSH (port 22)
- 958
- IPs banned right now
- 7
IF CROWDSEC WERE GUARDING IT
- attacks this site got today
- 6 406
- what it would have got behind a properly configured CrowdSec
- 1 096
- blocked by it
- 5 310 (83%)
- the community blocklist on its own
- 279 (4%)
- the WAF (AppSec) on its own, web requests
- 647
- attacking IPs it would have stopped at least once, of today's 386
- 122
- blocklisted IPs among today's 386 attackers
- 38
A second, watch-only CrowdSec looks at this site with the same rules but bans nothing. An attempt counts as blocked only if its IP would already have been banned at that moment: 5 047 through its own detections here, 0 because it was already banned on our real sites, 162 through the community blocklist. The attempts that trigger a detection still get through, as they would for real. 56% of the attempts come from the 10 busiest IPs, so the blocked share mostly depends on them; the per-attacker count is the fairer picture.
+ 101 requests from search and AI crawlers (Google, Bing, Claude...), not counted as attacks.
Of these, 117 IPs belong to known research or internet-survey scanners (Driftnet, Censys, Stretchoid, ONYPHE, LeakIX): they scan everyone and publish what they find. The rest are unsolicited and unknown.
THE PORT 22 TRAP
There is no real SSH on port 22, only a trap that never lets anyone in and sends a meaningless line every ten seconds to keep the bot waiting. 958 connections came in today, and the bots spent 34.4 hours stuck in total. The longest waited 18 minutes.
what they used:
no name given (404) Go (251) AsyncSSH (190) libssh (62) PuTTY (38)
PHP2SHELL (CVE-2026-109618, CVE-2026-109619)
A critical PHP flaw made public on 21 October 2026: a specially shaped file upload runs code on any PHP site. There is no PHP on this server, but a trap inspects every upload and recognises when someone tries this.
- PHP2Shell attempts today
- 0
- from distinct IPs
- 0
- in total since the trap went up
- 8
- other upload attempts today
- 75
As bait, a fake phpinfo page shows a vulnerable PHP version. Today it was opened 133 times from 27 IPs; 3 of them then tried an upload, 0 with PHP2Shell specifically.
The first attempt arrived at 10-22 10:13, 18.7 hours after disclosure.
TELNET (IoT BOTNETS, MIRAI STYLE)
The fake Telnet on port 23 acts like a weak router or camera: it accepts the first login offered, then drops a fake shell to see what they'd try to run or download through it.
- connections today
- 809
- username/password pairs tried
- 66
most tried usernames:
root (21) admin (11) pi (2) default (2) user (2)
MALWARE DOWNLOAD LINKS · 7 DAYS
Where they tried to make this machine fetch its next stage (a botnet client, an installer script) through Telnet, web exploits and other ports. Each one is checked in abuse.ch's URLhaus; 14 are known there. The addresses are deliberately not clickable.
hxxp://api[.]9hits[.]com/test (37×) · URLhaus: dropper, honeypot, iot, mirai
hxxp://143[.]246[.]56[.]120:8080/wget[.]sh (9×) · not in URLhaus yet
hxxp://160[.]119[.]66[.]206/bins/kla[.]sh (6×) · URLhaus: cowrie, honeypot, mirai
hxxp://201[.]79[.]108[.]167:8081/main_arm7 (6×) · URLhaus: cowrie, honeypot
hxxp://107[.]189[.]3[.]150/b2f628/cronb[.]sh (2×) · not in URLhaus yet
hxxp://182[.]61[.]146[.]73:9080/i[.]sh (1×) · URLhaus: docker, sh, ssh
hxxp://45[.]198[.]224[.]164/x86_64 (1×) · URLhaus: 45-198-224-164, elf, mirai, ua-wget
hxxp://143[.]246[.]56[.]120:8080/x86_64 (1×) · not in URLhaus yet
REDIS
An open Redis is a favourite way into cloud ransomware and cryptominer attacks (SLAVEOF, CONFIG SET, MODULE LOAD, then SET+SAVE to drop a file on disk). The fake one answers OK to everything so we see the whole attempt, but runs and stores nothing.
- connections today
- 48
- of which a server-takeover attempt
- 22
what they tried:
INFO
CONFIG GET bind
PUBSUB CHANNELS
CLIENT LIST
CLUSTER NODES
BRUTE FORCE ON OTHER PROTOCOLS
The same fleet of scanners also probes FTP and MySQL, not just web and SSH.
- FTP login attempts
- 28
- MySQL login attempts
- 165
most tried FTP usernames:
anonymous (7)
most tried MySQL usernames:
root (36) webapp (30) admin (6) sa (3)
OPEN SMTP RELAY
The fake mail server says yes to everything, as if it would relay the mail, but never actually sends anything anywhere: we just watch who they'd claim to be and who they'd try to reach through it.
- connections today
- 21
- login attempts (username+password)
- 1
OPEN DNS RESOLVER
A real open resolver gets abused by querying it with a spoofed source address, so it floods the victim with the reply (DDoS amplification). This one never answers anything, ever, it only watches who would ask what, so we still see the scanning without any way to abuse it.
- queries today
- 55
- of which an amplification-shaped type (ANY/TXT/DNSKEY)
- 38
STOLEN PASSWORDS
Anyone looking for .env or .git files here gets a fake one, with a password made just for them and the address of an admin login. If anyone tries to log in with it, we know exactly from whom and when it was stolen.
- IPs that took the bait today
- 47
- whose stolen password was then used
- 15
- … from a different machine
- 13
The fastest tried it 0 minutes after the theft.
| 11-07 16:53 | git clone | +941 min | other machine | 45.137.x.x |
| 11-07 16:32 | git clone | +0 min | same machine | 176.65.x.x |
| 11-07 16:08 | git clone | +795 min | other machine | 45.137.x.x |
| 11-07 11:49 | git clone | +0 min | other machine | 45.137.x.x |
| 11-07 06:56 | git clone | +243 min | other machine | 45.137.x.x |
WHAT THEY LOOK FOR
- secret hunting (.env, .git, backups)
- 2 843
- other probing
- 1 995
- other PHP scripts
- 269
- WordPress login and plugins
- 205
- known software bugs (Exchange, Jenkins, VPN)
- 113
- database admin (phpMyAdmin, Adminer)
- 17
- router and IoT exploits
- 6
870 different file names tried in the hunt for passwords and keys:
/.env (92) /.git/config (65) /phpinfo.php (63) /_profiler/phpinfo (40) /config.json (32)
asked for this server under 15 different names ("(IP)" is the bare IP address: whoever comes that way is not looking for us, just sweeping the internet):
keletazsia.hu (1 185) lukacsakos.eu (1 067) www.cyberzone.hu (903) notahoneypot.eu (334) cyberzone.hu (330) www.lukacsakos.eu (294) www.pindou.hu (252) www.notahoneypot.hu (251) www.keletazsia.hu (186) vps.numnet.hu (182) · names asked of the fake DNS: version.bind (23) www.example.com (6) hostname.bind (2) united.com (2) xxx.heimaoip.com (2)
most tried passwords (Telnet, FTP, SMTP):
null (101) password (41) 12345678 (30) admin (21) 123456 (21) bombisrael4124512 (16) iloveyou (13) root (11) postgres (11) 1234 (11) · 0% straight from the Mirai botnet's factory-default list
ban reasons (CrowdSec):
http-sensitive-files (2) http-crawl-non_statics (2) http-admin-interface-probing (2) http-probing (1)
ONE SCRIPT, MANY MACHINES
So far we found 57 groups where at least three different machines did exactly the same thing, step by step: the same program running from many places, 485 machines in all. In the largest, 35 machines (from 1 network) ran the same 29 steps:
crowdsec-sim
waf
GET /.DS_Store
GET /.env
GET /.git/config
GET /.vscode/sftp.json
…
FROM WHERE · 633 IP, 71 countries
- China
- 18 478
- United Kingdom
- 12 970
- Kazakhstan
- 8 802
- Taiwan
- 3 268
- Russian Federation
- 3 140
networks they came from: 11% from cloud and hosting providers, i.e. rented servers
- NINGBO, ZHEJIANG Province, P.R.China.
- 18 214
- Data Communication Business Group
- 3 148
- INSYS LLC
- 3 127
- GOOGLE-CLOUD-PLATFORM
- 1 395
- Colombia
- 1 066
WHICH DOORS THEY KNOCK ON · 4 888 TCP ports
No real service runs on this machine beyond the ones listed, yet every port gets tried. Each square is a range of ports over the last 24 hours; the deeper the orange, the more attempts.
0-65535, 256 ports per square
0-1023, the well-known ports, one per square
- 1433 · MSSQL
- 47 104
- 5900 · VNC
- 44 159
- 443 · HTTPS
- 5 448
- 3389 · RDP
- 3 082
- 22 · SSH
- 958
- 23 · Telnet
- 809
- 135 · HTTP
- 551
- 8080 · HTTP-alt
- 509
- 540 · HTTP
- 472
- 9090 · HTTP
- 471
LIVE
attempts as they arrive; the end of each IP is masked, "new": this IP has never been here before, ⛔: it was on CrowdSec's community blocklist when it arrived
| 09:23 | KZ | MS SQL abiq | 185.136.x.x | |
| 09:23 | GB | MS SQL amwb | 138.226.x.x | |
| 09:23 | US | Telnet | 166.62.x.x | GO-DADDY-COM-LLC |
| 09:22 | SG | fake SSH (22) Go | 101.47.x.x | Byteplus Pte. Ltd. |
| 09:21 | CN | fake SSH (22) Go | 112.26.x.x | China Mobile Communications Group Co., L |
| 09:21 | ZA | other PHP scripts | 20.87.x.x | MICROSOFT-CORP-MSN-AS-BLOCK |
| 09:17 | CN | fake SSH (22) | 39.105.x.x | Hangzhou Alibaba Advertising Co.,Ltd. |
| 09:14 | US | Telnet | 198.46.x.x | AS-COLOCROSSING |
| 09:14 | RO | fake SSH (22) | 193.32.x.x | Unmanaged Ltd |
| 09:13 | FR | fake SSH (22) Go | 45.80.x.x | Free Pro SAS |
IF YOU RUN A SERVER
- Never deploy .env files, .git folders or backups into the web root. 2 843
- Keep WordPress and its plugins updated, and don't use "admin" as the username. 205
- Keep database admin tools (phpMyAdmin, Adminer) off the public internet. 17
- Install updates as soon as they ship: exploitation starts within days. 113
- Change default passwords on routers and cameras, and don't expose their admin pages. 6
- SSH with keys only, no passwords.
numbers: attempts aimed at that mistake today
Your IP (216.73.217.15) is not on the ban list, or you could not see this page.
updated 09:23 · CrowdSec · GeoLite2 (MaxMind) · map: Al MacDonald, CC BY-SA 3.0 ·
open data