{"timestamp": "2026-07-11T00:03:32.458811+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/.git/HEAD", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}
{"timestamp": "2026-07-11T00:03:32.462655+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/config.xml", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:03:32.583903+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/.env", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:03:32.588874+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/api/.env", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:03:32.798883+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.production", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:03:32.836309+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"url": "(rate)", "http_method": "*", "http_user_agent": ""}, "alert": {"action": "allowed", "signature_id": 9000050, "rev": 1, "signature": "OWL Threshold: 15 req/60s from one source", "category": "attempted-dos", "severity": 1}}
{"timestamp": "2026-07-11T00:03:32.898206+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/config/production.json", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:03:33.022937+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/backup.sql", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:03:33.068024+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/config.php", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:03:33.239719+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/.ssh/id_ecdsa", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:03:33.393958+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/backup.zip", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:03:33.456593+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/actuator/heapdump", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000011, "rev": 1, "signature": "OWL App-framework probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:03:33.501391+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/backup.tar.gz", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:03:33.628990+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/wp-admin/setup-config.php", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000003, "rev": 1, "signature": "OWL WordPress admin probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:03:33.658410+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/.ssh/id_rsa", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:03:33.705708+0000", "event_type": "alert", "src_ip": "81.171.72.93", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/.ssh/id_ed25519", "http_method": "GET", "http_user_agent": "Go-http-client/1.1"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:03:41.708967+0000", "event_type": "alert", "src_ip": "163.176.137.114", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Brazil", "country_code": "BR"}, "http": {"hostname": "run.lulz.sh", "url": "/config", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:04:05.099724+0000", "event_type": "alert", "src_ip": "194.147.34.177", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Poland", "country_code": "PL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.production", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:04:19.675370+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.dev", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:04:32.204345+0000", "event_type": "alert", "src_ip": "145.241.230.205", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "United Kingdom", "country_code": "GB"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.test", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:04:41.063595+0000", "event_type": "alert", "src_ip": "211.175.22.56", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "South Korea", "country_code": "KR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.staging", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:04:42.740968+0000", "event_type": "alert", "src_ip": "167.172.158.128", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "United States", "country_code": "US"}, "http": {"hostname": "run.lulz.sh", "url": "/login.action", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (l9scan/2.0.33e23313e27313e2430313; +https://leakix.net)"}, "alert": {"action": "allowed", "signature_id": 9000012, "rev": 1, "signature": "OWL Admin login probe", "category": "attempted-recon", "severity": 3}}
{"timestamp": "2026-07-11T00:04:43.802717+0000", "event_type": "alert", "src_ip": "167.172.158.128", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "United States", "country_code": "US"}, "http": {"hostname": "run.lulz.sh", "url": "/___proxy_subdomain_whm/login", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (l9scan/2.0.33e23313e27313e2430313; +https://leakix.net)"}, "alert": {"action": "allowed", "signature_id": 9000012, "rev": 1, "signature": "OWL Admin login probe", "category": "attempted-recon", "severity": 3}}
{"timestamp": "2026-07-11T00:04:43.889898+0000", "event_type": "alert", "src_ip": "139.59.136.184", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/login.action", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (l9scan/2.0.33e24313e27313e2430313; +https://leakix.net)"}, "alert": {"action": "allowed", "signature_id": 9000012, "rev": 1, "signature": "OWL Admin login probe", "category": "attempted-recon", "severity": 3}}
{"timestamp": "2026-07-11T00:04:44.760281+0000", "event_type": "alert", "src_ip": "139.59.136.184", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/___proxy_subdomain_whm/login", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (l9scan/2.0.33e24313e27313e2430313; +https://leakix.net)"}, "alert": {"action": "allowed", "signature_id": 9000012, "rev": 1, "signature": "OWL Admin login probe", "category": "attempted-recon", "severity": 3}}
{"timestamp": "2026-07-11T00:04:45.944365+0000", "event_type": "alert", "src_ip": "167.172.158.128", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "United States", "country_code": "US"}, "http": {"hostname": "run.lulz.sh", "url": "/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (l9scan/2.0.33e23313e27313e2430313; +https://leakix.net)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:04:47.047506+0000", "event_type": "alert", "src_ip": "139.59.136.184", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (l9scan/2.0.33e24313e27313e2430313; +https://leakix.net)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:04:49.945297+0000", "event_type": "alert", "src_ip": "167.172.158.128", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "United States", "country_code": "US"}, "http": {"hostname": "run.lulz.sh", "url": "/.git/config", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (l9scan/2.0.33e23313e27313e2430313; +https://leakix.net)"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}
{"timestamp": "2026-07-11T00:04:50.803877+0000", "event_type": "alert", "src_ip": "211.175.22.56", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "South Korea", "country_code": "KR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.backup", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:04:51.068903+0000", "event_type": "alert", "src_ip": "167.172.158.128", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "United States", "country_code": "US"}, "http": {"url": "(rate)", "http_method": "*", "http_user_agent": ""}, "alert": {"action": "allowed", "signature_id": 9000050, "rev": 1, "signature": "OWL Threshold: 15 req/60s from one source", "category": "attempted-dos", "severity": 1}}
{"timestamp": "2026-07-11T00:04:51.347210+0000", "event_type": "alert", "src_ip": "139.59.136.184", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/.git/config", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (l9scan/2.0.33e24313e27313e2430313; +https://leakix.net)"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}
{"timestamp": "2026-07-11T00:04:52.955666+0000", "event_type": "alert", "src_ip": "139.59.136.184", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"url": "(rate)", "http_method": "*", "http_user_agent": ""}, "alert": {"action": "allowed", "signature_id": 9000050, "rev": 1, "signature": "OWL Threshold: 15 req/60s from one source", "category": "attempted-dos", "severity": 1}}
{"timestamp": "2026-07-11T00:04:52.960014+0000", "event_type": "alert", "src_ip": "167.172.158.128", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "United States", "country_code": "US"}, "http": {"hostname": "run.lulz.sh", "url": "/config.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (l9scan/2.0.33e23313e27313e2430313; +https://leakix.net)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:04:54.712664+0000", "event_type": "alert", "src_ip": "139.59.136.184", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/config.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (l9scan/2.0.33e24313e27313e2430313; +https://leakix.net)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:04:57.001385+0000", "event_type": "alert", "src_ip": "167.172.158.128", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "United States", "country_code": "US"}, "http": {"hostname": "run.lulz.sh", "url": "/actuator/env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (l9scan/2.0.33e23313e27313e2430313; +https://leakix.net)"}, "alert": {"action": "allowed", "signature_id": 9000011, "rev": 1, "signature": "OWL App-framework probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:04:58.922363+0000", "event_type": "alert", "src_ip": "139.59.136.184", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Germany", "country_code": "DE"}, "http": {"hostname": "run.lulz.sh", "url": "/actuator/env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (l9scan/2.0.33e24313e27313e2430313; +https://leakix.net)"}, "alert": {"action": "allowed", "signature_id": 9000011, "rev": 1, "signature": "OWL App-framework probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:05:05.765407+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.old", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:06.657984+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.bak", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:07.245868+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.tmp", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:07.791268+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.swp", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:08.363829+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env~", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:09.221372+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.example", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:09.816499+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.sample", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:10.238850+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.dist", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:10.709481+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.template", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:11.571960+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.production.local", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:12.072993+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.development.local", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:12.610821+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.test.local", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:13.987631+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"url": "(rate)", "http_method": "*", "http_user_agent": ""}, "alert": {"action": "allowed", "signature_id": 9000050, "rev": 1, "signature": "OWL Threshold: 15 req/60s from one source", "category": "attempted-dos", "severity": 1}}
{"timestamp": "2026-07-11T00:05:16.600648+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/app/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:17.214231+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/src/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:17.824947+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:18.718122+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/backend/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:19.322496+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/frontend/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:19.926655+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/api/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:20.507446+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/server/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:21.456454+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/client/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:21.987867+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/web/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:22.780935+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/public/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:23.370493+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/private/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:24.280112+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/var/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:27.958665+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config.js", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:28.863133+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:46.850159+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config.py", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:48.254994+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config/secrets.yml", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:48.876479+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config/master.key", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:52.848076+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config/app.php", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:05:59.562562+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config.yaml", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:00.232110+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config.yml", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:00.902357+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config.toml", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:03.395706+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config/production.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:03.514220+0000", "event_type": "alert", "src_ip": "178.16.54.137", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security  https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:03.882080+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config/development.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:05.172059+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config/default.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:05.673364+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config/local.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:05.673364+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"url": "(rate)", "http_method": "*", "http_user_agent": ""}, "alert": {"action": "allowed", "signature_id": 9000050, "rev": 1, "signature": "OWL Threshold: 15 req/60s from one source", "category": "attempted-dos", "severity": 1}}
{"timestamp": "2026-07-11T00:06:06.653959+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/data/config.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:07.704524+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/actuator/env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000011, "rev": 1, "signature": "OWL App-framework probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:06:08.172192+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/actuator/configprops", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:08.628260+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/api/config", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:10.348467+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/backup/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:10.834379+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/backups/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:11.325766+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/old/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:11.846830+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/temp/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:12.522210+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/tmp/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:13.965023+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/root/.aws/credentials", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:14.453845+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/home/ubuntu/.aws/credentials", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:15.225840+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/home/ec2-user/.aws/credentials", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:15.637640+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/home/node/.aws/credentials", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:19.210050+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.vault", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:19.627492+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.aws/credentials", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:20.351597+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.aws/config", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:20.824784+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/.docker/config.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:21.229985+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/storage/framework/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:21.597833+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/laravel/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:29.883296+0000", "event_type": "alert", "src_ip": "37.187.32.181", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "France", "country_code": "FR"}, "http": {"hostname": "run.lulz.sh", "url": "/config/gcp.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/136.0.0.0 Safari/537.36 (Silvy X Ran)"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:58.189011+0000", "event_type": "alert", "src_ip": "64.89.161.85", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Luxembourg", "country_code": "LU"}, "http": {"hostname": "run.lulz.sh", "url": "/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:58.208702+0000", "event_type": "alert", "src_ip": "64.89.161.85", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Luxembourg", "country_code": "LU"}, "http": {"hostname": "run.lulz.sh", "url": "/js/config.js", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:58.253789+0000", "event_type": "alert", "src_ip": "64.89.161.85", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Luxembourg", "country_code": "LU"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.local", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:58.265342+0000", "event_type": "alert", "src_ip": "64.89.161.85", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Luxembourg", "country_code": "LU"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.production", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:58.357250+0000", "event_type": "alert", "src_ip": "64.89.161.85", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Luxembourg", "country_code": "LU"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.example", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:58.358849+0000", "event_type": "alert", "src_ip": "64.89.161.85", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Luxembourg", "country_code": "LU"}, "http": {"hostname": "run.lulz.sh", "url": "/api/config", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:06:58.478200+0000", "event_type": "alert", "src_ip": "64.89.161.85", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Luxembourg", "country_code": "LU"}, "http": {"hostname": "run.lulz.sh", "url": "/config.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:08:03.591984+0000", "event_type": "alert", "src_ip": "64.89.161.82", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Luxembourg", "country_code": "LU"}, "http": {"hostname": "run.lulz.sh", "url": "/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:08:03.634970+0000", "event_type": "alert", "src_ip": "64.89.161.82", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Luxembourg", "country_code": "LU"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.example", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:08:03.611717+0000", "event_type": "alert", "src_ip": "64.89.161.82", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Luxembourg", "country_code": "LU"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.production", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:08:03.669442+0000", "event_type": "alert", "src_ip": "64.89.161.82", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Luxembourg", "country_code": "LU"}, "http": {"hostname": "run.lulz.sh", "url": "/api/config", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:08:03.765428+0000", "event_type": "alert", "src_ip": "64.89.161.82", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Luxembourg", "country_code": "LU"}, "http": {"hostname": "run.lulz.sh", "url": "/config.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:08:03.793924+0000", "event_type": "alert", "src_ip": "64.89.161.82", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Luxembourg", "country_code": "LU"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.local", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:09:42.976992+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/wp-login.php", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000003, "rev": 1, "signature": "OWL WordPress admin probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:09:43.416103+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/actuator/health", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000011, "rev": 1, "signature": "OWL App-framework probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:09:43.626102+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:09:43.879042+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.git/HEAD", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}
{"timestamp": "2026-07-11T00:09:48.018959+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/wp-login.php", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000003, "rev": 1, "signature": "OWL WordPress admin probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:09:51.544798+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/actuator/health", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000011, "rev": 1, "signature": "OWL App-framework probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:09:53.067925+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/app/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:09:53.394522+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/api/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:09:53.618932+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/backend/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:09:53.627829+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.aws/credentials", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:09:53.632987+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.local", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:09:53.648483+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.bak", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:09:53.648483+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"url": "(rate)", "http_method": "*", "http_user_agent": ""}, "alert": {"action": "allowed", "signature_id": 9000050, "rev": 1, "signature": "OWL Threshold: 15 req/60s from one source", "category": "attempted-dos", "severity": 1}}
{"timestamp": "2026-07-11T00:09:53.670639+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.production", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:09:53.888351+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.swp", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:09:54.017278+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/config.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:09:55.209411+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.git/HEAD", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}
{"timestamp": "2026-07-11T00:09:55.271293+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.git/config", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}
{"timestamp": "2026-07-11T00:09:55.477816+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/./.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:07.877681+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/configuration.php.bak", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.224694+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.ssh/id_ed25519", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.228209+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.ssh/id_dsa", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.230495+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/id_rsa", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.271244+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.ssh/id_rsa", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.275386+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.git/logs/HEAD", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.276937+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.ssh/id_ecdsa", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.590951+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.git/packed-refs", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.706002+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.git/index", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.708694+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.git-credentials", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.746926+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.backup", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.771212+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.old", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.781832+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.dev", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.800080+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.staging", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.807664+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.example", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.840076+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.prod", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.860761+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/server/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.861142+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/config/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:08.874364+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/web/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:09.365786+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/dist/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:09.419131+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.docker", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:09.426228+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.stage", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:09.428212+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.production.local", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:09.429495+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.dev.local", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:09.448079+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.live", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:09.459030+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/api/shared/config.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:09.467768+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/api/shared/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:09.618158+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/public/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:09.637486+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/src/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:09.647448+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/build/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:09.696412+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/deploy/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:09.721729+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/services/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:09.860047+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/core/.env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:11.840832+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.docker/config.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:11.853982+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.vercel/output/config.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:11.856146+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/config/database.yml", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:11.857352+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/config/master.key", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:11.868500+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.enc", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:11.868878+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.encrypted", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:11.869326+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.vault", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:11.870498+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/config/credentials.yml.enc", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:12.288902+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.env.production.enc", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:12.316719+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/api/v1/status/config", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:12.341452+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/debug/pprof/cmdline", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000008, "rev": 1, "signature": "OWL RCE / shell probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:12.356883+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/api/users/admin/check", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000012, "rev": 1, "signature": "OWL Admin login probe", "category": "attempted-recon", "severity": 3}}
{"timestamp": "2026-07-11T00:10:13.137220+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.github/workflows/deploy.yml", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}
{"timestamp": "2026-07-11T00:10:13.195999+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.github/workflows/ci.yml", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}
{"timestamp": "2026-07-11T00:10:13.263132+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.github/workflows/release.yml", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}
{"timestamp": "2026-07-11T00:10:13.314587+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.gitlab-ci.yml", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}
{"timestamp": "2026-07-11T00:10:13.327395+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/.circleci/config.yml", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:13.356409+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/Jenkinsfile", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000011, "rev": 1, "signature": "OWL App-framework probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:10:15.560047+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/config.php", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:15.563126+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/config.yaml", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:15.565017+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/config.yml", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:15.566295+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/adminer.php", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"}, "alert": {"action": "allowed", "signature_id": 9000004, "rev": 1, "signature": "OWL DB admin probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:10:15.566853+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/config.json", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:16.280334+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/actuator", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000011, "rev": 1, "signature": "OWL App-framework probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:10:16.281210+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/actuator/env", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1"}, "alert": {"action": "allowed", "signature_id": 9000011, "rev": 1, "signature": "OWL App-framework probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:10:16.586700+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/phpmyadmin/", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000004, "rev": 1, "signature": "OWL DB admin probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:10:16.646151+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/actuator/health", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000011, "rev": 1, "signature": "OWL App-framework probe", "category": "attempted-recon", "severity": 2}}
{"timestamp": "2026-07-11T00:10:16.663767+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/backup.sql", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:132.0) Gecko/20100101 Firefox/132.0"}, "alert": {"action": "allowed", "signature_id": 9000009, "rev": 1, "signature": "OWL Sensitive-file probe", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T00:10:16.703485+0000", "event_type": "alert", "src_ip": "45.88.138.44", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "The Netherlands", "country_code": "NL"}, "http": {"hostname": "run.lulz.sh", "url": "/admin", "http_method": "GET", "http_user_agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"}, "alert": {"action": "allowed", "signature_id": 9000012, "rev": 1, "signature": "OWL Admin login probe", "category": "attempted-recon", "severity": 3}}
{"timestamp": "2026-07-11T00:39:29.891781+0000", "event_type": "alert", "src_ip": "196.206.65.180", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "Morocco", "country_code": "MA"}, "http": {"hostname": "run.lulz.sh", "url": "/.env", "http_method": "GET", "http_user_agent": ""}, "alert": {"action": "allowed", "signature_id": 9000001, "rev": 1, "signature": "OWL Env-file / secret theft", "category": "web-application-attack", "severity": 1}}
{"timestamp": "2026-07-11T01:07:46.901290+0000", "event_type": "alert", "src_ip": "62.106.78.222", "src_port": 0, "dest_ip": "honeypot", "dest_port": 80, "proto": "TCP", "geoip": {"country_name": "United States", "country_code": "US"}, "http": {"hostname": "run.lulz.sh", "url": "/.git/config", "http_method": "GET", "http_user_agent": "curl/8.7.1"}, "alert": {"action": "allowed", "signature_id": 9000002, "rev": 1, "signature": "OWL Git repo exposure probe", "category": "attempted-recon", "severity": 1}}