๐ง๐ท
Pingtoping
2026-09-30 15:22:26
(2 weeks ago)
Nmap.Script.Scanner
Port Scan
Exploited Host
Web App Attack
๐ต๐ฑ
mkey
2026-09-30 08:02:47
(2 weeks ago)
[First: 2026-09-30 07:13:36/single] HITS=1 Repeated suspicious IDS-detected activity; sample=WEB-ATA ...
show more
[First: 2026-09-30 07:13:36/single] HITS=1 Repeated suspicious IDS-detected activity; sample=WEB-ATACK: Invalid destination host in header
show less
Port Scan
Hacking
Web App Attack
๐ฌ๐ง
cybersteve99
2026-09-30 07:50:48
(2 weeks ago)
Invalid HEX string in URL request - Attack suspected.
Brute-Force
Web App Attack
๐ซ๐ท
Thaliruth
2026-09-30 07:28:19
(2 weeks ago)
[30/Sep/2026:09:28:19.126001 +0200] ary6ExDDddl_nHI0-niUfQAAAEE 104.155.5.120 37646 127.0.0.1 7080
. ...
show more
[30/Sep/2026:09:28:19.126001 +0200] ary6ExDDddl_nHI0-niUfQAAAEE 104.155.5.120 37646 127.0.0.1 7080
...
show less
Hacking
Anonymous
2026-09-30 07:17:17
(2 weeks ago)
Http Port:80 (http_status:403) - Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 ...
show more
Http Port:80 (http_status:403) - Agent:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36
show less
Web App Attack
๐ณ๐ฑ
donarev419
2026-09-30 07:06:34
(2 weeks ago)
Connection to port 80 with data transfer.
Data preview: GET / HTTP/1.1
Host: 87.229.95.155:80
User ...
show more
Connection to port 80 with data transfer.
Data preview: GET / HTTP/1.1
Host: 87.229.95.155:80
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleW
show less
Port Scan
Hacking
๐ฌ๐ท
setupgr
2026-09-30 06:43:57
(2 weeks ago)
(mod_security) mod_security (id:11000011) triggered by 104.155.5.120 (BE/Belgium/Brussels Capital/Br ...
show more
(mod_security) mod_security (id:11000011) triggered by 104.155.5.120 (BE/Belgium/Brussels Capital/Brussels/-/[AS396982 Google LLC]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Wed Sep 30 09:43:53.159951 2026] [security2:error] [pid 1755641:tid 1755790] [client 104.155.5.120:19796] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "googleusercontent.com" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "141"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: 120.5.155.104.bc.googleusercontent.com"] [severity "CRITICAL"] [hostname "154.57.7.73"] [uri "/"] [unique_id "aryvqY2N9CyxFfktpZJjHwAABQ4"]
show less
Port Scan
๐บ๐ธ
cwytech
2026-09-30 06:37:39
(2 weeks ago)
Fleet-wide ban from the Ghostfleet ๐ป. Triggered by scenario: cwy/web-asn-lockdown-high.
Bad Web Bot
Web App Attack
Anonymous
2026-09-30 06:15:08
(2 weeks ago)
CrowdSec detection: crowdsecurity/http-probing
Hacking
Web App Attack
๐บ๐ธ
cwytech
2026-09-30 06:13:07
(2 weeks ago)
Fleet-wide ban from the Ghostfleet ๐ป. Triggered by scenario: cwy/tactical-rmm-lockdown-high.
Hacking
๐ฉ๐ช
MaxMeier
2026-09-30 05:57:53
(2 weeks ago)
104.155.5.120 - - [30/Sep/2026:07:56:52 +0200] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 1 ...
show more
104.155.5.120 - - [30/Sep/2026:07:56:52 +0200] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
104.155.5.120 - - [30/Sep/2026:07:56:52 +0200] "\x16\x03\x01\x05\xC4\x01\x00\x05\xC0\x03\x03a\xF5\xEF\x06\x1Fj\xD6\x83j\xE2[>~\xB9\xD2\x10#\x811\xF5n\x22\xA0\xFF\x02\x95)\xCF>vnd *\xE4#v\xB8\x1A\xB4\xEBM\x08\x11\xA7\xDA\xA8!\xEE\xAF\x7F\xFAs\xEA\xA8$\xD7\x1E\x82,h\xD2kV\x02\x002\xC0+\xC0/\xC0,\xC00\xCC\xA9\xCC\xA8\xC0\x09\xC0\x13\xC0" 400 150 "-" "-"
104.155.5.120 - - [30/Sep/2026:07:56:52 +0200] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
104.155.5.120 - - [30/Sep/2026:07:56:57 +0200] ";\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xD4\x07\x00\x00\x00\x00\x00\x00admin.$cmd\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x14\x00\x00\x00\x01hello\x00\x00\x00\x00\x00\x00\x00\xF0?\x00" 400 150 "-" "-"
104.155.5.120 - - [3
...
show less
Bad Web Bot
Web App Attack
๐บ๐ธ
azminawwar
2026-09-30 05:57:01
(2 weeks ago)
[104.155.5.120] triggered by honeypot on port [80], Timestamp [2026-09-30T05:57:01Z]METHOD=GET PATH= ...
show more
[104.155.5.120] triggered by honeypot on port [80], Timestamp [2026-09-30T05:57:01Z]METHOD=GET PATH=/ HTTP=HTTP/1.1 UA="Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko)
show less
Port Scan
Hacking
๐ฏ๐ต
VXG-NET
2026-09-30 05:49:43
(2 weeks ago)
port=80, indicator_type=hacktool
Hacking
๐ฉ๐ช
0x44
2026-09-30 05:42:04
(2 weeks ago)
Abusive host detected - Web probing for vulnerabilities
Web App Attack
Hacking
๐บ๐ธ
HamSammich
2026-09-30 05:27:37
(2 weeks ago)
Automated sensor: 1 HTTP connection/probe attempts over the last 24h (latest 2026-09-30T05:27Z).
Brute-Force
Web App Attack