🇨🇦
lakered
2026-10-05 11:38:48
UTC ·
(1 month ago)
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.95), High-Criminality-Signature (p0f:*:64:0 ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.95), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:46187m)
show less
Port Scan
Exploited Host
Anonymous
2026-10-05 11:11:51
UTC ·
(1 month ago)
Web application attack detected.
Web App Attack
🇩🇪
MaxMeier
2026-10-05 10:49:07
UTC ·
(1 month ago)
34.22.202.7 - - [05/Oct/2026:12:48:05 +0200] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
34.22.202.7 - - [05/Oct/2026:12:48:05 +0200] "GET / HTTP/1.1" 44 ...
show more
34.22.202.7 - - [05/Oct/2026:12:48:05 +0200] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
34.22.202.7 - - [05/Oct/2026:12:48:05 +0200] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
34.22.202.7 - - [05/Oct/2026:12:48:14 +0200] "07\xA0\x03\x02\x01`\xA100.0,\xA0*\x04(NTLMSSP\x00\x01\x00\x00\x00\xF7\xBA\xDB\xE2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 400 150 "-" "-"
34.22.202.7 - - [05/Oct/2026:12:48:19 +0200] "0:\x02\x04z_>\xD1`2\x02\x01\x03\x04\x17cn=buxokdthumfffqtfoosu\x80\x14buxokdthumfffqtfoosu" 400 150 "-" "-"
34.22.202.7 - - [05/Oct/2026:12:48:24 +0200] "\x00\x00\x00C\x00\x12\x00\x00\x1E3\xF4\x81\x00\x1Fconsumer-Offset Explorer 2.2-18\x00\x12apache-kafka-java\x062.4.0\x00" 400 150 "-" "-"
34.22.202.7 - - [05/Oct/2026:12:48:24 +0200] "\x00
...
show less
Bad Web Bot
Web App Attack
🇩🇪
MBombeck
2026-10-05 10:29:44
UTC ·
(1 month ago)
Fail2Ban/traefik-botsearch on apps-01: banned after 5 failures
Web App Attack
🇦🇺
Starburst SysOp Team
2026-10-05 10:27:40
UTC ·
(1 month ago)
Host header is a numeric IP address. Pattern match "(?:^( (920350-syd2-4)
Hacking
Bad Web Bot
🇺🇸
superflea2828
2026-10-05 09:51:37
UTC ·
(1 month ago)
34.22.202.7 - - [05/Oct/2026:09:51:36 +0000] "GET / HTTP/1.0" 400 668 "-" "-"
34.22.202.7 - - [05/Oct/2026:09:51:37 +0000] "GET / HTTP/1.0" 400 668 "-" "-"
...
Web App Attack
🇺🇸
xxkodedxx
2026-10-05 09:41:10
UTC ·
(1 month ago)
[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost)
Trigger: 3× edge-block in 10m window.
Origin: BE / AS396982 Google LLC
Active: 09:40:18→09:40:54 UTC
Volume: 3 HTTP req
Probed: /, Explorer
Status mix: 444×2 400×1
Vhost fishing: ...
show more
[Zorvexus edge-defense] Edge-block (probe URI / bad UA / hostile vhost)
Trigger: 3× edge-block in 10m window.
Origin: BE / AS396982 Google LLC
Active: 09:40:18→09:40:54 UTC
Volume: 3 HTTP req
Probed: /, Explorer
Status mix: 444×2 400×1
Vhost fishing: 67.217.240.72
UA: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
Auto-banned 30d. zorvexus-banner.
show less
Bad Web Bot
Web App Attack
🇯🇵
gomasy
2026-10-05 09:07:31
UTC ·
(1 month ago)
_:443 34.22.202.7 - - [05/Oct/2026:18:07:31 +0900] ";\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xD4\x07\x00\x00\x00\x00\x00\x00admin.$cmd\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x14\x00\x00\x00\x01hello\x00\x00\x00\x00\x00\x00\x00\xF0?\x00" 500 170 "-" ...
show more
_:443 34.22.202.7 - - [05/Oct/2026:18:07:31 +0900] ";\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xD4\x07\x00\x00\x00\x00\x00\x00admin.$cmd\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x14\x00\x00\x00\x01hello\x00\x00\x00\x00\x00\x00\x00\xF0?\x00" 500 170 "-" "-"
...
show less
Web App Attack
🇺🇸
HamSammich
2026-10-05 08:41:21
UTC ·
(1 month ago)
Automated sensor: 1 HTTPS connection/probe attempts over the last 24h (latest 2026-10-05T08:41Z).
Brute-Force
Web App Attack
🇹🇷
pashait
2026-10-05 08:28:27
UTC ·
(1 month ago)
Auto-blocked by Seczar SecureOps — IPS Web Attack Signature (1 events in 5min) at 2026-10-05 08:28
Web App Attack
Bad Web Bot
🇦🇹
vikal
2026-10-05 07:29:25
UTC ·
(1 month ago)
34.22.202.7 - - [05/Oct/2026:09:29:09 +0200] "07\xA0\x03\x02\x01`\xA100.0,\xA0*\x04(NTLMSSP\x00\x01\x00\x00\x00\xF7\xBA\xDB\xE2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 400 150 "-" "-"
34.22.202 ...
show more
34.22.202.7 - - [05/Oct/2026:09:29:09 +0200] "07\xA0\x03\x02\x01`\xA100.0,\xA0*\x04(NTLMSSP\x00\x01\x00\x00\x00\xF7\xBA\xDB\xE2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 400 150 "-" "-"
34.22.202.7 - - [05/Oct/2026:09:29:19 +0200] "0:\x02\x04\x0B\xD8.\xDB`2\x02\x01\x03\x04\x17cn=owksvtwinvkdlleeefgs\x80\x14owksvtwinvkdlleeefgs" 400 150 "-" "-"
34.22.202.7 - - [05/Oct/2026:09:29:24 +0200] "*1" 400 150 "-" "-"
34.22.202.7 - - [05/Oct/2026:09:29:24 +0200] "\x00\x00\x00#\x00\x03\x00\x00\x1E3\xF4\x81\x00" 400 150 "-" "-"
34.22.202.7 - - [05/Oct/2026:09:29:24 +0200] "\x00\x00\x00C\x00\x12\x00\x00\x1E3\xF4\x81\x00\x1Fconsumer-Offset Explorer 2.2-18\x00\x12apache-kafka-java\x062.4.0\x00" 400 150 "-" "-"
...
show less
Brute-Force
SSH
🇸🇪
SkyDancer
2026-10-05 07:21:40
UTC ·
(1 month ago)
Multiple unauthorized attempts to access using wrong credentials. Attack automatically blocked by SkyDancer Ai. EXT-SYS-Vx
Hacking
Brute-Force
SSH
🇺🇸
antlac1
2026-10-05 07:15:11
UTC ·
(1 month ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇫🇷
pm33
2026-10-05 06:56:36
UTC ·
(1 month ago)
Probing for resource vulnerabilities HTTP(S)
Web App Attack
🇵🇱
webadmin
2026-10-05 06:46:36
UTC ·
(1 month ago)
2026-10-05T08:46:31.689581+02:00 tytan csmpro-api[3056]: [error] client: 34.22.202.7 server: 195.116.29.58, request: "GET", url: http://195.116.29.58/ [404]: Not Found
2026-10-05T08:46:31.689581+02:00 tytan csmpro-api[3056]: [error] client: 34.22.202 ...
show more
2026-10-05T08:46:31.689581+02:00 tytan csmpro-api[3056]: [error] client: 34.22.202.7 server: 195.116.29.58, request: "GET", url: http://195.116.29.58/ [404]: Not Found
2026-10-05T08:46:31.689581+02:00 tytan csmpro-api[3056]: [error] client: 34.22.202.7 server: 195.116.29.58, request: "OPTIONS", url: http://195.116.29.58/ [404]: Not Found
2026-10-05T08:46:32.075183+02:00 tytan csmpro-api[3056]: [error] client: 34.22.202.7 server: 195.116.29.58, request: "GET", url: http://195.116.29.58/favicon.ico [404]: Not Found
2026-10-05T08:46:35.047767+02:00 tytan csmpro-api[3056]: [error] client: 34.22.202.7 server: 195.116.29.58, request: "KVIP", url: http://195.116.29.58/ [404]: Not Found
show less
Web App Attack