Anonymous
2026-10-13 12:10:09
(2 days ago)
Web application attack detected.
Web App Attack
๐ฉ๐ช
robotstxt
2026-10-13 11:38:30
(2 days ago)
34.22.233.114 - - [13/Oct/2026:11:38:27 +0000] "GXUI / HTTP/1.1" 400 291 "-" "Mozilla/5.0 (compatibl ...
show more
34.22.233.114 - - [13/Oct/2026:11:38:27 +0000] "GXUI / HTTP/1.1" 400 291 "-" "Mozilla/5.0 (compatible)" "-" edge="34.22.233.114"
34.22.233.114 - - [13/Oct/2026:11:38:27 +0000] "GET / HTTP/1.1" 400 291 "-" "Mozilla/5.0 (compatible)" "-" edge="34.22.233.114"
34.22.233.114 - - [13/Oct/2026:11:38:28 +0000] "HEAD / HTTP/1.1" 400 0 "-" "Mozilla/5.0 (compatible)" "-" edge="34.22.233.114"
34.22.233.114 - - [13/Oct/2026:11:38:28 +0000] "POST / HTTP/1.1" 400 291 "-" "Mozilla/5.0 (compatible)" "-" edge="34.22.233.114"
34.22.233.114 - - [13/Oct/2026:11:38:28 +0000] "OPTIONS / HTTP/1.1" 400 291 "-" "Mozilla/5.0 (compatible)" "-" edge="34.22.233.114"
...
show less
Web Spam
Web App Attack
๐ฌ๐ท
setupgr
2026-10-13 11:12:43
(2 days ago)
(mod_security) mod_security (id:11000011) triggered by 34.22.233.114 (BE/Belgium/Brussels Capital/Br ...
show more
(mod_security) mod_security (id:11000011) triggered by 34.22.233.114 (BE/Belgium/Brussels Capital/Brussels/-/[AS396982 Google LLC]): 1 in the last 86400 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Tue Oct 13 14:12:42.316498 2026] [security2:error] [pid 1355998:tid 1356086] [client 34.22.233.114:27328] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "googleusercontent.com" at REMOTE_HOST. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "140"] [id "11000011"] [msg "BLOCKED BAD DOMAIN: 114.233.22.34.bc.googleusercontent.com"] [severity "CRITICAL"] [hostname "154.57.7.73"] [uri "/"] [unique_id "as4SKf_p15sj0cXy8sQsQwAABIA"]
show less
Port Scan
๐ฉ๐ช
Yoisho!
2026-10-13 11:06:04
(2 days ago)
Web attack from 34.22.233.114
Web App Attack
๐บ๐ธ
cwytech
2026-10-13 11:05:55
(2 days ago)
Fleet-wide ban from the Ghostfleet ๐ป. Triggered by scenario: cwy/rdg-local-lockdown-high.
Bad Web Bot
Web App Attack
๐ฉ๐ช
dpsbs
2026-10-13 10:57:30
(2 days ago)
url scanning on multiple public ips detected
Bad Web Bot
๐บ๐ธ
crooze.net
2026-10-13 10:01:41
(2 days ago)
34.22.233.114 - - [13/Oct/2026:06:01:40 -0400] "07\xA0\x03\x02\x01`\xA100.0,\xA0*\x04(NTLMSSP\x00\x0 ...
show more
34.22.233.114 - - [13/Oct/2026:06:01:40 -0400] "07\xA0\x03\x02\x01`\xA100.0,\xA0*\x04(NTLMSSP\x00\x01\x00\x00\x00\xF7\xBA\xDB\xE2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 400 150 "-" "-"
...
show less
Hacking
Web App Attack
Anonymous
2026-10-13 09:57:27
(2 days ago)
Fail2ban Nginx log integration.
Brute-Force
SSH
Port Scan
๐จ๐ฆ
lakered
2026-10-13 09:42:50
(2 days ago)
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.97), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:125m)
show less
Port Scan
Exploited Host
๐ฉ๐ช
Roper123
2026-10-13 08:47:55
(2 days ago)
Web exploits
Web App Attack
๐ซ๐ท
pm33
2026-10-13 08:22:17
(2 days ago)
Probing for resource vulnerabilities HTTP(S)
Web App Attack
๐ฉ๐ช
Tamsy
2026-10-13 07:30:39
(2 days ago)
HTTPD - 4xx scan
Web App Attack
๐ง๐ท
SOC Blue Team
2026-10-13 07:27:13
(2 days ago)
IPs get by Hunting on SIEM
Phishing
Web Spam
Port Scan
Hacking
๐ฏ๐ต
gomasy
2026-10-13 06:57:42
(2 days ago)
_:443 34.22.233.114 - - [13/Oct/2026:15:57:41 +0900] ";\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\ ...
show more
_:443 34.22.233.114 - - [13/Oct/2026:15:57:41 +0900] ";\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xD4\x07\x00\x00\x00\x00\x00\x00admin.$cmd\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x14\x00\x00\x00\x01hello\x00\x00\x00\x00\x00\x00\x00\xF0?\x00" 500 170 "-" "-"
...
show less
Web App Attack
๐ซ๐ท
Kejult
2026-10-13 06:31:48
(2 days ago)
Honeypot Finding: repeated TCP service probing on TCP/443 (HTTPS); 8 application-level events across ...
show more
Honeypot Finding: repeated TCP service probing on TCP/443 (HTTPS); 8 application-level events across 8 source port(s). Sensor(s): H0neytr4p.
show less
Port Scan