🇫🇷
agroman93
2026-10-26 08:09:02
(2 days ago)
T-Pot honeypot: 13 hits on ports [80] (automated)
Port Scan
Web App Attack
🇩🇪
sojan
2026-10-26 07:54:35
(2 days ago)
34.34.189.26 - - [26/Oct/2026:08:53:51 +0100] "\x16\x03\x01\x05\xC4\x01\x00\x05\xC0\x03\x03`\x08\xE6\xD2\x94S\x00\x0B\xCD\xF8\xBE\xBB" 400 150 "-" "-"
34.34.189.26 - - [26/Oct/2026:08:53:55 +0100] "\xCC9\xFE\x92\x0C}\xF3" 400 150 "-" "-"
34.34.189.26 ...
show more
34.34.189.26 - - [26/Oct/2026:08:53:51 +0100] "\x16\x03\x01\x05\xC4\x01\x00\x05\xC0\x03\x03`\x08\xE6\xD2\x94S\x00\x0B\xCD\xF8\xBE\xBB" 400 150 "-" "-"
34.34.189.26 - - [26/Oct/2026:08:53:55 +0100] "\xCC9\xFE\x92\x0C}\xF3" 400 150 "-" "-"
34.34.189.26 - - [26/Oct/2026:08:54:34 +0100] "\x00\x1E\xF0 \x01\x00\x00\x01\x00\x00\x00\x00\x00\x00\x07version\x04bind\x00\x00\x10\x00\x03" 400 150 "-" "-"
...
show less
Bad Web Bot
🇧🇷
ufn.edu.br
2026-10-26 07:37:49
(2 days ago)
[Mon Oct 26 04:37:44.790311 2026] [authz_core:error] [pid 19479] [client 34.34.189.26:15318] AH01630: client denied by server configuration: /var/www/CPED-UFN/public/
[Mon Oct 26 04:37:45.366028 2026] [authz_core:error] [pid 14095] [client 34.34.189. ...
show more
[Mon Oct 26 04:37:44.790311 2026] [authz_core:error] [pid 19479] [client 34.34.189.26:15318] AH01630: client denied by server configuration: /var/www/CPED-UFN/public/
[Mon Oct 26 04:37:45.366028 2026] [authz_core:error] [pid 14095] [client 34.34.189.26:15332] AH01630: client denied by server configuration: /var/www/CPED-UFN/public/favicon.ico
[Mon Oct 26 04:37:48.959384 2026] [authz_core:error] [pid 14097] [client 34.34.189.26:61068] AH01630: client denied by server configuration: /var/www/CPED-UFN/public/pub
...
show less
Exploited Host
Web App Attack
🇵🇱
ToJa
2026-10-26 07:26:08
(2 days ago)
Web App Port Scaning, [Jail 80], Access Not Existent Virtual Server. (honeypot):
[server08] 34.34.189.26 - - [26/Oct/2026:08:26:07 +0100] "GET / HTTP/1.1" 403 168 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) C ...
show more
Web App Port Scaning, [Jail 80], Access Not Existent Virtual Server. (honeypot):
[server08] 34.34.189.26 - - [26/Oct/2026:08:26:07 +0100] "GET / HTTP/1.1" 403 168 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" "-"
show less
Web App Attack
🇭🇰
sandra361
2026-10-26 07:20:18
(2 days ago)
Port scan detected: 11 attempts across 1 port (80). | Evidence: GHOST_SCAN: IN=eth0 SRC=34.34.189.26 LEN=60 TOS=0x14 PREC=0x00 TTL=57 ID=14515 DF PROTO=TCP SPT=48636 DPT=80 WINDOW=42600 RES=0x00 SYN URGP=0
Port Scan
🇫🇷
Sebbabas
2026-10-26 06:50:39
(2 days ago)
34.34.189.26 - - \[26/Oct/2026:07:50:36 +0100\] "GET /pub/ HTTP/1.1" 404 366 "-" "Mozilla/5.0 \(compatible\)"34.34.189.26 - - \[26/Oct/2026:07:50:36 +0100\] "GET /favicon.ico HTTP/1.1" 404 373 "-" "Mozilla/5.0 \(compatible\)"34.34.189.26 - - \[26/Oct ...
show more
34.34.189.26 - - \[26/Oct/2026:07:50:36 +0100\] "GET /pub/ HTTP/1.1" 404 366 "-" "Mozilla/5.0 \(compatible\)"34.34.189.26 - - \[26/Oct/2026:07:50:36 +0100\] "GET /favicon.ico HTTP/1.1" 404 373 "-" "Mozilla/5.0 \(compatible\)"34.34.189.26 - - \[26/Oct/2026:07:50:37 +0100\] "GET /files/ HTTP/1.1" 404 368 "-" "Mozilla/5.0 \(compatible\)"34.34.189.26 - - \[26/Oct/2026:07:50:37 +0100\] "GET /downloads/ HTTP/1.1" 404 372 "-" "Mozilla/5.0 \(compatible\)"
...
show less
FTP Brute-Force
Port Scan
Brute-Force
Web App Attack
SSH
🇩🇪
Ano_Nym
2026-10-26 06:42:38
(2 days ago)
CrowdSec IDS alert on VPS 85.215.198.123 (DE). Scenario: crowdsecurity/http-probing
Web App Attack
🇺🇸
donarev419
2026-10-26 06:12:02
(2 days ago)
Connection to port 80 with data transfer.
Data preview: GET / HTTP/1.1
Host: 107.175.212.44:80
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Apple
Port Scan
Hacking
2026-10-26 05:43:45
(2 days ago)
Fail2Ban nginx-bad-request on Security-Instance. Persistent malicious activity detected. Evidence:
/var/log/nginx/access.log:34.34.189.26 - - [26/Oct/2026:06:43:01 +0100] "\x16\x03\x01\x05\xC4\x01\x00\x05\xC0\x03\x03`\xC6\x82<\xBB-\xC8\xCD\xC5\xFF\xC ...
show more
Fail2Ban nginx-bad-request on Security-Instance. Persistent malicious activity detected. Evidence:
/var/log/nginx/access.log:34.34.189.26 - - [26/Oct/2026:06:43:01 +0100] "\x16\x03\x01\x05\xC4\x01\x00\x05\xC0\x03\x03`\xC6\x82<\xBB-\xC8\xCD\xC5\xFF\xC2\x93/\xE0+A\x14w\x0CgJZld{s\xFA\x8D\xC5Y$" 400 150 "-" "-" "-"
/var/log/nginx/access.log:34.34.189.26 - - [26/Oct/2026:06:43:01 +0100] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" "-"
/var/log/nginx/access.log:34.34.189.26 - - [26/Oct/2026:06:43:06 +0100] ";\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xD4\x07\x00\x00\x00\x00\x00\x00admin.$cmd\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x14\x00\x00\x00\x01hello\x00\x00\x00\x00\x00\x00\x00\xF0?\x00" 400 150 "
show less
Web App Attack
🇧🇷
SOC Blue Team
2026-10-26 05:27:22
(2 days ago)
IPs get by Hunting on SIEM
Phishing
Web Spam
Port Scan
Hacking
2026-10-26 05:16:07
(2 days ago)
🔥 Web application attack detected. Vulnerability scanning and exploitation attempts identified.
Port Scan
Web App Attack
🇺🇸
antlac1
2026-10-26 05:10:52
(2 days ago)
crowdsecurity/http-probing
Brute-Force
Web App Attack
🇮🇳
nadnitin
2026-10-26 03:53:59
(2 days ago)
Automated block via Nginx Police. Detected suspicious activity: MALICIOUS-HEX.
Web App Attack
🇩🇪
Tamsy
2026-10-26 03:39:53
(2 days ago)
HTTPD - 4xx scan
Web App Attack
🇫🇷
pm33
2026-10-26 03:14:33
(2 days ago)
Probing for resource vulnerabilities HTTP(S)
Web App Attack
