🇺🇸
gu-alvareza
2026-10-28 05:05:04
UTC ·
(2 weeks ago)
Java.Debug.Wire.Protocol.Insecure.Configuration
Hacking
Anonymous
2026-10-27 16:52:26
UTC ·
(2 weeks ago)
Reported from Nginx log analysis 6. Log: 34.38.255.41 - - [27/Oct/2026:xx:xx:xx 0100] "GET / HTTP/1.1" xxx xxx "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" "-" "BE Belgium Brus ...
show more
Reported from Nginx log analysis 6. Log: 34.38.255.41 - - [27/Oct/2026:xx:xx:xx 0100] "GET / HTTP/1.1" xxx xxx "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" "-" "BE Belgium Brussels" "AS396982" "Google LLC" | 34.38.255.41 - - [27/Oct/2026:xx:xx:xx 0100] "GET / HTTP/1.1" xxx xxx "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36" "-" "BE Belgium Brussels" "AS396982" "Google LLC"
show less
Port Scan
Brute-Force
SSH
🇨🇳
Peter Yu
2026-10-27 14:53:16
UTC ·
(2 weeks ago)
Bad Web Bot
Web App Attack
🇺🇸
LSPCCU
2026-10-27 14:03:25
UTC ·
(2 weeks ago)
TSEC Honeypot Network report. Threat score: 74/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH. Honeypot: h0neytr4p. Context: Attacker IP 34.38.255.41 observed using TLS client fingerprint 'Unknown TLS Client (c872de4b8082)' 12 ...
show more
TSEC Honeypot Network report. Threat score: 74/100. Categories: Port Scan, Hacking, Brute-Force, Web App Attack, SSH. Honeypot: h0neytr4p. Context: Attacker IP 34.38.255.41 observed using TLS client fingerprint 'Unknown TLS Client (c872de4b8082)' 12 times when connecting to a financial services sector honeypot between 2026-10-27 11:19 and 2026....
show less
Port Scan
Hacking
Brute-Force
Web App Attack
SSH
🇵🇱
mkey
2026-10-27 14:03:21
UTC ·
(2 weeks ago)
[First: 2026-10-27 14:27:45/single] HITS=1 Repeated suspicious web requests; sample=GET /pub/ 404
Port Scan
Hacking
Web App Attack
🇺🇸
chronos
2026-10-27 13:50:21
UTC ·
(2 weeks ago)
[AUTORAVALT][[27/10/2026 - 10:50:21 -03:00 UTC]
Attack from [Google LLC]
[34.38.255.41][41.255.38.34.bc.googleusercontent.com]
Action: BLocKed
DDoS Attack -> Participating in distributed denial-of-service.
Phishing -> Phishing websites and/or email ...
show more
[AUTORAVALT][[27/10/2026 - 10:50:21 -03:00 UTC]
Attack from [Google LLC]
[34.38.255.41][41.255.38.34.bc.googleusercontent.com]
Action: BLocKed
DDoS Attack -> Participating in distributed denial-of-service.
Phishing -> Phishing websites and/or email.
Web Spam -> Comment/forum spam, HTTP referer spam, or other CMS spam.
Blog Spam -> CMS blog comment spam.
Web A]
...
show less
DDoS Attack
Phishing
Web Spam
Blog Spam
Web App Attack
🇫🇷
pm33
2026-10-27 13:17:34
UTC ·
(2 weeks ago)
Probing for resource vulnerabilities HTTP(S)
Web App Attack
🇩🇪
D3vNu11
2026-10-27 13:05:20
UTC ·
(2 weeks ago)
Level: (LOW): Reputation Unknown via CitrixHoneypot IOC Country: Belgium 1x -> Target Country: Ashburn, USA HTTPS
Hacking
Web App Attack
Anonymous
2026-10-27 12:46:49
UTC ·
(2 weeks ago)
...
Bad Web Bot
🇺🇸
Player Unknown
2026-10-27 12:41:22
UTC ·
(2 weeks ago)
34.38.255.41 - - [27/Oct/2026:05:40:47 -0700] "07\xA0\x03\x02\x01`\xA100.0,\xA0*\x04(NTLMSSP\x00\x01\x00\x00\x00\xF7\xBA\xDB\xE2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 400 25 "-" "-"
34.38.255 ...
show more
34.38.255.41 - - [27/Oct/2026:05:40:47 -0700] "07\xA0\x03\x02\x01`\xA100.0,\xA0*\x04(NTLMSSP\x00\x01\x00\x00\x00\xF7\xBA\xDB\xE2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00" 400 25 "-" "-"
34.38.255.41 - - [27/Oct/2026:05:40:58 -0700] "0:\x02\x04\x1B\xB1{" 400 25 "-" "-"
34.38.255.41 - - [27/Oct/2026:05:41:09 -0700] "\x00\x00\x00C\x00\x12\x00\x00\x1E3\xF4\x81\x00\x1Fconsumer-Offset Explorer 2.2-18\x00\x12apache-kafka-java\x062.4.0\x00" 400 25 "-" "-"
34.38.255.41 - - [27/Oct/2026:05:41:14 -0700] "\x00\x00\x00#\x00\x03\x00\x00\x1E3\xF4\x81\x00" 400 25 "-" "-"
34.38.255.41 - - [27/Oct/2026:05:41:20 -0700] "*1" 400 25 "-" "-"
...
show less
Brute-Force
SSH
Anonymous
2026-10-27 12:08:09
UTC ·
(2 weeks ago)
34.38.255.41 - - [27/Oct/2026:13:08:07 +0100] "GET / HTTP/1.1" 403 6505 "-" "Mozilla/5.0 (compatible)"
34.38.255.41 - - [27/Oct/2026:13:08:08 +0100] "GET /pub/ HTTP/1.1" 403 6505 "-" "Mozilla/5.0 (compatible)"
...
Web App Attack
🇯🇵
gomasy
2026-10-27 11:43:18
UTC ·
(2 weeks ago)
_:443 34.38.255.41 - - [27/Oct/2026:20:43:16 +0900] ";\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xD4\x07\x00\x00\x00\x00\x00\x00admin.$cmd\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x14\x00\x00\x00\x01hello\x00\x00\x00\x00\x00\x00\x00\xF0?\x00" 500 170 "- ...
show more
_:443 34.38.255.41 - - [27/Oct/2026:20:43:16 +0900] ";\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xD4\x07\x00\x00\x00\x00\x00\x00admin.$cmd\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x14\x00\x00\x00\x01hello\x00\x00\x00\x00\x00\x00\x00\xF0?\x00" 500 170 "-" "-"
...
show less
Web App Attack
🇺🇸
3rdKey
2026-10-27 11:36:03
UTC ·
(2 weeks ago)
OpenCanary honeypot hit on port 443 (no legitimate service runs there); logtype 3000. Automated report.
Port Scan
Web App Attack
🇺🇸
NXTwoThou
2026-10-27 11:27:41
UTC ·
(2 weeks ago)
174.78
Web App Attack
🇩🇪
lumbermatt_de
2026-10-27 11:00:03
UTC ·
(2 weeks ago)
Excessive requests - Web bot activity
Bad Web Bot