🇧🇷
SOC Blue Team
2026-07-15 09:25:53
(2 days ago)
IPs get by Hunting on SIEM
Phishing
Web Spam
Port Scan
Hacking
🇨🇭
GAS
2026-07-15 07:08:20
(2 days ago)
Direct IP access.
34.53.164.197 - - [15/Jul/2026:09:08:18 +0200] "\x16\x03" 400 392 "-" "-" "-" "-"
...
show more
Direct IP access.
34.53.164.197 - - [15/Jul/2026:09:08:18 +0200] "\x16\x03" 400 392 "-" "-" "-" "-"
34.53.164.197 - - [15/Jul/2026:09:08:19 +0200] "GET / HTTP/1.1" 402 2769 "-" "Mozilla/5.0 (compatible; nmap-http-info)" "REDACTED" ""
...
show less
Port Scan
Web App Attack
🇺🇸
gu-alvareza
2026-07-15 07:05:38
(2 days ago)
Java.Debug.Wire.Protocol.Insecure.Configuration
Hacking
🇮🇩
PENJAGA.AUM
2026-07-15 07:00:14
(2 days ago)
34.53.164.197 - Attack: Possible XSS attack, script tag
Web App Attack
SQL Injection
Spoofing
🇺🇸
conrad10781
2026-07-15 06:29:22
(2 days ago)
nginx-direct-ip
Port Scan
🇧🇷
mubusys.com
2026-07-15 05:52:36
(2 days ago)
34.53.164.197 - - [15/Jul/2026:02:52:24 -0300] "\x16\x03\x01\x05\xC4\x01\x00\x05\xC0\x03\x03\xC4-\x1 ...
show more
34.53.164.197 - - [15/Jul/2026:02:52:24 -0300] "\x16\x03\x01\x05\xC4\x01\x00\x05\xC0\x03\x03\xC4-\x1F\xF6\xFC*<\xC9P\xF3s\xE4)\xE10\xF7PGwL\xD6\x5C\x83\xBDd\x07\xBF{C\xB1\x1Ek \x1E\x8DP&\x7F\x07-\xEFc!\x19\xF4D\x94\xBA\xD7|\x86C\xC4I=\xADU{\xCF\x10iz\x82)\xDB\x002\xC0+\xC0/\xC0,\xC00\xCC\xA9\xCC\xA8\xC0\x09\xC0\x13\xC0" 400 157 "-" "-" "-"
34.53.164.197 - - [15/Jul/2026:02:52:29 -0300] ";\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xD4\x07\x00\x00\x00\x00\x00\x00admin.$cmd\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x14\x00\x00\x00\x01hello\x00\x00\x00\x00\x00\x00\x00\xF0?\x00" 400 157 "-" "-" "-"
show less
Hacking
Brute-Force
🇺🇸
itsnixk
2026-07-15 05:47:02
(2 days ago)
(mod_security) mod_security (id:920350) triggered by 34.53.164.197 (BE/Belgium/197.164.53.34.bc.goog ...
show more
(mod_security) mod_security (id:920350) triggered by 34.53.164.197 (BE/Belgium/197.164.53.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Jul 15 01:46:56.545697 2026] [security2:error] [pid 218453:tid 218854] [client 34.53.164.197:62294] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "alce0EWkXZ-tpiK2k6U0OQAAANo"]
show less
Port Scan
🇩🇪
nyt
2026-07-15 05:26:46
(2 days ago)
Empty UA + error
Web App Attack
🇩🇪
dpsbs
2026-07-15 05:22:37
(2 days ago)
multiple ips intrustions detected
Hacking
🇩🇪
MaxMeier
2026-07-15 05:18:19
(2 days ago)
34.53.164.197 - - [15/Jul/2026:07:16:59 +0200] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 1 ...
show more
34.53.164.197 - - [15/Jul/2026:07:16:59 +0200] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
34.53.164.197 - - [15/Jul/2026:07:16:59 +0200] "\x16\x03\x01\x05\xC4\x01\x00\x05\xC0\x03\x03J\xEFA\xB2\x14\x17\x9B\x96, " 400 150 "-" "-"
34.53.164.197 - - [15/Jul/2026:07:17:00 +0200] "GET / HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
34.53.164.197 - - [15/Jul/2026:07:17:05 +0200] ";\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x00\xD4\x07\x00\x00\x00\x00\x00\x00admin.$cmd\x00\x00\x00\x00\x00\xFF\xFF\xFF\xFF\x14\x00\x00\x00\x01hello\x00\x00\x00\x00\x00\x00\x00\xF0?\x00" 400 150 "-" "-"
34.53.164.197 - - [15/Jul/2026:07:17:05 +0200] "\xF9~y\x89\xDC\x9D\x03\x85\xEF\xD7\xCD\xEF\xDB\xA7d\xCD\xA5+F\x03OY\x8B\xA0\xA5\xB1\xECp\x5C\xF2Wa\xE1\xEF\x04\xDA}\xF3{#\x0F\x82\xC0\xEAT\xBF\xFA\xBF\x98z\xE0:h\xCF\x07=\x5CWM\x5C\xA66/\
...
show less
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-07-15 05:17:34
(2 days ago)
IPS detection: Nmap.Script.Scanner
Port Scan
🇫🇷
pm33
2026-07-15 05:00:43
(2 days ago)
Probing for resource vulnerabilities HTTP(S)
Web App Attack
🇦🇺
dyln
2026-07-15 04:40:17
(2 days ago)
Dyls honeypot brute-force: proto8 (1 total hits)
Brute-Force
🇳🇴
jad-abuse
2026-07-15 04:30:49
(2 days ago)
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: tls_probe ...
show more
ActiveDefense automated detection: malicious HTTP scanning / exploit attempts. Signatures: tls_probe. Observed by 1 sensor(s); 6 hits.
show less
Port Scan
Bad Web Bot
🇹🇷
ozyurterdem
2026-07-15 04:00:28
(2 days ago)
T-Pot Suricata IDS: 3 alert(s) in 24h. SiberKale Threat Intel (unknown-bad filtered).
Hacking
IoT Targeted