๐น๐ผ
34.80.245.83
29 Sep 2026
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Automated scan targeting an un ...
show more
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Automated scan targeting an unauthorized host or default server sinkhole | Evidence: Verified-Bot-JA4-Match (t13d1516h2) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Web App Attack
Hacking
Port Scan
Bad Web Bot
๐บ๐ธ
34.214.208.81
29 Sep 2026
Detectors: [NGINX, CROWDSEC, NGINX-TRIAGE] | Reasons: challenge_failed | CrowdSec: Reconnaissance sc ...
show more
Detectors: [NGINX, CROWDSEC, NGINX-TRIAGE] | Reasons: challenge_failed | CrowdSec: Reconnaissance scan | Nginx: Proactive Triage | Evidence: High-Criminality-Signature (ja4:t13d1712h1 - Ratio:0.82) | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/44.0.2403.157 Safari/537.36 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:1000m)
show less
Port Scan
Web App Attack
๐ช๐ธ
135.129.231.101
29 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.98), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96) | UA: Mozilla/5.0 (Windows NT 6.3; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Windows (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐ณ๐ฑ
34.178.221.145
29 Sep 2026
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Automated scan targeting an un ...
show more
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Automated scan targeting an unauthorized host or default server sinkhole | Evidence: Verified-Bot-JA4-Match (t13d1516h2) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Web App Attack
Hacking
Port Scan
Bad Web Bot
๐บ๐ธ
8.229.31.135
29 Sep 2026
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Automated scan targeting an un ...
show more
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Automated scan targeting an unauthorized host or default server sinkhole | Evidence: Verified-Bot-JA4-Match (t13d1516h2) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Web App Attack
Hacking
Port Scan
Bad Web Bot
๐ง๐ช
207.175.217.243
29 Sep 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐ฐ๐ท
20.214.191.94
29 Sep 2026
Detectors: [CROWDSEC] | Reasons: CrowdSec: Security alert | Evidence: High-Criminality-Signature (p0 ...
show more
Detectors: [CROWDSEC] | Reasons: CrowdSec: Security alert | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.97), Repeat-Offender (Past Bans: 1) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Web App Attack
๐ป๐ณ
103.146.23.23
29 Sep 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐น๐ผ
35.229.170.87
29 Sep 2026
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Automated scan targeting an un ...
show more
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Automated scan targeting an unauthorized host or default server sinkhole | Evidence: Verified-Bot-JA4-Match (t13d1516h2) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Web App Attack
Hacking
Port Scan
Bad Web Bot
๐ฎ๐ณ
20.198.74.230
29 Sep 2026
Detectors: [CROWDSEC] | Reasons: CrowdSec: Security alert | Evidence: Persistent-Slow-Scanner (Strik ...
show more
Detectors: [CROWDSEC] | Reasons: CrowdSec: Security alert | Evidence: Persistent-Slow-Scanner (Strikes: 4), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.97), Repeat-Offender (Past Bans: 3) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Web App Attack
๐บ๐ฆ
94.131.213.241
29 Sep 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ฐ๐ท
20.194.96.176
29 Sep 2026
Detectors: [NGINX, CROWDSEC] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show more
Detectors: [NGINX, CROWDSEC] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | CrowdSec: Security alert | Evidence: Persistent-Slow-Scanner (Strikes: 7), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.97), Repeat-Offender (Past Bans: 6) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Web App Attack
Port Scan
Bad Web Bot
๐ฆ๐บ
20.28.180.172
29 Sep 2026
Detectors: [CROWDSEC] | Reasons: CrowdSec: Security alert | Evidence: High-Criminality-Signature (p0 ...
show more
Detectors: [CROWDSEC] | Reasons: CrowdSec: Security alert | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.97), Repeat-Offender (Past Bans: 1) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Web App Attack
๐ฉ๐ช
2001:4ba0:cafe:c13::1
29 Sep 2026
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previ ...
show more
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban | Evidence: Persistent-Slow-Scanner (Strikes: 6), TCP/IP-Spoofing-Detected (bad_sw: 2), Repeat-Offender (Past Bans: 4) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36 Edg/91.0.864.54 | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:18090m)
show less
Port Scan
Web App Attack
๐ฉ๐ช
88.214.25.125
29 Sep 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Persistent-Slow-Scanner (Strikes: 4), Repeat-Offender (Past Bans: 3)
show less
Port Scan
๐บ๐ฟ
185.78.138.99
29 Sep 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ช๐ธ
79.108.228.134
29 Sep 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ป๐ณ
180.93.238.65
29 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Truste ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Trusted-P0F-Signature (*:128:0:*:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) | TCP Fingerprint: Modern Windows (Link:PPPoE, Uptime:0m)
show less
Hacking
Web App Attack
๐ณ๐ฑ
172.94.9.57
29 Sep 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 2)
show less
Port Scan
๐จ๐ณ
101.96.192.45
29 Sep 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐จ๐ฑ
201.215.33.91
29 Sep 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ท๐บ
217.28.220.229
29 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Truste ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Trusted-P0F-Signature (*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0) | UA: Python/3.10 aiohttp/3.14.3 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:PPPoE, Uptime:41288m)
show less
Hacking
Web App Attack
๐ณ๐ฑ
34.7.17.70
29 Sep 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐ณ๐ฑ
93.123.109.214
29 Sep 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ง๐ช
35.240.60.231
29 Sep 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:66761m)
show less
Port Scan
Exploited Host