πΊπΈ
136.108.8.198
29 Aug 2026
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Targeting a decommissioned/exp ...
show more
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Targeting a decommissioned/expired domain name (historical data recon) | Evidence: Verified-Bot-JA4-Match (t13d1516h2) | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:22323m)
show less
Bad Web Bot
Web App Attack
Hacking
πΊπΈ
50.41.7.175
29 Aug 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π§π«
102.180.170.153
29 Aug 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π¨π³
60.188.249.64
29 Aug 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
πΊπΈ
20.168.116.255
29 Aug 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: Known-Scanner-UA (Mozilla/5.0 zgrab/0.x), H ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: Known-Scanner-UA (Mozilla/5.0 zgrab/0.x), High-Criminality-Signature (p0f:*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.96) | UA: Mozilla/5.0 zgrab/0.x | TCP Fingerprint: Linux (Legacy/Embedded) (Link:IPIP or SIT, Uptime:0m)
show less
Port Scan
πΊπΈ
192.241.179.235
29 Aug 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π¨π³
36.32.3.129
29 Aug 2026
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evid ...
show more
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.99) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
π¨π³
144.123.77.119
29 Aug 2026
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evid ...
show more
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i130900 - Ratio:0.96), High-Criminality-Signature (p0f:*:64:0:*:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.99) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
π¨π³
118.212.123.74
29 Aug 2026
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evid ...
show more
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.99) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
π¨π³
122.96.28.104
29 Aug 2026
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evid ...
show more
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.99) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
π¨π³
1.24.16.117
29 Aug 2026
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evid ...
show more
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.99) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
π¨π³
182.119.227.34
29 Aug 2026
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evid ...
show more
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.99) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
π¬π
154.162.36.130
29 Aug 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.99), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.99), OS-Signature-Mismatch (UA:Linux/p0f:Windows) | UA: Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Safari/15.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Windows (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
Web App Attack
π»π³
165.101.46.64
29 Aug 2026
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evid ...
show more
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.96) | TCP Fingerprint: Linux (Legacy/Embedded) (Link:PPPoE, Uptime:17787m)
show less
Port Scan
πΊπΈ
40.124.82.215
29 Aug 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: Known-Scanner-UA (Mozilla/5.0 zgrab/0.x), H ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: Known-Scanner-UA (Mozilla/5.0 zgrab/0.x), High-Criminality-Signature (ja4:t13i190800 - Ratio:0.95), High-Criminality-Signature (p0f:*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.96) | UA: Mozilla/5.0 zgrab/0.x | TCP Fingerprint: Linux (Legacy/Embedded) (Link:IPIP or SIT, Uptime:23444m)
show less
Port Scan
π°π·
34.64.206.159
29 Aug 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-C ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d1011h1 - Ratio:0.97), High-Criminality-Signature (ja4h:5cf9f33397d2cfab2c8ca2fd9e424522 - Ratio:0.97) | UA: crusader-worker/1.0 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:66990m)
show less
Hacking
Web App Attack
π¨π³
106.12.170.135
29 Aug 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π§π·
191.242.231.67
29 Aug 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
πΊπΈ
34.139.96.197
29 Aug 2026
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Targeting a decommissioned/exp ...
show more
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Targeting a decommissioned/expired domain name (historical data recon) | Evidence: Verified-Bot-JA4-Match (t13d1516h2) | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:57729m)
show less
Bad Web Bot
Web App Attack
Hacking
π¬πͺ
194.32.242.133
29 Aug 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 2)
show less
Port Scan
π·π΄
2.57.122.238
29 Aug 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 2)
show less
Port Scan
πͺπΈ
81.172.78.210
29 Aug 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π²π¬
154.120.138.30
29 Aug 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π·πΊ
178.249.244.158
29 Aug 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 1)
show less
Port Scan
π·πͺ
83.198.180.194
29 Aug 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan