๐ช๐ธ
146.70.59.160
09 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ธ๐ช
185.246.128.170
09 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ธ๐ช
89.37.63.136
09 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previ ...
show more
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban | Evidence: Repeat-Offender (Past Bans: 2) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Chrome/120.0.0.0 Safari/537.36 | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐บ๐ธ
34.28.229.128
09 Oct 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐บ๐ธ
34.59.239.130
09 Oct 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐ป๐ณ
117.5.151.172
09 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐บ๐ธ
35.238.138.59
09 Oct 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐ฆ๐บ
20.92.77.159
09 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previ ...
show more
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96), Repeat-Offender (Past Bans: 1) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Port Scan
Web App Attack
๐ฏ๐ต
20.210.186.186
09 Oct 2026
Detectors: [NGINX] | Reasons: Targeting a decommissioned/expired domain name (historical data recon) ...
show more
Detectors: [NGINX] | Reasons: Targeting a decommissioned/expired domain name (historical data recon) | Evidence: Persistent-Slow-Scanner (Strikes: 6), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96), Repeat-Offender (Past Bans: 5) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Bad Web Bot
Web App Attack
๐ฆ๐บ
20.92.239.62
09 Oct 2026
Detectors: [CROWDSEC] | Reasons: CrowdSec: Security alert | Evidence: Persistent-Slow-Scanner (Strik ...
show more
Detectors: [CROWDSEC] | Reasons: CrowdSec: Security alert | Evidence: Persistent-Slow-Scanner (Strikes: 4), High-Criminality-Signature (ja4h:42e3de08c65b1ee25ee407fa6b622dac - Ratio:0.96), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96), Repeat-Offender (Past Bans: 3) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Web App Attack
๐ญ๐ฐ
154.194.251.254
09 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 1)
show less
Port Scan
๐ฌ๐ง
2a01:4020:1:1:102::9
09 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h2 - Ratio:0.94) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:500m)
show less
Port Scan
Exploited Host
๐ฌ๐ง
2a01:4020:1:1:102::27a
09 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i351300 - Ratio:0.94) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:15760m)
show less
Port Scan
Exploited Host
๐ฌ๐ง
2a01:4020:1:1:102::63e
09 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h1 - Ratio:0.94) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:50002m)
show less
Port Scan
Exploited Host
๐ฌ๐ง
2a01:4020:1:1:102::38d
09 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h2 - Ratio:0.94) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:20923m)
show less
Port Scan
Exploited Host
๐ฌ๐ง
2a01:4020:1:1:102::c7
09 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i351300 - Ratio:0.94) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:15565m)
show less
Port Scan
Exploited Host
๐ฌ๐ง
2a01:4020:1:1:102::56
09 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h1 - Ratio:0.94) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:9566m)
show less
Port Scan
Exploited Host
๐ฎ๐ณ
2409:40c1:6024:7730:cb7:d532:625c:df7d
09 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.99), High-Criminality-Signature (p0f:*:64:0:*:65535,8:mss,nop,ws,nop,nop,sok:flow:0 - Ratio:0.95) | UA: Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.0.0 Safari/537.36 | TCP Fingerprint: Unknown (Link:Unknown, Uptime:0m)
show less
Port Scan
Web App Attack
๐ช๐ธ
84.236.230.25
09 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.99), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96) | UA: Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/80.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Windows (Link:Unknown, Uptime:0m)
show less
Port Scan
Web App Attack
๐ญ๐ฐ
40.83.95.41
09 Oct 2026
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Automated scan targeting an unaut ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Automated scan targeting an unauthorized host or default server sinkhole | Evidence: Persistent-Slow-Scanner (Strikes: 7), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96), Repeat-Offender (Past Bans: 6) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Port Scan
Bad Web Bot
Web App Attack
๐บ๐ธ
44.251.85.7
09 Oct 2026
Detectors: [CROWDSEC, NGINX] | Reasons: Targeting a decommissioned/expired domain name (historical d ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: Targeting a decommissioned/expired domain name (historical data recon) | CrowdSec: Reconnaissance scan | Evidence: High-Criminality-Signature (ja4:t13d2512h1 - Ratio:0.98) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:37842m)
show less
Port Scan
Web App Attack
Bad Web Bot
๐จ๐ณ
42.101.43.119
09 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ฎ๐ฉ
103.140.79.92
09 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ง๐ช
34.76.217.11
09 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ป๐ช
190.120.253.61
09 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Crimina ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Criminality-Signature (ja4:t12d190800 - Ratio:0.99), High-Criminality-Signature (p0f:*:128:0:*:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.85) | UA: Mozilla/5.0 (Windows NT 6.2; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/74.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Windows (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack