Detectors: [CROWDSEC, NGINX] | Reasons: Targeting a decommissioned/expired domain name (historical d ...
show moreDetectors: [CROWDSEC, NGINX] | Reasons: Targeting a decommissioned/expired domain name (historical data recon) | CrowdSec: Security alert | Evidence: Persistent-Slow-Scanner (Strikes: 6), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96), Repeat-Offender (Past Bans: 5) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Detectors: [SURICATA, NGINX] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show moreDetectors: [SURICATA, NGINX] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | Suricata: Web Server attack | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*46,10:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.80) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Detectors: [SURICATA, NGINX] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show moreDetectors: [SURICATA, NGINX] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | Suricata: Web Server attack | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*46,10:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.80) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Detectors: [SURICATA, NGINX] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show moreDetectors: [SURICATA, NGINX] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | Suricata: Web Server attack | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*46,10:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.80) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Detectors: [SURICATA, NGINX] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show moreDetectors: [SURICATA, NGINX] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | Suricata: Web Server attack | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Detectors: [SURICATA, NGINX] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show moreDetectors: [SURICATA, NGINX] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | Suricata: Web Server attack | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Detectors: [CROWDSEC, NGINX] | Reasons: Targeting a decommissioned/expired domain name (historical d ...
show moreDetectors: [CROWDSEC, NGINX] | Reasons: Targeting a decommissioned/expired domain name (historical data recon) | CrowdSec: Reconnaissance scan | Evidence: High-Criminality-Signature (ja4:t13d2512h1 - Ratio:0.99) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:14123m)
show less