๐จ๐ณ
60.166.82.17
11 Oct 2026
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evid ...
show more
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.96) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐จ๐ณ
106.117.105.136
11 Oct 2026
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evid ...
show more
Detectors: [NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.96) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐จ๐ณ
47.106.35.158
11 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previ ...
show more
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban | Evidence: Malformed-Connection-Structure, High-Criminality-Signature (p0f:*:64:0:*:mss*22,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:1.00), Repeat-Offender (Past Bans: 1) | UA: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐ฉ๐ช
193.148.56.90
11 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐จ๐ณ
36.108.214.78
11 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 1)
show less
Port Scan
๐บ๐ธ
35.223.149.83
11 Oct 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐บ๐ธ
35.223.69.81
11 Oct 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐ต๐ฑ
45.138.12.188
11 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Truste ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Trusted-P0F-Signature (*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0), High-Criminality-Signature (ja4:t13d251100 - Ratio:0.90) | UA: Mozilla/5.0 (X11; Linux i686; rv:1.9.6.20) Gecko/ Firefox/4.0 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:PPPoE, Uptime:7747m)
show less
Hacking
Web App Attack
๐บ๐ธ
34.60.212.205
11 Oct 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐บ๐ธ
2604:a00:5:2032:9e6b:ff:fe39:805c
11 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previ ...
show more
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban | Evidence: Repeat-Offender (Past Bans: 1) | UA: wp-cve-2026-87902-validator/1.0 | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:10759m)
show less
Port Scan
Web App Attack
๐ฌ๐ง
2a01:4020:1:1:102::73f
11 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h2 - Ratio:0.95) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:19563m)
show less
Port Scan
Exploited Host
๐ฌ๐ง
2a01:4020:1:1:102::4cd
11 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i351300 - Ratio:0.95) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:27363m)
show less
Port Scan
Exploited Host
๐ฌ๐ง
2a01:4020:1:1:102::d9
11 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h1 - Ratio:0.95) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:27660m)
show less
Port Scan
Exploited Host
๐ฌ๐ง
2a01:4020:1:1:102::314
11 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h2 - Ratio:0.95) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:31001m)
show less
Port Scan
Exploited Host
๐ฌ๐ง
2a01:4020:1:1:102::1d6
11 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i351300 - Ratio:0.95) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:47336m)
show less
Port Scan
Exploited Host
๐ฌ๐ง
2a01:4020:1:1:102::468
11 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h1 - Ratio:0.95) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:12059m)
show less
Port Scan
Exploited Host
๐ฉ๐ช
34.40.23.40
11 Oct 2026
Detectors: [SURICATA, NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost a ...
show more
Detectors: [SURICATA, NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban | Suricata: Web Server attack | Evidence: Persistent-Slow-Scanner (Strikes: 5), High-Criminality-Signature (p0f:*:64:0:*:mss*46,10:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.81), OS-Signature-Mismatch (UA:Windows/p0f:Linux), Repeat-Offender (Past Bans: 4) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/153.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Web App Attack
Hacking
Port Scan
๐บ๐ธ
35.237.80.53
11 Oct 2026
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Automated scan targeting an unaut ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Automated scan targeting an unauthorized host or default server sinkhole | Evidence: High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
Bad Web Bot
Web App Attack
๐บ๐ธ
35.231.17.226
11 Oct 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐บ๐ธ
132.196.60.168
11 Oct 2026
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Automated scan targeting an unaut ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Automated scan targeting an unauthorized host or default server sinkhole | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Port Scan
Bad Web Bot
Web App Attack
๐ธ๐ฌ
146.235.21.143
11 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | UA: WebSiphon/ne ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | UA: WebSiphon/next-0.1 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:0m)
show less
Hacking
Web App Attack
๐ธ๐ฌ
161.118.205.249
11 Oct 2026
Detectors: [CROWDSEC, NGINX_BURST, NGINX] | Reasons: Nginx: Default server trap hit | CrowdSec: Secu ...
show more
Detectors: [CROWDSEC, NGINX_BURST, NGINX] | Reasons: Nginx: Default server trap hit | CrowdSec: Security alert | Rapid burst scanning (10+ blocked requests in 60s) | UA: WebSiphon/next-0.1 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:63196m)
show less
Port Scan
Exploited Host
Web App Attack
๐ฎ๐ท
81.163.0.91
11 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: OS-Signature-Mismatch (UA:W ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.116 Safari/537.36 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:0m)
show less
Port Scan
Exploited Host
๐ง๐ฉ
103.132.185.209
11 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 1)
show less
Port Scan
๐ญ๐ฐ
154.83.15.221
11 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan