๐บ๐ธ
18.145.244.68
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-C ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d4312h1 - Ratio:0.95), High-Criminality-Signature (p0f:*:64:0:*:62727,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.97), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:21409m)
show less
Hacking
Web App Attack
๐น๐ผ
35.229.139.138
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-C ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d101000 - Ratio:0.96), High-Criminality-Signature (ja4h:5c0bd253f95ea229356b13014e1fd816 - Ratio:0.95), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:40617m)
show less
Hacking
Web App Attack
๐น๐ผ
35.229.253.248
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-C ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d101000 - Ratio:0.96), High-Criminality-Signature (ja4h:5c0bd253f95ea229356b13014e1fd816 - Ratio:0.94), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:42039m)
show less
Hacking
Web App Attack
๐บ๐ธ
34.20.219.133
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Exploitation / Shell attempt | Evidence: High-Criminal ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Exploitation / Shell attempt | Evidence: High-Criminality-Signature (ja4:t13d1011h1 - Ratio:0.98), High-Criminality-Signature (ja4h:5cf9f33397d2cfab2c8ca2fd9e424522 - Ratio:0.97) | UA: crusader-worker/1.0 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:23113m)
show less
Hacking
๐ฏ๐ต
34.146.104.73
04 Sep 2026
Detectors: [SURICATA, NGINX] | Reasons: Suricata: Web Server attack | Nginx Honeypot: Sensitive conf ...
show more
Detectors: [SURICATA, NGINX] | Reasons: Suricata: Web Server attack | Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d1011h1 - Ratio:0.97), High-Criminality-Signature (ja4h:5cf9f33397d2cfab2c8ca2fd9e424522 - Ratio:0.97) | UA: crusader-worker/1.0 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:1759m)
show less
Hacking
Web App Attack
๐ซ๐ท
161.97.124.90
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Trusted-JA4- ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Trusted-JA4-Signature (t13d1312h2), High-Criminality-Signature (p0f:*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.95), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:154.0) Gecko/20100101 Firefox/154.0 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:PPPoE, Uptime:9611m)
show less
Port Scan
Web App Attack
๐ฏ๐ต
193.123.160.108
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Repeat-Offen ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Repeat-Offender (Past Bans: 2) | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_1) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Safari/605.1.15 | TCP Fingerprint: Legacy Windows (XP/2003) (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐ต๐ฐ
124.29.214.69
04 Sep 2026
Detectors: [SURICATA, NGINX] | Reasons: Suricata: Exploit attempt | Automated scan targeting an unau ...
show more
Detectors: [SURICATA, NGINX] | Reasons: Suricata: Exploit attempt | Automated scan targeting an unauthorized host or default server sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*10,5:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.95) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:IPIP or SIT, Uptime:0m)
show less
Port Scan
Bad Web Bot
Hacking
๐น๐ผ
104.199.236.38
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-C ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d101000 - Ratio:0.96), High-Criminality-Signature (ja4h:5c0bd253f95ea229356b13014e1fd816 - Ratio:0.94), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:37899m)
show less
Hacking
Web App Attack
๐น๐ผ
35.201.136.76
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-C ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d101000 - Ratio:1.00), High-Criminality-Signature (ja4h:5c0bd253f95ea229356b13014e1fd816 - Ratio:1.00), OS-Signature-Mismatch (UA:Windows/p0f:Linux), Repeat-Offender (Past Bans: 1) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:13559m)
show less
Hacking
Web App Attack
๐ง๐ช
207.175.52.39
04 Sep 2026
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:22957m)
show less
Port Scan
Exploited Host
๐ง๐ช
207.175.106.219
04 Sep 2026
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:52744m)
show less
Port Scan
Exploited Host
๐น๐ผ
34.80.114.37
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-C ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d101000 - Ratio:0.96), High-Criminality-Signature (ja4h:5c0bd253f95ea229356b13014e1fd816 - Ratio:0.94), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:13710m)
show less
Hacking
Web App Attack
๐ญ๐ฐ
34.96.200.36
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-C ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d101000 - Ratio:1.00), High-Criminality-Signature (ja4h:5c0bd253f95ea229356b13014e1fd816 - Ratio:1.00), OS-Signature-Mismatch (UA:Windows/p0f:Linux), Repeat-Offender (Past Bans: 1) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:39586m)
show less
Hacking
Web App Attack
๐ฐ๐ท
39.121.165.14
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.99), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Linux/p0f:Windows) | UA: Mozilla/5.0 (Linux; Android 10; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/60.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Windows (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐ง๐ช
34.53.169.45
04 Sep 2026
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:37094m)
show less
Port Scan
Exploited Host
๐บ๐ธ
20.106.19.228
04 Sep 2026
Detectors: [nginx_monitor, NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on ...
show more
Detectors: [nginx_monitor, NGINX] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.95) | TCP Fingerprint: Linux (Legacy/Embedded) (Link:IPIP or SIT, Uptime:29691m)
show less
Port Scan
๐ซ๐ท
51.15.215.70
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previ ...
show more
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.95), OS-Signature-Mismatch (UA:Windows/p0f:Linux), Repeat-Offender (Past Bans: 1) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:PPPoE, Uptime:33285m)
show less
Port Scan
Web App Attack
๐บ๐ธ
35.231.170.94
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-C ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d101000 - Ratio:0.96), High-Criminality-Signature (ja4h:5c0bd253f95ea229356b13014e1fd816 - Ratio:0.93), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:59337m)
show less
Hacking
Web App Attack
๐น๐ผ
104.199.141.7
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-C ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d101000 - Ratio:0.95), High-Criminality-Signature (ja4h:5c0bd253f95ea229356b13014e1fd816 - Ratio:0.93), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:13126m)
show less
Hacking
Web App Attack
๐น๐ผ
34.81.90.137
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-C ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d101000 - Ratio:0.95), High-Criminality-Signature (ja4h:5c0bd253f95ea229356b13014e1fd816 - Ratio:0.92), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:25631m)
show less
Hacking
Web App Attack
๐น๐ผ
35.194.215.35
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-C ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d101000 - Ratio:0.95), High-Criminality-Signature (ja4h:5c0bd253f95ea229356b13014e1fd816 - Ratio:0.92), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:34003m)
show less
Hacking
Web App Attack
๐บ๐ธ
34.228.237.218
04 Sep 2026
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Reconnaissance scan | Nginx Honeypot: Sensitive co ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Reconnaissance scan | Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (p0f:*:64:0:*:62727,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.97) | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:59601m)
show less
Hacking
Web App Attack
Port Scan
๐บ๐ธ
34.73.62.26
04 Sep 2026
Detectors: [SURICATA, NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost a ...
show more
Detectors: [SURICATA, NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban | Suricata: Web Server attack | Evidence: Persistent-Slow-Scanner (Strikes: 6), Verified-Bot-JA4-Match (t13d1516h2), Repeat-Offender (Past Bans: 5) | UA: Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/149.0.0.0 Mobile Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:48725m)
show less
Port Scan
Web App Attack
Hacking
๐น๐ผ
34.81.210.188
04 Sep 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-C ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: High-Criminality-Signature (ja4:t13d101000 - Ratio:0.95), High-Criminality-Signature (ja4h:5c0bd253f95ea229356b13014e1fd816 - Ratio:0.91), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:49089m)
show less
Hacking
Web App Attack