|
๐ป๐ณ
119.15.169.38
|
|
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
|
Port Scan
|
|
๐ฎ๐ณ
20.204.16.113
|
|
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Automated scan targeting an unaut ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Automated scan targeting an unauthorized host or default server sinkhole | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96), Repeat-Offender (Past Bans: 1) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
|
Port Scan
Bad Web Bot
Web App Attack
|
|
๐ฎ๐ณ
2405:201:c403:f805:cd3b:9efc:7d51:ad68
|
|
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Crimina ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Criminality-Signature (ja4:t12d190800 - Ratio:0.99), High-Criminality-Signature (p0f:*:64:0:*:mss*45,8:mss,nop,ws,nop,nop,sok:flow:0 - Ratio:0.97) | UA: Jetpack by WordPress.com | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:0m)
show less
|
Port Scan
Web App Attack
|
|
๐บ๐ธ
136.112.224.132
|
|
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
|
Port Scan
|
|
๐บ๐ธ
136.111.16.36
|
|
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
|
Port Scan
|
|
๐บ๐ธ
72.211.199.216
|
|
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
|
Port Scan
|
|
๐ฉ๐ช
2a01:4020:31:0:102::3f8
|
|
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h2 - Ratio:0.93) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:66845m)
show less
|
Port Scan
Exploited Host
|
|
๐ฉ๐ช
2a01:4020:31:0:102::3e
|
|
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i351300 - Ratio:0.93) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:35880m)
show less
|
Port Scan
Exploited Host
|
|
๐ฉ๐ช
2a01:4020:31:0:102::4cc
|
|
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h1 - Ratio:0.93) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:7707m)
show less
|
Port Scan
Exploited Host
|
|
๐ฉ๐ช
2a01:4020:31:0:102::207
|
|
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h2 - Ratio:0.93) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:36379m)
show less
|
Port Scan
Exploited Host
|
|
๐ฉ๐ช
2a01:4020:31:0:102::6c4
|
|
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i351300 - Ratio:0.93) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:50084m)
show less
|
Port Scan
Exploited Host
|
|
๐ฉ๐ช
2a01:4020:31:0:102::224
|
|
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h1 - Ratio:0.93) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:3508m)
show less
|
Port Scan
Exploited Host
|
|
๐ณ๐ฑ
217.60.242.58
|
|
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Nginx Honeypot: Sensitive configu ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Nginx Honeypot: Sensitive configuration file search | Evidence: Trusted-P0F-Signature (*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:PPPoE, Uptime:3028m)
show less
|
Web App Attack
Hacking
|
|
๐บ๐ธ
35.184.212.122
|
|
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Automated scan targeting an unaut ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Automated scan targeting an unauthorized host or default server sinkhole | Evidence: High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
|
Port Scan
Bad Web Bot
Web App Attack
|
|
๐ง๐ท
191.5.204.105
|
|
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.99), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96), OS-Signature-Mismatch (UA:Linux/p0f:Windows) | UA: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/86.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Windows (Link:PPPoE, Uptime:0m)
show less
|
Port Scan
Web App Attack
|
|
๐บ๐ธ
44.250.194.187
|
|
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (ja4:t13d2512h1 - Ratio:0.98), High-Criminality-Signature (ja4h:5284a4e8dcdc8b18d4c888678c3ea4b3 - Ratio:0.97) | UA: Mozilla/5.0 (compatible; wpbot/1.4; +https://forms.gle/ajBaxygz9jSR8p8G9) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:48810m)
show less
|
Port Scan
|
|
๐บ๐ฆ
31.129.232.94
|
|
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
|
Port Scan
|
|
๐ฆ๐บ
20.213.164.192
|
|
Detectors: [CROWDSEC] | Reasons: CrowdSec: Security alert | Evidence: Persistent-Slow-Scanner (Strik ...
show more
Detectors: [CROWDSEC] | Reasons: CrowdSec: Security alert | Evidence: Persistent-Slow-Scanner (Strikes: 4), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96), Repeat-Offender (Past Bans: 3) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
|
Web App Attack
|
|
๐ท๐บ
89.188.180.33
|
|
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 2)
show less
|
Port Scan
|
|
๐ธ๐ฆ
176.45.33.55
|
|
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.99), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96), OS-Signature-Mismatch (UA:Linux/p0f:Windows) | UA: Mozilla/5.0 (Linux; Android 10; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Windows (Link:PPPoE, Uptime:0m)
show less
|
Port Scan
Web App Attack
|
|
๐ฆ๐ท
190.111.215.78
|
|
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
|
Port Scan
|
|
๐ฆ๐ท
186.22.54.242
|
|
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
|
Port Scan
|
|
๐บ๐ธ
35.224.238.166
|
|
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
|
Port Scan
|
|
๐ฆ๐ท
186.19.199.87
|
|
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
|
Port Scan
|
|
๐จ๐ณ
114.245.216.60
|
|
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
|
Port Scan
|