๐ง๐ช
35.205.83.66
08 Oct 2026
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.96), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:15902m)
show less
Port Scan
Exploited Host
๐บ๐ธ
2602:fa59:10:253::1
08 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Verifi ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Verified-Bot-JA4-Match (t13d131100), Trusted-JA4-Signature (t13d131100), High-Criminality-Signature (ja4h:c308f84e3b7796240a9cfa5ec1c6880f - Ratio:0.93), Repeat-Offender (Past Bans: 1) | UA: Mozilla/5.0 (X11; Linux x86_64) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:36328m)
show less
Hacking
Web App Attack
๐ง๐ช
34.78.185.124
08 Oct 2026
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.96), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:27970m)
show less
Port Scan
Exploited Host
๐ฆ๐ท
186.138.43.235
08 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 2)
show less
Port Scan
๐ง๐ช
34.78.89.88
08 Oct 2026
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:2598m)
show less
Port Scan
Exploited Host
๐จ๐ณ
222.138.125.125
08 Oct 2026
Detectors: [SURICATA, NGINX] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show more
Detectors: [SURICATA, NGINX] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | Suricata: Exploit attempt | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:0m)
show less
Hacking
Port Scan
Bad Web Bot
๐ธ๐ฌ
182.55.114.80
08 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ง๐ช
34.79.246.221
08 Oct 2026
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:30596m)
show less
Port Scan
Exploited Host
๐ฌ๐ช
212.58.103.54
08 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ง๐ช
34.77.6.19
08 Oct 2026
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [nginx_monitor, NGINX] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:57861m)
show less
Port Scan
Exploited Host
๐ฎ๐ณ
20.219.185.206
08 Oct 2026
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Automated scan targeting an unaut ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Automated scan targeting an unauthorized host or default server sinkhole | Evidence: Persistent-Slow-Scanner (Strikes: 5), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96), Repeat-Offender (Past Bans: 4) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Port Scan
Bad Web Bot
Web App Attack
๐ฐ๐ท
52.141.3.247
08 Oct 2026
Detectors: [CROWDSEC] | Reasons: CrowdSec: Security alert | Evidence: High-Criminality-Signature (p0 ...
show more
Detectors: [CROWDSEC] | Reasons: CrowdSec: Security alert | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96), Repeat-Offender (Past Bans: 2) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Web App Attack
๐ณ๐ฑ
45.225.135.20
08 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Persistent-Slow-Scanner (Strikes: 7), Repeat-Offender (Past Bans: 6)
show less
Port Scan
๐บ๐ธ
70.22.243.138
08 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ฏ๐ต
20.210.186.186
08 Oct 2026
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Automated scan targeting an unaut ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Automated scan targeting an unauthorized host or default server sinkhole | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96), Repeat-Offender (Past Bans: 2) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Port Scan
Bad Web Bot
Web App Attack
๐ฎ๐ณ
103.174.104.12
08 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Exploitation / Shell attempt | Evidence: High-Criminal ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Exploitation / Shell attempt | Evidence: High-Criminality-Signature (ja4h:e0264a3100bfa47758587ac4545f447d - Ratio:0.92), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:Unknown, Uptime:0m)
show less
Hacking
๐ฏ๐ต
2400:8d60:8::96b0:ddfd
08 Oct 2026
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Nginx Honeypot: Sensitive configu ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: CrowdSec: Security alert | Nginx Honeypot: Sensitive configuration file search | Evidence: Repeat-Offender (Past Bans: 2) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:3150m)
show less
Web App Attack
Hacking
๐ง๐ฉ
103.217.108.231
08 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Exploitation / Shell attempt | Evidence: Trusted-P0F-S ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Exploitation / Shell attempt | Evidence: Trusted-P0F-Signature (*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0), High-Criminality-Signature (ja4h:e0264a3100bfa47758587ac4545f447d - Ratio:0.92), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:PPPoE, Uptime:0m)
show less
Hacking
๐จ๐ญ
31.165.193.102
08 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐บ๐ธ
34.173.148.32
08 Oct 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: High-Criminality-Signature (p0f:*:64:0:*:ms ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98) | UA: python-requests/2.32.5 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐จ๐ฆ
85.217.149.18
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ฐ๐ท
104.250.184.6
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: High-Criminality-Signature (ja4:t13i251000 - Ratio:0.91) | UA: Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:0m)
show less
Port Scan
Exploited Host
๐บ๐ธ
35.95.58.125
07 Oct 2026
Detectors: [CROWDSEC, NGINX] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | CrowdSec: Reconnaissance scan | Evidence: URL-Found-In-UA, High-Criminality-Signature (ja4:t13d2512h1 - Ratio:0.98), High-Criminality-Signature (ja4h:5284a4e8dcdc8b18d4c888678c3ea4b3 - Ratio:0.97) | UA: Mozilla/5.0 (compatible; wpbot/1.4; +https://forms.gle/ajBaxygz9jSR8p8G9) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:23292m)
show less
Port Scan
Bad Web Bot
Web App Attack
๐บ๐ธ
23.137.104.67
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Trusted-P0F- ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Trusted-P0F-Signature (*:128:0:*:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0) | UA: Mozilla/6.4 (Windows NT 11.1) Gecko/2010102 Firefox/99.0 | TCP Fingerprint: Modern Windows (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐ด๐ฒ
2001:1670:1a:4982:650f:f3c3:4825:2110
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Crimina ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Criminality-Signature (ja4:t12d190800 - Ratio:0.99), High-Criminality-Signature (p0f:*:64:0:*:mss*45,8:mss,nop,ws,nop,nop,sok:flow:0 - Ratio:0.97) | UA: Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/80.0.0.0 Safari/537.36 | TCP Fingerprint: Unknown (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
Web App Attack