π©πͺ
2a01:4020:31:0:102::63b
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h2 - Ratio:0.92) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:43755m)
show less
Port Scan
Exploited Host
π©πͺ
2a01:4020:31:0:102::3d3
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i351300 - Ratio:0.92) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:30593m)
show less
Port Scan
Exploited Host
π©πͺ
2a01:4020:31:0:102::5f7
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h1 - Ratio:0.92) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:52440m)
show less
Port Scan
Exploited Host
π©πͺ
2a01:4020:31:0:102::59c
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h2 - Ratio:0.92) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:2268m)
show less
Port Scan
Exploited Host
π©πͺ
2a01:4020:31:0:102::30e
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i351300 - Ratio:0.92) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:10868m)
show less
Port Scan
Exploited Host
π©πͺ
2a01:4020:31:0:102::3c
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, U ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, URL-Found-In-UA, High-Criminality-Signature (ja4:t13i3514h1 - Ratio:0.92) | UA: Mozilla/5.0 (compatible; Infrawatch/1.0; +https://infrawat.ch/) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:32404m)
show less
Port Scan
Exploited Host
π¨π±
190.163.130.144
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π―π΅
20.210.166.54
07 Oct 2026
Detectors: [CROWDSEC, NGINX] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show more
Detectors: [CROWDSEC, NGINX] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | CrowdSec: Security alert | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Web App Attack
Port Scan
Bad Web Bot
πΊπΈ
34.27.87.39
07 Oct 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
π¨π΄
179.1.179.5
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π―π΅
45.43.60.98
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 2)
show less
Port Scan
πΊπΈ
70.106.210.161
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π§πͺ
35.195.38.220
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
ππ°
52.184.15.30
07 Oct 2026
Detectors: [NGINX, CROWDSEC] | Reasons: CrowdSec: Security alert | Targeting a decommissioned/expire ...
show more
Detectors: [NGINX, CROWDSEC] | Reasons: CrowdSec: Security alert | Targeting a decommissioned/expired domain name (historical data recon) | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Web App Attack
Bad Web Bot
π§π©
103.230.211.34
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π°π·
52.141.3.247
07 Oct 2026
Detectors: [NGINX] | Reasons: Targeting a decommissioned/expired domain name (historical data recon) ...
show more
Detectors: [NGINX] | Reasons: Targeting a decommissioned/expired domain name (historical data recon) | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Bad Web Bot
Web App Attack
πΊπΈ
35.84.196.176
07 Oct 2026
Detectors: [NGINX, CROWDSEC] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show more
Detectors: [NGINX, CROWDSEC] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | CrowdSec: Reconnaissance scan | Evidence: URL-Found-In-UA, High-Criminality-Signature (ja4:t13d2512h1 - Ratio:0.98), High-Criminality-Signature (ja4h:5284a4e8dcdc8b18d4c888678c3ea4b3 - Ratio:0.96) | UA: Mozilla/5.0 (compatible; wpbot/1.4; +https://forms.gle/ajBaxygz9jSR8p8G9) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:32250m)
show less
Port Scan
Web App Attack
Bad Web Bot
πΊπΈ
132.148.73.100
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Persistent-Slow-Scanner (Strikes: 8), Repeat-Offender (Past Bans: 7)
show less
Port Scan
π§π·
187.95.21.198
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π―π΅
40.74.77.37
07 Oct 2026
Detectors: [NGINX, CROWDSEC] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show more
Detectors: [NGINX, CROWDSEC] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | CrowdSec: Security alert | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Web App Attack
Port Scan
Bad Web Bot
πΊπΈ
144.225.6.182
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 1)
show less
Port Scan
π²πΆ
93.176.34.126
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π΅π°
2400:adc1:441:c800:4971:46d1:148e:e131
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Crimina ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Criminality-Signature (ja4:t12d190800 - Ratio:0.99) | UA: Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
πΊπΈ
34.201.71.24
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
πΊπΈ
34.203.191.231
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan