π§πͺ
207.175.210.219
07 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.96), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:48334m)
show less
Port Scan
Exploited Host
π΅π°
223.123.43.34
07 Oct 2026
Detectors: [NGINX, CROWDSEC] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show more
Detectors: [NGINX, CROWDSEC] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | CrowdSec: Security alert | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*10,5:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:IPIP or SIT, Uptime:0m)
show less
Web App Attack
Port Scan
Bad Web Bot
π§πͺ
207.175.110.84
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π§πͺ
104.199.18.193
07 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.95), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:32592m)
show less
Port Scan
Exploited Host
π§πͺ
35.195.184.82
07 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.95), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:13380m)
show less
Port Scan
Exploited Host
πΊπΈ
2602:fa59:10:311::1
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Persis ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Persistent-Slow-Scanner (Strikes: 4), Repeat-Offender (Past Bans: 3) | UA: Mozilla/5.0 (X11; Linux x86_64) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:51805m)
show less
Hacking
Web App Attack
π΅π°
139.135.43.212
07 Oct 2026
Detectors: [NGINX, SURICATA, CROWDSEC] | Reasons: Suricata: Web Server attack | Automated scan targe ...
show more
Detectors: [NGINX, SURICATA, CROWDSEC] | Reasons: Suricata: Web Server attack | Automated scan targeting an unauthorized host or default server sinkhole | CrowdSec: Security alert | Suricata: Exploit attempt | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:IPIP or SIT, Uptime:0m)
show less
Web App Attack
Hacking
Port Scan
Bad Web Bot
π°π·
20.249.5.100
07 Oct 2026
Detectors: [NGINX, CROWDSEC] | Reasons: CrowdSec: Security alert | Targeting a decommissioned/expire ...
show more
Detectors: [NGINX, CROWDSEC] | Reasons: CrowdSec: Security alert | Targeting a decommissioned/expired domain name (historical data recon) | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96), Repeat-Offender (Past Bans: 2) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Web App Attack
Bad Web Bot
πΊπ¦
46.175.136.164
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
πΊπΈ
13.59.14.240
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: OS-Signature-Mismatch (UA:W ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:0m)
show less
Port Scan
Exploited Host
π¬π§
209.38.164.188
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π§πͺ
34.62.151.133
07 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:59264m)
show less
Port Scan
Exploited Host
π§π©
103.177.124.129
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π§π·
45.238.235.104
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π§πͺ
34.62.184.31
07 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:64760m)
show less
Port Scan
Exploited Host
π§πͺ
35.205.250.144
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π§πͺ
34.79.179.96
07 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:38373m)
show less
Port Scan
Exploited Host
π§πͺ
34.53.138.254
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π³π±
20.31.129.34
07 Oct 2026
Detectors: [NGINX, SURICATA] | Reasons: Nginx Honeypot: Administration interface scan | Suricata: ID ...
show more
Detectors: [NGINX, SURICATA] | Reasons: Nginx Honeypot: Administration interface scan | Suricata: IDS security alert | Evidence: Trusted-P0F-Signature (*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:IPIP or SIT, Uptime:47332m)
show less
Port Scan
Web App Attack
Hacking
π¨π
193.73.122.18
07 Oct 2026
Detectors: [NGINX, NGINX_BURST] | Reasons: Rapid burst scanning (10+ blocked requests in 60s) | Ngin ...
show more
Detectors: [NGINX, NGINX_BURST] | Reasons: Rapid burst scanning (10+ blocked requests in 60s) | Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d131100), Trusted-JA4-Signature (t13d131100), Trusted-P0F-Signature (*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:PPPoE, Uptime:35229m)
show less
Port Scan
Web App Attack
π»π³
2402:800:610d:f8e2:4d25:f504:7055:3e36
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.99), High-Criminality-Signature (p0f:*:64:0:*:65535,8:mss,nop,ws,nop,nop,sok:flow:0 - Ratio:0.94) | UA: Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/98.0.0.0 Safari/537.36 | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
π»π³
14.236.172.1
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.99), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.95) | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Windows (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
π΅π±
45.138.12.6
07 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Truste ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Trusted-P0F-Signature (*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0), Repeat-Offender (Past Bans: 1) | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:PPPoE, Uptime:4991m)
show less
Hacking
Web App Attack
πΊπ¦
194.242.96.186
07 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π΅π°
139.135.41.40
07 Oct 2026
Detectors: [NGINX, SURICATA] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show more
Detectors: [NGINX, SURICATA] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | Suricata: Exploit attempt | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:IPIP or SIT, Uptime:0m)
show less
Hacking
Port Scan
Bad Web Bot