๐บ๐ฆ
91.225.162.50
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ฎ๐ณ
2405:201:e00c:a036:29:976c:b940:a9bc
06 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.99), High-Criminality-Signature (p0f:*:64:0:*:65535,8:mss,nop,ws,nop,nop,sok:flow:0 - Ratio:0.94) | UA: Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36 | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐บ๐ธ
24.125.104.205
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐บ๐ธ
136.119.118.240
06 Oct 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: URL-Found-In-UA, High-Criminality-Signature (p0f:*:128:0:*:mss*46,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0 - Ratio:0.99) | UA: Mozilla/5.0 (compatible; CMS-Checker/1.0; +https://example.com) | TCP Fingerprint: Legacy Windows (XP/2003) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐บ๐ธ
64.247.196.151
06 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Truste ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Trusted-P0F-Signature (*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0), High-Criminality-Signature (ja4:t13d190900 - Ratio:0.94) | UA: SEC-SGHX210/1.0 UP.Link/6.3.1.13.0 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:PPPoE, Uptime:27999m)
show less
Hacking
Web App Attack
๐ณ๐ฑ
2a01:4020:2:b:101::670
06 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, H ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, High-Criminality-Signature (ja4:t13i3514h2 - Ratio:0.91) | UA: Mozilla/5.0 | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:70419m)
show less
Port Scan
Exploited Host
๐ณ๐ฑ
2a01:4020:2:b:101::e2
06 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, H ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, High-Criminality-Signature (ja4:t13i351300 - Ratio:0.91) | UA: Mozilla/5.0 | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:41857m)
show less
Port Scan
Exploited Host
๐ณ๐ฑ
2a01:4020:2:b:101::2d6
06 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, H ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Malformed-Host-Structure, High-Criminality-Signature (ja4:t13i3514h1 - Ratio:0.91), Repeat-Offender (Past Bans: 1) | UA: Mozilla/5.0 | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:42676m)
show less
Port Scan
Exploited Host
๐บ๐ฆ
109.86.1.55
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐บ๐ธ
34.168.50.128
06 Oct 2026
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Automated scan targeting an un ...
show more
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Automated scan targeting an unauthorized host or default server sinkhole | Evidence: Verified-Bot-JA4-Match (t13d1516h2) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Web App Attack
Hacking
Port Scan
Bad Web Bot
๐ง๐ช
34.62.220.24
06 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.95), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:27998m)
show less
Port Scan
Exploited Host
๐ง๐ช
35.205.97.229
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐บ๐ธ
2001:19f0:ac01:1ad7:5400:6ff:fe72:b8f2
06 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Persistent-Slow-Scanner (St ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Persistent-Slow-Scanner (Strikes: 71), Malformed-Host-Structure, URL-Found-In-UA, TCP/IP-Spoofing-Detected (bad_sw: 2), Repeat-Offender (Past Bans: 70) | UA: Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:59532m)
show less
Port Scan
Exploited Host
๐บ๐ฆ
185.138.230.6
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ฎ๐ณ
2405:201:f006:1077:dc07:1e85:c2c9:5081
06 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.99), High-Criminality-Signature (p0f:*:64:0:*:65535,8:mss,nop,ws,nop,nop,sok:flow:0 - Ratio:0.94) | UA: Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/83.0.0.0 Safari/537.36 | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐ธ๐ช
185.123.33.152
06 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previ ...
show more
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*44,9:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.89), Repeat-Offender (Past Bans: 1) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.3 | TCP Fingerprint: Android Modern Android (Cellular) (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐บ๐ธ
34.239.130.59
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐บ๐ธ
107.23.10.184
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 2)
show less
Port Scan
๐ต๐ญ
120.28.43.59
06 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.99), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.95) | UA: Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/88.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Windows (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐บ๐ธ
54.204.116.159
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 2)
show less
Port Scan
๐จ๐ณ
221.13.86.198
06 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.96) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐จ๐ฆ
143.198.34.47
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ง๐ช
35.195.228.177
06 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:11212m)
show less
Port Scan
Exploited Host
๐ง๐ช
35.205.41.95
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ง๐ช
34.79.26.226
06 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:20010m)
show less
Port Scan
Exploited Host