๐บ๐ฆ
109.86.1.55
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐บ๐ธ
34.168.50.128
06 Oct 2026
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Automated scan targeting an un ...
show more
Detectors: [NGINX, SURICATA] | Reasons: Suricata: Web Server attack | Automated scan targeting an unauthorized host or default server sinkhole | Evidence: Verified-Bot-JA4-Match (t13d1516h2) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Web App Attack
Hacking
Port Scan
Bad Web Bot
๐ง๐ช
34.62.220.24
06 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.95), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:27998m)
show less
Port Scan
Exploited Host
๐ง๐ช
35.205.97.229
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐บ๐ธ
2001:19f0:ac01:1ad7:5400:6ff:fe72:b8f2
06 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Persistent-Slow-Scanner (St ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Persistent-Slow-Scanner (Strikes: 71), Malformed-Host-Structure, URL-Found-In-UA, TCP/IP-Spoofing-Detected (bad_sw: 2), Repeat-Offender (Past Bans: 70) | UA: Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:59532m)
show less
Port Scan
Exploited Host
๐บ๐ฆ
185.138.230.6
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ฎ๐ณ
2405:201:f006:1077:dc07:1e85:c2c9:5081
06 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.99), High-Criminality-Signature (p0f:*:64:0:*:65535,8:mss,nop,ws,nop,nop,sok:flow:0 - Ratio:0.94) | UA: Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/83.0.0.0 Safari/537.36 | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐ธ๐ช
185.123.33.152
06 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previ ...
show more
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*44,9:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.89), Repeat-Offender (Past Bans: 1) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.3 | TCP Fingerprint: Android Modern Android (Cellular) (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐บ๐ธ
34.239.130.59
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐บ๐ธ
107.23.10.184
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 2)
show less
Port Scan
๐ต๐ญ
120.28.43.59
06 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.99), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.95) | UA: Mozilla/5.0 (Windows NT 6.3; x86) AppleWebKit/537.36 (KHTML, like Gecko) Edge/88.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Windows (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐บ๐ธ
54.204.116.159
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 2)
show less
Port Scan
๐จ๐ณ
221.13.86.198
06 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*20,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.96) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
๐จ๐ฆ
143.198.34.47
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ง๐ช
35.195.228.177
06 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:11212m)
show less
Port Scan
Exploited Host
๐ง๐ช
35.205.41.95
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ง๐ช
34.79.26.226
06 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:20010m)
show less
Port Scan
Exploited Host
๐ง๐ช
34.62.48.50
06 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:62268m)
show less
Port Scan
Exploited Host
๐ท๐ด
2.57.122.238
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Persistent-Slow-Scanner (Strikes: 5), Repeat-Offender (Past Bans: 4)
show less
Port Scan
๐จ๐ณ
47.106.188.159
06 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previ ...
show more
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban | Evidence: Malformed-Connection-Structure, High-Criminality-Signature (p0f:*:64:0:*:mss*22,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:1.00), Repeat-Offender (Past Bans: 1) | UA: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐จ๐ณ
112.54.142.215
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐บ๐ฆ
31.43.59.59
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ง๐ช
34.140.186.57
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ง๐ท
54.94.85.181
06 Oct 2026
Detectors: [NGINX, NGINX_BURST] | Reasons: Rapid burst scanning (10+ blocked requests in 60s) | Ngin ...
show more
Detectors: [NGINX, NGINX_BURST] | Reasons: Rapid burst scanning (10+ blocked requests in 60s) | Nginx Honeypot: Sensitive configuration file search | Evidence: Verified-Bot-JA4-Match (t13d131100), Trusted-JA4-Signature (t13d131100), High-Criminality-Signature (p0f:*:64:0:*:mss*44,10:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.86), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/95.0.4638.69 Safari/537.36 Edg/95.0.1020.53 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:0m)
show less
Web App Attack
Hacking
๐จ๐ณ
120.211.74.131
06 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan