π§πͺ
35.187.22.230
05 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π΅π°
111.68.111.100
05 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π§πͺ
34.38.0.205
05 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:54374m)
show less
Port Scan
Exploited Host
π§πͺ
34.22.202.7
05 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.95), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:46187m)
show less
Port Scan
Exploited Host
π¨π³
47.107.123.5
05 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previ ...
show more
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban | Evidence: Persistent-Slow-Scanner (Strikes: 4), Malformed-Connection-Structure, High-Criminality-Signature (p0f:*:64:0:*:mss*22,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:1.00), Repeat-Offender (Past Bans: 3) | UA: Mozilla/5.0 (iPhone; CPU iPhone OS 13_2_3 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Mobile/15E148 Safari/604.1 | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
π§πͺ
35.240.61.101
05 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.94), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:69125m)
show less
Port Scan
Exploited Host
π§πͺ
104.155.42.55
05 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.94), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:25923m)
show less
Port Scan
Exploited Host
πΊπΈ
23.100.83.23
05 Oct 2026
Detectors: [NGINX] | Reasons: Targeting a decommissioned/expired domain name (historical data recon) ...
show more
Detectors: [NGINX] | Reasons: Targeting a decommissioned/expired domain name (historical data recon) | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Bad Web Bot
Web App Attack
π·πΊ
95.71.134.19
05 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: High-Criminality-Signature ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*44,9:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.88) | UA: Mozilla/5.0 | TCP Fingerprint: Android Modern Android (Cellular) (Link:PPPoE, Uptime:0m)
show less
Port Scan
Exploited Host
π°πͺ
196.96.188.118
05 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Crimina ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Criminality-Signature (ja4:t12d190800 - Ratio:0.99), High-Criminality-Signature (p0f:*:128:0:*:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.85) | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/85.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Windows (Link:generic tunnel or VPN, Uptime:0m)
show less
Port Scan
Web App Attack
π¦πͺ
87.200.245.106
05 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Trusted-P0F- ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Trusted-P0F-Signature (*:128:0:*:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+,ecn:0) | UA: Mozilla/5.0 (Windows NT 6.2; x64) AppleWebKit/537.36 (KHTML, like Gecko) Firefox/81.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Windows (Link:Unknown, Uptime:0m)
show less
Port Scan
Web App Attack
π¨π±
190.101.117.124
05 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
πΊπΈ
2602:fa59:10:253::1
05 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | UA: Mozilla/5.0 ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | UA: Mozilla/5.0 (X11; Linux x86_64) | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:43307m)
show less
Hacking
Web App Attack
πΊπ¦
45.159.19.93
05 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 2)
show less
Port Scan
π³π±
176.65.149.45
05 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
π¦πͺ
217.165.139.79
05 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: Verified-Bot-JA4-Match (t13d201200), High-Criminality-Signature (ja4:t13d201200 - Ratio:0.98), High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.96) | UA: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/85.0.0.0 Safari/537.36 | TCP Fingerprint: Modern Windows (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
πΊπΈ
2001:19f0:ac01:1ad7:5400:6ff:fe72:b8f2
05 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Persistent-Slow-Scanner (St ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Persistent-Slow-Scanner (Strikes: 51), Malformed-Host-Structure, URL-Found-In-UA, TCP/IP-Spoofing-Detected (bad_sw: 2), Repeat-Offender (Past Bans: 50) | UA: Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:56644m)
show less
Port Scan
Exploited Host
πΊπΈ
174.129.71.237
05 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
πΊπΈ
34.239.247.180
05 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Persistent-Slow-Scanner (Strikes: 5), Repeat-Offender (Past Bans: 4)
show less
Port Scan
πΊπΈ
54.86.27.243
05 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 1)
show less
Port Scan
π¨π³
39.90.144.60
05 Oct 2026
Detectors: [NGINX, SURICATA] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show more
Detectors: [NGINX, SURICATA] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | Suricata: Exploit attempt | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:0m)
show less
Hacking
Port Scan
Bad Web Bot
πΊπΈ
104.243.42.83
05 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Persistent-Slow-Scanner (Strikes: 15), Repeat-Offender (Past Bans: 14)
show less
Port Scan
πΊπΈ
108.85.15.137
05 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
πΊπΈ
150.136.227.229
05 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 1)
show less
Port Scan
ππ°
2602:80d:1003::1d
05 Oct 2026
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: Malformed-Host-Structure, URL-Found-In-UA, ...
show more
Detectors: [NGINX] | Reasons: bad_user_agent | Evidence: Malformed-Host-Structure, URL-Found-In-UA, Known-Scanner-UA (Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)) | UA: Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:51047m)
show less
Port Scan