๐ซ๐ท
169.40.142.93
03 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Verifi ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Sensitive configuration file search | Evidence: Verified-Bot-JA4-Match (t13d131100), Trusted-JA4-Signature (t13d131100), Trusted-P0F-Signature (*:64:0:*:mss*44,7:mss,sok,ts,nop,ws:df,id+:0), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:PPPoE, Uptime:6228m)
show less
Hacking
Web App Attack
๐ณ๐ฑ
2001:1c00:906:700:4d34:76c1:2baf:11b0
03 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Crimina ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Criminality-Signature (ja4:t12d180800 - Ratio:0.94), High-Criminality-Signature (p0f:*:64:0:*:65535,8:mss,nop,ws,nop,nop,sok:flow:0 - Ratio:0.93) | UA: Mozilla/5.0 (Windows NT 10.0; x64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/63.0.0.0 Safari/537.36 | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐บ๐ธ
191.96.150.130
03 Oct 2026
Detectors: [NGINX, CROWDSEC] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show more
Detectors: [NGINX, CROWDSEC] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | CrowdSec: Reconnaissance scan | UA: panscient.com | TCP Fingerprint: Modern Android / Mobile Device (Link:generic tunnel or VPN, Uptime:20563m)
show less
Port Scan
Web App Attack
Bad Web Bot
๐ง๐ช
130.211.106.214
03 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.92), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:68949m)
show less
Port Scan
Exploited Host
๐ฑ๐น
77.90.185.41
03 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 2)
show less
Port Scan
๐ง๐ช
34.53.215.123
03 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.92), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:8411m)
show less
Port Scan
Exploited Host
๐ง๐ช
35.241.148.211
03 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (ja4:t13i250900 - Ratio:0.91), High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:53102m)
show less
Port Scan
Exploited Host
๐ฎ๐ณ
20.219.185.206
03 Oct 2026
Detectors: [NGINX, CROWDSEC] | Reasons: Automated scan targeting an unauthorized host or default ser ...
show more
Detectors: [NGINX, CROWDSEC] | Reasons: Automated scan targeting an unauthorized host or default server sinkhole | CrowdSec: Security alert | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.95) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Web App Attack
Port Scan
Bad Web Bot
๐บ๐ธ
54.167.71.13
03 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐บ๐ธ
3.85.57.190
03 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐บ๐ธ
199.244.88.219
03 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previ ...
show more
Detectors: [NGINX] | Reasons: Nginx: Repeat offender returning to default/inactive vhost after previous ban | Evidence: OS-Signature-Mismatch (UA:Linux/p0f:Windows), Repeat-Offender (Past Bans: 1) | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36 | TCP Fingerprint: Legacy Windows (XP/2003) (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐ป๐ณ
160.250.128.93
03 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | ...
show more
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity | Evidence: Repeat-Offender (Past Bans: 1)
show less
Port Scan
๐ง๐ท
168.181.49.225
03 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Crimina ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Criminality-Signature (ja4:t12d190800 - Ratio:0.99), High-Criminality-Signature (p0f:*:128:0:*:mss*44,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.87) | UA: Jetpack by WordPress.com (Jetpack 12.1; WordPress 6.2) | TCP Fingerprint: Modern Windows (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐ง๐ช
34.52.198.155
03 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:3043m)
show less
Port Scan
Exploited Host
๐ฒ๐ฝ
209.178.135.15
03 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐บ๐ธ
2001:19f0:ac01:1ad7:5400:6ff:fe72:b8f2
03 Oct 2026
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Persistent-Slow-Scanner (St ...
show more
Detectors: [NGINX] | Reasons: Nginx: Default server trap hit | Evidence: Persistent-Slow-Scanner (Strikes: 11), Malformed-Host-Structure, URL-Found-In-UA, TCP/IP-Spoofing-Detected (bad_sw: 2), Repeat-Offender (Past Bans: 10) | UA: Mozilla/5.0 (compatible; CyberConvoyScout/1.0; +https://scout.cyberconvoy.co) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:PPPoE, Uptime:12710m)
show less
Port Scan
Exploited Host
๐ง๐ช
34.156.236.161
03 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:70115m)
show less
Port Scan
Exploited Host
๐ง๐ช
34.140.129.234
03 Oct 2026
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol ...
show more
Detectors: [NGINX, nginx_monitor] | Reasons: Nginx: Default server trap hit | Invalid HTTP protocol or SSTP scan attempt detected on sinkhole | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*30,7:mss,sok,ts,nop,ws:df,id+:0 - Ratio:0.98), OS-Signature-Mismatch (UA:Windows/p0f:Linux) | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36 | TCP Fingerprint: Linux (Legacy/Embedded) (Link:generic tunnel or VPN, Uptime:7978m)
show less
Port Scan
Exploited Host
๐ญ๐ฐ
20.205.114.149
03 Oct 2026
Detectors: [NGINX] | Reasons: Targeting a decommissioned/expired domain name (historical data recon) ...
show more
Detectors: [NGINX] | Reasons: Targeting a decommissioned/expired domain name (historical data recon) | Evidence: High-Criminality-Signature (p0f:*:128:0:*:65535,8:mss,nop,ws,nop,nop,sok:df,id+:0 - Ratio:0.95) | TCP Fingerprint: Modern Windows (Link:IPIP or SIT, Uptime:0m)
show less
Bad Web Bot
Web App Attack
๐ง๐ช
34.156.65.210
03 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ฎ๐ณ
2405:201:e019:e09a:485a:bf56:65f4:3007
03 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: URL-Found-In ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: URL-Found-In-UA, High-Criminality-Signature (ja4:t12d190800 - Ratio:0.99), High-Criminality-Signature (p0f:*:64:0:*:mss*45,8:mss,nop,ws,nop,nop,sok:flow:0 - Ratio:0.96) | UA: WordPress.com; https://wordpress.com | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐ต๐ญ
2001:4455:90c5:4c00:4804:2cfd:42fd:7bab
03 Oct 2026
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Crimina ...
show more
Detectors: [NGINX] | Reasons: Nginx Honeypot: Administration interface scan | Evidence: High-Criminality-Signature (ja4:t12d190800 - Ratio:0.99), High-Criminality-Signature (p0f:*:64:0:*:mss*45,8:mss,nop,ws,nop,nop,sok:flow:0 - Ratio:0.96) | UA: Mozilla/5.0 (Windows NT 10.0; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/69.0.0.0 Safari/537.36 | TCP Fingerprint: Unknown (Link:PPPoE, Uptime:0m)
show less
Port Scan
Web App Attack
๐ต๐ฐ
59.103.119.193
03 Oct 2026
Detectors: [CROWDSEC] | Reasons: CrowdSec: Security alert | Evidence: High-Criminality-Signature (p0 ...
show more
Detectors: [CROWDSEC] | Reasons: CrowdSec: Security alert | Evidence: High-Criminality-Signature (p0f:*:64:0:*:mss*10,5:mss,sok,ts,nop,ws:df,id+:0 - Ratio:1.00), Repeat-Offender (Past Bans: 1) | TCP Fingerprint: Modern Linux (Kernel 3.x+) (Link:IPIP or SIT, Uptime:0m)
show less
Web App Attack
๐ง๐ช
34.22.188.36
03 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan
๐ฆ๐ท
181.46.39.234
03 Oct 2026
Detectors: [pfsense_monitor] | Reasons: Firewall: Prohibited Port Scan / Automated Botnet Activity
Port Scan