πΊπΈ
18.116.101.220
11 hours ago
Direct IP access.
18.116.101.220 - - [03/Nov/2026:19:50:00 +0100] "GET / HTTP/1.1" 402 2775 "-" "vis ...
show more
Direct IP access.
18.116.101.220 - - [03/Nov/2026:19:50:00 +0100] "GET / HTTP/1.1" 402 2775 "-" "visionheight.com/scan Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) Chrome/126.0.0.0 Safari/537.36" "REDACTED" ""
18.116.101.220 - - [03/Nov/2026:19:50:05 +0100] "\x16\x03\x01\x01" 400 392 "-" "-" "-" "-"
...
show less
Port Scan
Web App Attack
π΅π°
119.157.76.2
11 hours ago
Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 119.157.76.2; ...
show more
Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 119.157.76.2; usernames=["admin" "mother" "root" "test1" "CUAdmin" "support"]; passwords sha1 prefix=["a762554c" "c177922c" "70352f41" "c13ec639" "eeac0f0e" "7c4a8d09" "b444ac06" "90d3cf82" "9d4e1e23" "7110eda4"]
show less
Port Scan
Brute-Force
IoT Targeted
π΅π±
95.214.53.196
11 hours ago
Direct IP access.
95.214.53.196 - - [03/Nov/2026:19:18:30 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "- ...
show more
Direct IP access.
95.214.53.196 - - [03/Nov/2026:19:18:30 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" "-"
95.214.53.196 - - [03/Nov/2026:19:18:30 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" "-"
...
show less
Port Scan
Web App Attack
π¨π³
118.253.166.235
13 hours ago
Direct IP access.
118.253.166.235 - - [03/Nov/2026:18:11:15 +0100] "GET /phpmyadmin/index.php HTTP/1 ...
show more
Direct IP access.
118.253.166.235 - - [03/Nov/2026:18:11:15 +0100] "GET /phpmyadmin/index.php HTTP/1.1" 402 2780 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3464.0 Safari/537.36" "REDACTED" ""
118.253.166.235 - - [03/Nov/2026:18:11:16 +0100] "GET /pmd/index.php HTTP/1.1" 402 2791 "-" "Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/69.0.3464.0 Safari/537.36" "REDACTED" ""
...
show less
Port Scan
Web App Attack
π¨π³
27.0.135.12
13 hours ago
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 27.0.135.12; user ...
show more
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 27.0.135.12; usernames=["root"]; passwords sha1 prefix=["24bf68e3" "a6eb4d9d" "b3a5425f" "ba324ca7" "58a3ed6f" "f460c882" "62eb0db1" "e982f17b" "01c11b90" "86dd1cf4"]
show less
Brute-Force
SSH
π³π±
94.102.49.190
13 hours ago
Direct IP access.
94.102.49.190 - - [03/Nov/2026:17:22:46 +0100] "GET / HTTP/1.1" 402 2768 "-" "Mozi ...
show more
Direct IP access.
94.102.49.190 - - [03/Nov/2026:17:22:46 +0100] "GET / HTTP/1.1" 402 2768 "-" "Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/41.0.2228.0 Safari/537.36" "REDACTED" ""
94.102.49.190 - - [03/Nov/2026:17:22:47 +0100] "GET /robots.txt HTTP/1.1" 402 409 "-" "-" "REDACTED" ""
...
show less
Port Scan
Web App Attack
πΊπΈ
204.48.24.60
13 hours ago
Direct IP access.
204.48.24.60 - - [03/Nov/2026:17:19:51 +0100] "GET / HTTP/1.1" 402 4925 "-" "Mozil ...
show more
Direct IP access.
204.48.24.60 - - [03/Nov/2026:17:19:51 +0100] "GET / HTTP/1.1" 402 4925 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0" "REDACTED" ""
204.48.24.60 - - [03/Nov/2026:17:19:56 +0100] "GET /favicon.ico HTTP/1.1" 402 4925 "https://REDACTED/" "Mozilla/5.0 (X11; Linux x86_64; rv:153.0) Gecko/20100101 Firefox/153.0" "REDACTED" ""
...
show less
Port Scan
Web App Attack
π¨π³
112.248.155.73
14 hours ago
Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 112.248.155.73 ...
show more
Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 112.248.155.73; usernames=["admin" "root"]; passwords sha1 prefix=["ce7987ef" "404865ca" "eeac0f0e" "a1ea31f8" "bf7b70bf" "317f1e76" "bdb985a5" "8cb2237d" "5c52cbc0" "b667bad5"]
show less
Port Scan
Brute-Force
IoT Targeted
π³π±
45.74.28.214
14 hours ago
Direct IP access.
45.74.28.214 - - [03/Nov/2026:16:52:44 +0100] "\x16\x03\x01\x05\xc6\x01" 400 392 " ...
show more
Direct IP access.
45.74.28.214 - - [03/Nov/2026:16:52:44 +0100] "\x16\x03\x01\x05\xc6\x01" 400 392 "-" "-" "-" "-"
45.74.28.214 - - [03/Nov/2026:16:52:44 +0100] "GET / HTTP/1.1" 402 818 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36" "REDACTED:80" ""
...
show less
Port Scan
Web App Attack
πΊπΈ
66.132.186.181
14 hours ago
Direct IP access.
66.132.186.181 - - [03/Nov/2026:16:49:18 +0100] "\x16\x03\x01\x05\xba\x01" 400 392 ...
show more
Direct IP access.
66.132.186.181 - - [03/Nov/2026:16:49:18 +0100] "\x16\x03\x01\x05\xba\x01" 400 392 "-" "-" "-" "-"
66.132.186.181 - - [03/Nov/2026:16:49:26 +0100] "GET / HTTP/1.1" 402 2752 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" "REDACTED" ""
...
show less
Port Scan
Web App Attack
πΊπΈ
66.132.186.178
14 hours ago
Direct IP access.
66.132.186.178 - - [03/Nov/2026:16:46:54 +0100] "GET / HTTP/1.1" 402 4831 "-" "Moz ...
show more
Direct IP access.
66.132.186.178 - - [03/Nov/2026:16:46:54 +0100] "GET / HTTP/1.1" 402 4831 "-" "Mozilla/5.0 (compatible; CensysInspect/1.1; +https://about.censys.io/)" "REDACTED" ""
66.132.186.178 - - [03/Nov/2026:16:47:48 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" "-"
...
show less
Port Scan
Web App Attack
π©πͺ
193.174.89.19
15 hours ago
Direct IP access.
193.174.89.19 - - [03/Nov/2026:15:55:36 +0100] "GET / HTTP/1.1" 402 4889 "-" "fhms ...
show more
Direct IP access.
193.174.89.19 - - [03/Nov/2026:15:55:36 +0100] "GET / HTTP/1.1" 402 4889 "-" "fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)" "REDACTED" ""
193.174.89.19 - - [03/Nov/2026:15:55:39 +0100] "GET /app-config.js HTTP/1.1" 402 4902 "-" "fhms-its-research-scanner/1.0 (+https://fb02itsscan02.fh-muenster.de)" "REDACTED" ""
...
show less
Port Scan
Web App Attack
π©πͺ
18.197.102.42
15 hours ago
Bad Bot.
18.197.102.42 - - [03/Nov/2026:15:53:05 +0100] "GET /_environment HTTP/2.0" 404 2459 "-" "M ...
show more
Bad Bot.
18.197.102.42 - - [03/Nov/2026:15:53:05 +0100] "GET /_environment HTTP/2.0" 404 2459 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36""DE"
...
show less
Bad Web Bot
Web App Attack
πΊπΈ
185.180.141.47
15 hours ago
Direct IP access.
185.180.141.47 - - [03/Nov/2026:15:19:54 +0100] "POST /mcp HTTP/2.0" 402 2696 "-" ...
show more
Direct IP access.
185.180.141.47 - - [03/Nov/2026:15:19:54 +0100] "POST /mcp HTTP/2.0" 402 2696 "-" "python-httpx/0.28.1" "REDACTED" ""
185.180.141.47 - - [03/Nov/2026:15:19:55 +0100] "GET /sse HTTP/2.0" 402 2547 "-" "python-httpx/0.28.1" "REDACTED" ""
...
show less
Port Scan
Web App Attack
π·π΄
193.46.255.86
16 hours ago
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 193.46.255.86; us ...
show more
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 193.46.255.86; usernames=["probe" "support" "admin" "ubnt"]; passwords sha1 prefix=["5bdcd3c0" "14437885" "7c4a8d09" "d033e22a" "b05fbd45" "165087ce" "b5e701c9" "863e9c4d"]
show less
Brute-Force
SSH
πΈπ¬
15.235.193.26
16 hours ago
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 15.235.193.26; us ...
show more
SSH authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 15.235.193.26; usernames=["root"]; passwords sha1 prefix=["a6eb4d9d" "b3a5425f" "ba324ca7" "58a3ed6f" "f460c882" "62eb0db1" "e982f17b" "01c11b90" "86dd1cf4" "ca84d134"]
show less
Brute-Force
SSH
πΊπΈ
159.223.116.70
17 hours ago
Bad Bot.
159.223.116.70 - - [03/Nov/2026:14:01:34 +0100] "GET /.git/config HTTP/1.1" 402 2795 "-" "M ...
show more
Bad Bot.
159.223.116.70 - - [03/Nov/2026:14:01:34 +0100] "GET /.git/config HTTP/1.1" 402 2795 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" "REDACTED" ""
...
show less
Bad Web Bot
Web App Attack
π³π±
138.226.239.5
17 hours ago
Direct IP access.
138.226.239.5 - - [03/Nov/2026:13:56:19 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "- ...
show more
Direct IP access.
138.226.239.5 - - [03/Nov/2026:13:56:19 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" "-"
138.226.239.5 - - [03/Nov/2026:13:56:19 +0100] "GET /vpn HTTP/1.0" 402 4534 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" "REDACTED" ""
...
show less
Port Scan
Web App Attack
π·πΊ
45.91.64.10
17 hours ago
Direct IP access.
45.91.64.10 - - [03/Nov/2026:13:29:27 +0100] "GET / HTTP/1.1" 400 2354 "-" "-" "-" ...
show more
Direct IP access.
45.91.64.10 - - [03/Nov/2026:13:29:27 +0100] "GET / HTTP/1.1" 400 2354 "-" "-" "-" "-"
45.91.64.10 - - [03/Nov/2026:13:29:27 +0100] "GET /aaa9 HTTP/1.1" 402 4873 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36" "REDACTED:443" ""
...
show less
Port Scan
Web App Attack
π¦π²
176.32.193.16
17 hours ago
Direct IP access.
176.32.193.16 - - [03/Nov/2026:13:29:27 +0100] "GET / HTTP/1.1" 402 3110 "-" "fast ...
show more
Direct IP access.
176.32.193.16 - - [03/Nov/2026:13:29:27 +0100] "GET / HTTP/1.1" 402 3110 "-" "fasthttp" "REDACTED:443" ""
176.32.193.16 - - [03/Nov/2026:13:29:27 +0100] "GET / HTTP/1.1" 402 3110 "-" "fasthttp" "REDACTED:443" ""
...
show less
Port Scan
Web App Attack
π³π±
185.136.15.2
18 hours ago
Direct IP access.
185.136.15.2 - - [03/Nov/2026:13:01:14 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" ...
show more
Direct IP access.
185.136.15.2 - - [03/Nov/2026:13:01:14 +0100] "GET / HTTP/1.0" 400 651 "-" "-" "-" "-"
185.136.15.2 - - [03/Nov/2026:13:01:14 +0100] "GET /dana-na HTTP/1.0" 402 4533 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" "REDACTED" ""
...
show less
Port Scan
Web App Attack
π΅π°
124.29.251.143
18 hours ago
Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 124.29.251.143 ...
show more
Telnet authentication brute-force attempt against GAS85/ssh-auth-logger honeypot from 124.29.251.143; usernames=["e8telnet" "admin" "root" "yhtcAdmin"]; passwords sha1 prefix=["b0faceaa" "cf21d858" "162aab82" "f04a138b" "3d8d20f5" "068767b3" "b69413e4" "6401561d" "6db69219" "180a4def"]
show less
Port Scan
Brute-Force
IoT Targeted
πΊπΈ
71.6.135.131
18 hours ago
Direct IP access.
71.6.135.131 - - [03/Nov/2026:12:43:00 +0100] "GET / HTTP/1.1" 402 4614 "-" "Mozil ...
show more
Direct IP access.
71.6.135.131 - - [03/Nov/2026:12:43:00 +0100] "GET / HTTP/1.1" 402 4614 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/98.0.4758.102 Safari/537.36" "REDACTED" ""
71.6.135.131 - - [03/Nov/2026:12:43:09 +0100] "
" 400 2358 "-" "-" "-" "-"
...
show less
Port Scan
Web App Attack
π΅π±
95.214.54.159
18 hours ago
Direct IP access.
95.214.54.159 - - [03/Nov/2026:12:37:13 +0100] "GET / HTTP/1.1" 402 2748 "-" "-" " ...
show more
Direct IP access.
95.214.54.159 - - [03/Nov/2026:12:37:13 +0100] "GET / HTTP/1.1" 402 2748 "-" "-" "REDACTED" ""
95.214.54.159 - - [03/Nov/2026:12:37:13 +0100] "GET / HTTP/1.1" 402 4837 "-" "-" "REDACTED" ""
...
show less
Port Scan
Web App Attack
πΊπΈ
47.77.221.175
19 hours ago
Direct IP access.
47.77.221.175 - - [03/Nov/2026:12:07:30 +0100] "GET / HTTP/1.1" 402 4834 "-" "curl ...
show more
Direct IP access.
47.77.221.175 - - [03/Nov/2026:12:07:30 +0100] "GET / HTTP/1.1" 402 4834 "-" "curl/7.64.1" "REDACTED:443" ""
47.77.221.175 - - [03/Nov/2026:12:07:32 +0100] "GET / HTTP/2.0" 402 651 "-" "curl/7.74.0" "REDACTED:443" ""
...
show less
Port Scan
Web App Attack