There was a successful sign-in from this address, and the same address was flagged by other defences — or a file check, the antivirus or a newly opened port fired right after it. Worth confirming that the sign-in was yours.
| Time | Severity | Source | Message | Count |
|---|---|---|---|---|
| 07.10.2026 08:57 | Warning | crowdsec |
CrowdSec: new decisions 198.51.100.26 (crowdsecurity/http-bad-user-agent)
|
1 |
| 12.10.2026 04:44 | Warning | suricata |
Suricata: new alerts ET SCAN Nmap Scripting Engine User-Agent
|
14 |
| 12.10.2026 05:44 | Warning | fail2ban |
Fail2ban: new bans 198.51.100.26
|
6 |
| 12.10.2026 06:29 | Warning | ssh |
SSH: login from a new address deploy@198.51.100.26
|
1 |
Events that carry no address: their source does not know who did it. Shown for the span this address was active, plus six hours after it.
| 07.10.2026 10:49 | Critical | service | Protection service stopped: suricata |
| 08.10.2026 13:16 | Info | service | Protection service is running again: crowdsec |
| 09.10.2026 04:16 | Warning | network |
A new port is reachable from outside 5432
|
| 11.10.2026 15:08 | Critical | falco |
Falco: critical events Shell spawned in a container (user=www-data)
|
| 11.10.2026 17:55 | Info | service | Protection service is running again: crowdsec |