🇮🇩
hermawan
2026-11-10 15:26:41
UTC ·
(1 day ago)
[Tue Nov 10 22:26:41.259218 2026] [security2:error] [pid 89092:tid 139647699117760] [client 103.3.220.220:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".mkv" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.29.0/rul ...
show more
[Tue Nov 10 22:26:41.259218 2026] [security2:error] [pid 89092:tid 139647699117760] [client 103.3.220.220:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".mkv" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "98"] [id "448101"] [msg "BAD REQUEST FILENAME - Detected and Blocked"] [data "Matched Data: .mkv found within REQUEST_FILENAME: /ae1c614ebb1a5ea26d130959c27039.mkv request_line = GET /ae1c614ebb1a5ea26d130959c27039.mkv HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/ae1c614ebb1a5ea26d130959c27039.mkv"] [unique_id "avM3sda2zTWONCxCTB2YnQAAAAM"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[89138] [jXeMtG2pEF8] [avM3sda2zTWONCxCTB2YnQAAAAM] keep_alive=[0] [2026-11-10 22:26:41.259226] [R:avM3sda2zTWONCxCTB2YnQAAAAM] UA:'Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/27.0 Safari/605.1.15' Host:'staklim-jat
...
show less
Email Spam
Hacking
🇫🇷
sthoyer.de
2026-09-22 03:46:02
UTC ·
(1 month ago)
Sep 22 05:46:01 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=103.3.220.220 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=116 ID=10775 DF PROTO=TCP SPT=12306 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0 ...
show more
Sep 22 05:46:01 sthoyer kernel: [IPTables-Block] IN=eth0 OUT= MAC=00:50:56:43:00:af:c0:69:11:cd:10:f7:08:00 SRC=103.3.220.220 DST=173.212.223.67 LEN=52 TOS=0x00 PREC=0x00 TTL=116 ID=10775 DF PROTO=TCP SPT=12306 DPT=445 WINDOW=8192 RES=0x00 SYN URGP=0
...
show less
Port Scan
🇺🇸
kosada.com
2026-08-29 21:13:05
UTC ·
(2 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
2026-08-13 17:15:27
UTC ·
(2 months ago)
Large-scale coordinated botnet (1M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky); Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan) employed by Angara Technologies Group | Attack Signature Blocked: /catalog/product ...
show more
Large-scale coordinated botnet (1M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky); Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan) employed by Angara Technologies Group | Attack Signature Blocked: /catalog/product_compare/add/product/5986/uenc/aHR0cHM6Ly93d3cuZDJvZmZpY2UucnUvY2F0YWxvZ3NlYXJjaC9yZXN1bHQvP2NhdD0xMjgmYW1wO3A9MiZhbXA7cT1jcmVzdHJvbittdC0xMDAwYyZhbXA7cmF0aW5nPTY,/form_key/6DfcsXtQ0wZnqQZt/ | UA: Mozilla/5.0 (compatible; MSIE 6.0; Windows NT 5.2; Trident/3.1) | (Magento Site)
show less
Hacking
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-07-27 22:21:00
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
kosada.com
2026-07-10 08:18:49
UTC ·
(4 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇬🇧
PeravixGroup
2026-06-29 03:46:38
UTC ·
(4 months ago)
Honeypot detection: SMB / Windows file sharing exploitation attempt on port 445. Severity: HIGH. Aaran.cloud
Hacking
Exploited Host
🇮🇩
sockominfo
2026-06-20 16:00:52
UTC ·
(4 months ago)
SIMASN Account Signin during non bussiness hour.. Threat Score: 8.1/10 (CRITICAL). Confidence: 60%. CVSS v3.1: 7.3/10 (High). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 97%. MITRE ATT&CK: T1071 (Application Layer ...
show more
SIMASN Account Signin during non bussiness hour.. Threat Score: 8.1/10 (CRITICAL). Confidence: 60%. CVSS v3.1: 7.3/10 (High). CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L. Bayesian Probability: 97%. MITRE ATT&CK: T1071 (Application Layer Protocol). Tactic: TA0001. Freshness: Very Fresh. Source Reputation: SUSPICIOUS. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT. Status: MALICIOUS
show less
Hacking
Web App Attack
🇺🇸
kosada.com
2026-02-09 17:06:16
UTC ·
(9 months ago)
Web bot: DDoS
DDoS Attack
Bad Web Bot
🇪🇸
robotstxt
2026-01-18 15:41:18
UTC ·
(9 months ago)
103.3.220.220 - - [18/Jan/2026:15:40:58 +0000] "GET /wp-login.php/wp-login.php HTTP/1.1" 404 48143 "-" "python-requests/2.32.5" "-"
103.3.220.220 - - [18/Jan/2026:15:41:00 +0000] "GET /wp-login.php/administrator/index.php HTTP/1.1" 404 31 "-" "Mozill ...
show more
103.3.220.220 - - [18/Jan/2026:15:40:58 +0000] "GET /wp-login.php/wp-login.php HTTP/1.1" 404 48143 "-" "python-requests/2.32.5" "-"
103.3.220.220 - - [18/Jan/2026:15:41:00 +0000] "GET /wp-login.php/administrator/index.php HTTP/1.1" 404 31 "-" "Mozilla/5.0 (Linux; Android 11; Redmi Note 9 Pro Build/RKQ1.200826.002; wv) AppleWebKit/5310.36 (KHTML, like Gecko) Version/4.0 Chrome/90.0.4430.210 Mobile Safari/5310.36" "-"
103.3.220.220 - - [18/Jan/2026:15:41:01 +0000] "POST /wp-login.php/admin/index.php HTTP/1.1" 404 31 "-" "Mozilla/5.0 (Linux; Android 11; Redmi Note 9 Pro Build/RKQ1.200826.002; wv) AppleWebKit/5310.36 (KHTML, like Gecko) Version/4.0 Chrome/90.0.4430.210 Mobile Safari/5310.36" "-"
103.3.220.220 - - [18/Jan/2026:15:41:00 +0000] "GET /wp-login.php/administrator/index.php HTTP/1.1" 404 31 "-" "Mozilla/5.0 (Linux; Android 11; Redmi Note 9 Pro Build/RKQ1.200826.002; wv) AppleWebKit/5310.36 (KHTML, like Gecko) Version/4.0 Chrome/90.0.4430.210 Mobile Safari/5310.36" "-"
...
show less
Bad Web Bot
🇪🇸
robotstxt
2026-01-18 13:13:51
UTC ·
(9 months ago)
103.3.220.220 - - [18/Jan/2026:13:13:36 +0000] "GET /wp-login.php/wp-login.php HTTP/1.1" 404 48145 "-" rt="0.320" "python-requests/2.32.5" "-" h="economipedia.com" sn="economipedia.com" ru="/wp-login.php/wp-login.php" u="/index.php" ucs="-" ua="unix: ...
show more
103.3.220.220 - - [18/Jan/2026:13:13:36 +0000] "GET /wp-login.php/wp-login.php HTTP/1.1" 404 48145 "-" rt="0.320" "python-requests/2.32.5" "-" h="economipedia.com" sn="economipedia.com" ru="/wp-login.php/wp-login.php" u="/index.php" ucs="-" ua="unix:/var/run/php/economipedia83.sock" us="404" uct="0.000" urt="0.319"
103.3.220.220 - - [18/Jan/2026:13:13:38 +0000] "GET /wp-login.php/administrator/index.php HTTP/1.1" 404 31 "-" rt="0.280" "Mozilla/5.0 (Linux; Android 11; Redmi Note 9 Pro Build/RKQ1.200826.002; wv) AppleWebKit/5310.36 (KHTML, like Gecko) Version/4.0 Chrome/90.0.4430.210 Mobile Safari/5310.36" "-" h="economipedia.com" sn="economipedia.com" ru="/wp-login.php/administrator/index.php" u="/index.php" ucs="-" ua="unix:/var/run/php/economipedia83.sock" us="301" uct="0.000" urt="0.280"
103.3.220.220 - - [18/Jan/2026:13:13:38 +0000] "POST /wp-login.php/admin/index.php HTTP/1.1" 404 31 "-" rt="0.280" "Mozilla/5.0 (Linux; Android 11; Redmi Note 9 Pro Build/RKQ1.200826.002; wv) AppleWe
...
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2026-01-18 04:25:29
UTC ·
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 103.3.220.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 23:25:22.084355 2026] [security2:error] [pid 11619:tid 11619] [client 103.3.220.220:58649] M ...
show more
(mod_security) mod_security (id:210492) triggered by 103.3.220.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 23:25:22.084355 2026] [security2:error] [pid 11619:tid 11619] [client 103.3.220.220:58649] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "admin.turedinmobiliaria.com"] [uri "/.env"] [unique_id "aWxgsuI-L3GqdWbwe35mrwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-01-17 22:57:50
UTC ·
(9 months ago)
(wp-php-upload-includes) Block attempt to access .php in uploads wordpress uploads or well-known 103.3.220.220 (ID/Indonesia/-)
Brute-Force
2026-01-17 19:46:10
UTC ·
(9 months ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 103.3.220.220 (ID/Indonesia/-)
Port Scan
🇮🇩
sockominfo
2026-01-17 18:00:31
UTC ·
(9 months ago)
Reported by TangerangKota-CSIRT. Status: MALICIOUS
Email Spam
Hacking
