Automated distributed scraping of Forgejo git server (git.vitexsoftware.com). Bots systematically cr ...
show moreAutomated distributed scraping of Forgejo git server (git.vitexsoftware.com). Bots systematically crawled git blame endpoints (/*/blame/commit/<hash>/file) across all commits of public repositories, causing server load of 17+ (normal: <2). Over 71,000 unique IPs involved. Attack window: 2026-05-26 03:30-06:37 UTC. Primary target: PureHTML/purezencart (9933 commits, 5065 files). Each blame request triggers expensive git operations; 30,000+ slow requests per hour.
show less
[Tue Nov 18 18:20:33.049478 2025] [security2:error] [pid 486397:tid 140213245351616] [client 103.39. ...
show more[Tue Nov 18 18:20:33.049478 2025] [security2:error] [pid 486397:tid 140213245351616] [client 103.39.49.108:55938] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.20.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "183"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: 7% found within SERVER_NAME: staklim-malang.info request_line = GET /index.php/profil/arsip-artikel?catid=471&id=647%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-4-10-agustus-2015&start=110 HTTP/2.0 Request URI RAW = /index.php/profil/arsip-artikel?catid=471&id=647%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-4-10-agustus-2015&start=110 Requ..."] [hostname "staklim-malang.info"] [uri "/index.php/profil/arsip-artikel"] [unique_id "aRxWgf0HX0rkC
...
show less