2026-11-04 02:15:03
UTC ·
(6 days ago)
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show more
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Blocked by User-Agent Filter: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36 | UA: Mozilla/5.0 (Linux; Android 6.0; Nexus 5 Build/MRA58N) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/65.0.3325.181 Mobile Safari/537.36 | (Magento Site)
show less
Hacking
Bad Web Bot
🇮🇩
hermawan
2026-10-25 07:47:28
UTC ·
(2 weeks ago)
Captured JA4H: ge11n_9320ec489e62 | Log: 112.78.133.199 - - [25/Oct/2026:14:47:20 +0700] "GET /index.php/analisis-iklim/analisis-bulanan/analisis-distribusi-hujan/analisis-distribusi-curah-hujan HTTP/1.1" 200 14068 "https://staklim-jatim.bmkg.go.id/" ...
show more
Captured JA4H: ge11n_9320ec489e62 | Log: 112.78.133.199 - - [25/Oct/2026:14:47:20 +0700] "GET /index.php/analisis-iklim/analisis-bulanan/analisis-distribusi-hujan/analisis-distribusi-curah-hujan HTTP/1.1" 200 14068 "https://staklim-jatim.bmkg.go.id/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 Edg/155.0.0.0" ge11n_host,x-forwarded-scheme,x-forwarded-proto,x-forwarded-for,x-real-ip,connection,upgrade-insecure-requests,cf-ew-via,cdn-loop,sec-fetch-user,sec-fetch-site,cf-ray,accept-encoding,accept-language,accept,referer,user-agent,cf-connecting-ip,sec-fetch-mode,cf-visitor,sec-fetch-dest,priority,sec-ch-ua,sec-ch-ua-mobile,sec-ch-ua-platform,cf-ipcountry...
...
show less
Email Spam
Hacking
🇮🇩
bps-statistics
2026-10-24 05:39:00
UTC ·
(2 weeks ago)
Malicious Access
Brute-Force
🇮🇩
hermawan
2026-10-11 03:41:33
UTC ·
(4 weeks ago)
Captured JA4H: ge11n_9320ec489e62 | Log: 112.78.133.199 - - [11/Oct/2026:10:41:29 +0700] "GET /index.php/prediksi-iklim/prediksi-musim-tiap-6-bulan-sekali/prediksi-musim-kemarau/prediksi-puncak-musim-kemarau/per-kota-kabupaten/555562966-prediksi-6-bu ...
show more
Captured JA4H: ge11n_9320ec489e62 | Log: 112.78.133.199 - - [11/Oct/2026:10:41:29 +0700] "GET /index.php/prediksi-iklim/prediksi-musim-tiap-6-bulan-sekali/prediksi-musim-kemarau/prediksi-puncak-musim-kemarau/per-kota-kabupaten/555562966-prediksi-6-bulanan-puncak-musim-kemarau-tahun-2026-di-kabupaten-banyuwangi HTTP/1.1" 200 14544 "https://www.bing.com/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/155.0.0.0 Safari/537.36 Edg/155.0.0.0" ge11n_host,x-forwarded-scheme,x-forwarded-proto,x-forwarded-for,x-real-ip,connection,upgrade-insecure-requests,cf-ew-via,cdn-loop,sec-fetch-user,sec-fetch-site,cf-ray,accept-encoding,accept-language,accept,referer,user-agent,cf-connecting-ip,sec-fetch-mode,cf-visitor,sec-fetch-dest,priority,sec-ch-ua,sec-ch-ua-mobile,sec-ch-ua-platform,cf-ipcountry...
...
show less
Email Spam
Hacking
🇩🇪
von44bis33
2026-10-06 10:01:02
UTC ·
(1 month ago)
Cowrie SSH honeypot: unauthorized login attempts/commands observed.
Brute-Force
SSH
🇬🇧
spufidoo
2026-10-06 08:30:53
UTC ·
(1 month ago)
2026-10-06T09:28:33.433487+01:00 heimdall kernel: [12336922.477355] [UFW BLOCK] IN=eth0 OUT= MAC=b8:27:eb:a2:a7:d3:d4:05:de:c6:00:32:08:00:45:00:00:3c:fe:74:40:00:30:06:91:3c SRC=112.78.133.199 DST=192.168.4.77 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=651 ...
show more
2026-10-06T09:28:33.433487+01:00 heimdall kernel: [12336922.477355] [UFW BLOCK] IN=eth0 OUT= MAC=b8:27:eb:a2:a7:d3:d4:05:de:c6:00:32:08:00:45:00:00:3c:fe:74:40:00:30:06:91:3c SRC=112.78.133.199 DST=192.168.4.77 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=65140 DF PROTO=TCP SPT=20905 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0
2026-10-06T09:28:34.431710+01:00 heimdall kernel: [12336923.475571] [UFW BLOCK] IN=eth0 OUT= MAC=b8:27:eb:a2:a7:d3:d4:05:de:c6:00:32:08:00:45:00:00:3c:fe:75:40:00:30:06:91:3b SRC=112.78.133.199 DST=192.168.4.77 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=65141 DF PROTO=TCP SPT=20905 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0
2026-10-06T09:30:51.240865+01:00 heimdall kernel: [12337060.284469] [UFW BLOCK] IN=eth0 OUT= MAC=b8:27:eb:a2:a7:d3:d4:05:de:c6:00:32:08:00:45:00:00:3c:0b:22:40:00:30:06:84:8f SRC=112.78.133.199 DST=192.168.4.77 LEN=60 TOS=0x00 PREC=0x00 TTL=48 ID=2850 DF PROTO=TCP SPT=27231 DPT=22 WINDOW=65535 RES=0x00 SYN URGP=0
...
show less
Brute-Force
SSH
2026-10-03 03:40:29
UTC ·
(1 month ago)
denied SSH access attempt. destination port 22.
Port Scan
Brute-Force
SSH
🇺🇸
鬼影233
2026-09-29 08:45:43
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
uhhhhhhyeahnotanythingthatislikemyotheraccountsanywhereelse
2026-09-23 03:17:10
UTC ·
(1 month ago)
T-Pot honeypot: 4 credential/exploit attempts (Dionaea) in the last hour
Brute-Force
SSH
🇺🇸
鬼影233
2026-09-23 01:23:17
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇮🇩
hermawan
2026-09-21 02:55:10
UTC ·
(1 month ago)
[Mon Sep 21 09:55:05.336027 2026] [security2:error] [pid 78925:tid 139824774231744] [client 112.78.133.199:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bing.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/core ...
show more
[Mon Sep 21 09:55:05.336027 2026] [security2:error] [pid 78925:tid 139824774231744] [client 112.78.133.199:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bing.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "601"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.bing.go.id found within REQUEST_HEADERS:referer: https://www.bing.go.id/ request_line = GET /index.php HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php"] [unique_id "arCciRcXqaNyJx2K7yAFugAAAEg"], referer https://www.bing.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[78987] [j4yOYDVFGaI] [arCciRcXqaNyJx2K7yAFugAAAEg] keep_alive=[0] [2026-09-21 09:55:05.336031] [R:arCciRcXqaNyJx2K7yAFugAAAEg] UA:'Mozilla/5.0 (Linux; Android 10; Pixel 6 Build/QP1A.190711.020) AppleWebKit/555.31 (KHTML, like Gecko) Firefox/93.0.3094.77 Mobile Safari/555.10' Host:'staklim-ja
...
show less
Email Spam
Hacking
🇺🇸
鬼影233
2026-09-14 06:55:09
UTC ·
(1 month ago)
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.0.0 Safari/537.36
Bad Web Bot
🇺🇸
鬼影233
2026-09-11 18:52:18
UTC ·
(1 month ago)
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Bad Web Bot
2026-08-27 12:05:20
UTC ·
(2 months ago)
denied traffic to a honeypot network. destination port 22.
Port Scan
Hacking
🇺🇸
kosada.com
2026-08-09 12:50:51
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
