🇮🇩
hermawan
2026-11-11 22:19:43
UTC ·
(3 days ago)
[Thu Nov 12 05:19:42.699920 2026] [security2:error] [pid 373625:tid 139652388345536] [client 122.161.51.166:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/cor ...
show more
[Thu Nov 12 05:19:42.699920 2026] [security2:error] [pid 373625:tid 139652388345536] [client 122.161.51.166:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "608"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.bmkg.go.id found within REQUEST_HEADERS:referer: https://www.bmkg.go.id/ request_line = GET /index.php?option=com_content&view=article&id=121&catid=344 HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php"] [unique_id "avTp_rSh-CU6kweI5llvkAAAAZc"], referer https://www.bmkg.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[373675] [ZZ16l4feDc0] [avTp_rSh-CU6kweI5llvkAAAAZc] keep_alive=[0] [2026-11-12 05:19:42.699927] [R:avTp_rSh-CU6kweI5llvkAAAAZc] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.3
...
show less
Email Spam
Hacking
🇺🇸
justbible
2026-11-10 18:30:21
UTC ·
(4 days ago)
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 5 requests from 2026-11-10T18:30:21+00:00 to 2026-11-11T12:38:46+00:00, e.g. 'GET /en/web,lsv,ylt/luke/1/47 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x6 ...
show more
HTTPS (TCP 443) scraping bot, part of a distributed and coordinated scrape: 5 requests from 2026-11-10T18:30:21+00:00 to 2026-11-11T12:38:46+00:00, e.g. 'GET /en/web,lsv,ylt/luke/1/47 HTTP/2.0' with User-Agent 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/152.0.0.0 Safari/537.36'. Forged browser headers; spoofed user agent (did not identify itself as a bot); robots.txt ignored (a disallowed URL requested).
show less
Bad Web Bot
🇺🇸
IndigoRidge
2026-10-09 07:40:55
UTC ·
(1 month ago)
122.161.51.166 - - [09/Oct/2026:03:36:03 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5130 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/67.0.0.0 Safari/537.36"
122.161.51.166 - - [09/Oct/2026:03:36:47 -0400] "POST ...
show more
122.161.51.166 - - [09/Oct/2026:03:36:03 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5130 "-" "Mozilla/5.0 (Linux; Android 10; x86) AppleWebKit/537.36 (KHTML, like Gecko) Opera/67.0.0.0 Safari/537.36"
122.161.51.166 - - [09/Oct/2026:03:36:47 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5158 "-" "Mozilla/5.0 (Windows NT 6.3; arm64) AppleWebKit/537.36 (KHTML, like Gecko) Opera/77.0.0.0 Safari/537.36"
122.161.51.166 - - [09/Oct/2026:03:40:17 -0400] "GET /wp-json/wp/v2/users HTTP/1.1" 403 5749 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"
122.161.51.166 - - [09/Oct/2026:03:40:22 -0400] "GET /wp-json/wp/v2/users HTTP/1.1" 403 5786 "-" "Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)"
122.161.51.166 - - [09/Oct/2026:03:40:53 -0400] "POST /xmlrpc.php HTTP/1.1" 200 5130 "-" "Mozilla/5.0 (Windows NT 10.0; x86) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇺🇸
kosada.com
2026-07-15 05:58:28
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
2024-08-31 11:11:42
UTC ·
(2 years ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
2024-07-27 05:41:44
UTC ·
(2 years ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2024-07-25 06:14:50
UTC ·
(2 years ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2024-07-16 05:21:22
UTC ·
(2 years ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
🇳🇿
Tripwire
2023-10-20 19:17:49
UTC ·
(3 years ago)
Wordpress login attempts
Brute-Force
Web App Attack
