๐ฎ๐ฉ
hermawan
2026-03-27 03:54:30
(5 months ago)
[Fri Mar 27 10:54:27.273876 2026] [security2:error] [pid 483271:tid 140683238119104] [client 139.165 ...
show more
[Fri Mar 27 10:54:27.273876 2026] [security2:error] [pid 483271:tid 140683238119104] [client 139.165.31.22:37140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Head" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.24.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "296"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Head found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/140.0.7339.16 Safari/537.36 request_line = GET /OneSignalSDKWorker.js HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/OneSignalSDKWorker.js"] [unique_id "acX_c_jBWS29BeEg6TQzgwAAQw4"], referer https://staklim-jatim.bmkg.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[483352] [f+J2dHk8u3o] [acX_c_jBWS29BeEg6TQzgwAAQw4] keep_alive=[1] [2026-03-27 10:54:27.273894] [R:acX_c_jBWS29BeEg6TQzgwAAQw4] UA:'Mozilla/5.0 (X11; Linux x86
...
show less
Web App Attack
Hacking
๐ฎ๐ช
Coolnagour
2026-03-27 00:12:18
(5 months ago)
http-probing: /signin
Web App Attack
๐บ๐ธ
ipblock.com
2026-03-26 17:29:00
(5 months ago)
IPBlock protected site ID [1365-l].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
๐บ๐ธ
ipblock.com
2026-03-26 12:46:00
(5 months ago)
IPBlock protected site ID [955-wdo][s=02].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
๐ซ๐ฎ
JimArchon72
2026-03-26 09:05:01
(5 months ago)
2026/03/26 09:01:06 "GET /wp-login.php HTTP/2.0"
Web App Attack
๐ฉ๐ช
Viveronese
2026-03-26 01:46:38
(5 months ago)
HTTP vulnerability scanning
Web App Attack
๐ฆ๐บ
aranguren.org
2026-03-25 18:22:58
(5 months ago)
139.165.31.22 - - [26/Mar/2026:05:22:55 +1100] "GET /login HTTP/2.0" 404 985 "-" "Mozilla/5.0 (Windo ...
show more
139.165.31.22 - - [26/Mar/2026:05:22:55 +1100] "GET /login HTTP/2.0" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
139.165.31.22 - - [26/Mar/2026:05:22:55 +1100] "GET /signin HTTP/2.0" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
139.165.31.22 - - [26/Mar/2026:05:22:56 +1100] "GET /sign-in HTTP/2.0" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
139.165.31.22 - - [26/Mar/2026:05:22:56 +1100] "GET /log-in HTTP/2.0" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
139.165.31.22 - - [26/Mar/2026:05:22:57 +1100] "GET /user/signin HTTP/2.0" 404 985 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36"
139.165.31.22 -
...
show less
Bad Web Bot
๐บ๐ธ
ipblock.com
2026-03-25 07:56:00
(5 months ago)
IPBlock protected site ID [3192-af][s=02].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
๐ฌ๐ง
consul.to
2026-03-25 05:40:41
(5 months ago)
Web attack/malicious scanning detected
Web App Attack
๐ฎ๐ช
Coolnagour
2026-03-25 00:19:16
(5 months ago)
http-probing: /signin
Web App Attack
๐ฎ๐ฉ
hermawan
2026-03-07 13:11:52
(6 months ago)
[Sat Mar 07 20:11:06.632681 2026] [security2:error] [pid 676156:tid 140640579987136] [client 139.165 ...
show more
[Sat Mar 07 20:11:06.632681 2026] [security2:error] [pid 676156:tid 140640579987136] [client 139.165.31.22:44422] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Head" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.22.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "253"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Head found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/140.0.7339.16 Safari/537.36 request_line = GET /OneSignalSDKWorker.js HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/OneSignalSDKWorker.js"] [unique_id "aawj6gmwiOhYZhtY77jqwQABTwU"], referer https://staklim-jatim.bmkg.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[676162] [SNzg5m6EpoE] [aawj6gmwiOhYZhtY77jqwQABTwU] keep_alive=[1] [2026-03-07 20:11:06.632685] [R:aawj6gmwiOhYZhtY77jqwQABTwU] UA:'Mozilla/5.0 (X11; Linux x86
...
show less
Web App Attack
Hacking
๐ฎ๐ช
Coolnagour
2026-03-07 05:45:07
(6 months ago)
http-probing: /signin
Web App Attack
๐ฉ๐ช
Viveronese
2026-03-07 01:46:28
(6 months ago)
HTTP vulnerability scanning
Web App Attack
๐บ๐ธ
ipblock.com
2026-03-07 01:02:00
(6 months ago)
IPBlock protected site ID [1365-l].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
๐บ๐ธ
ipblock.com
2026-03-06 21:13:00
(6 months ago)
IPBlock protected site ID [955-wdo][s=02].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack