🇮🇩
Incidents Response Neptus Team
2025-06-09 12:57:00
(1 year ago)
Report Abuse IP
Hacking
Bad Web Bot
Exploited Host
Web App Attack
2025-06-09 04:40:57
(1 year ago)
139.59.224.251 - - [09/Jun/2025:06:39:22 +0200] "GET /un.php HTTP/1.1" 404 18825 "www.google.com" "M ...
show more
139.59.224.251 - - [09/Jun/2025:06:39:22 +0200] "GET /un.php HTTP/1.1" 404 18825 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
139.59.224.251 - - [09/Jun/2025:06:39:23 +0200] "GET /un.php HTTP/1.1" 404 11329 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
139.59.224.251 - - [09/Jun/2025:06:39:24 +0200] "GET /foxx.php HTTP/1.1" 404 11328 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
139.59.224.251 - - [09/Jun/2025:06:39:25 +0200] "GET /foxx.php HTTP/1.1" 404 11328 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie
...
show less
DDoS Attack
🇺🇸
ipblock.com
2025-06-09 03:16:00
(1 year ago)
IPBlock protected site ID [4730-fr].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
🇺🇸
ipblock.com
2025-06-08 20:06:00
(1 year ago)
IPBlock protected site ID [4055-d][s=06].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2025-06-08 13:52:42
(1 year ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇩🇪
paissangroup
2025-06-08 08:51:13
(1 year ago)
Multiple WAF Violations
Web App Attack
🇺🇦
URAN Publishing Service
2025-06-08 06:31:58
(1 year ago)
139.59.224.251 - - [08/Jun/2025:09:31:56 +0300] "GET /wp-content/themes/alera/alpha.php HTTP/1.1" 40 ...
show more
139.59.224.251 - - [08/Jun/2025:09:31:56 +0300] "GET /wp-content/themes/alera/alpha.php HTTP/1.1" 404 196 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
139.59.224.251 - - [08/Jun/2025:09:31:57 +0300] "GET /wp-content/themes/alera/alpha.php HTTP/1.1" 404 2793 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
...
show less
Web App Attack
🇮🇩
Incidents Response Neptus Team
2025-06-06 15:30:00
(1 year ago)
Report Abuse IP
Hacking
Exploited Host
Web App Attack
2025-06-05 00:58:05
(1 year ago)
(WPLOGIN) WP Login Attack 139.59.224.251 (SG/Singapore/-): 10 in the last 3600 secs; Ports: *; Direc ...
show more
(WPLOGIN) WP Login Attack 139.59.224.251 (SG/Singapore/-): 10 in the last 3600 secs; Ports: *; Direction: 1
show less
Brute-Force
SSH
🇬🇧
Apache
2025-06-04 23:33:04
(1 year ago)
(mod_security) mod_security (id:20000010) triggered by 139.59.224.251 (SG/Singapore/-): 5 in the las ...
show more
(mod_security) mod_security (id:20000010) triggered by 139.59.224.251 (SG/Singapore/-): 5 in the last 300 secs
show less
Brute-Force
Web App Attack
🇧🇪
cmbplf
2025-06-04 22:28:22
(1 year ago)
6 requests with url.path /indoxploit.php
Brute-Force
Bad Web Bot
🇩🇪
ps-center
2025-06-04 20:30:38
(1 year ago)
ABV: Web Attack GET /wp-includes/class-wp-other.php
Web Spam
Hacking
Bad Web Bot
Web App Attack
🇮🇩
securejdprop
2025-06-04 15:28:18
(1 year ago)
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent. Ip 139.59.224.251 per ...
show more
This IP was detected by CrowdSec triggering crowdsecurity/http-bad-user-agent. Ip 139.59.224.251 performed 'crowdsecurity/http-bad-user-agent' (2 events over 164.420675ms) at 2025-06-04 15:28:17.422306937 +0000 UTC
show less
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2025-06-04 13:27:21
(1 year ago)
[Wed Jun 04 20:27:20.669453 2025] [security2:error] [pid 382508:tid 139723867678400] [client 139.59. ...
show more
[Wed Jun 04 20:27:20.669453 2025] [security2:error] [pid 382508:tid 139723867678400] [client 139.59.224.251:54173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Mozlila" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.14.0/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "59"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: Mozlila found within REQUEST_HEADERS:User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36 request_line = GET /un.php HTTP/1.1 Request URI RAW = /un.php Request Basename = un.php"] [severity "CRITICAL"] [ver "OWASP_CRS/4.14.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "
...
show less
Hacking
Web App Attack
🇺🇸
ipblock.com
2025-06-04 12:44:00
(1 year ago)
IPBlock protected site ID [4055-d][s=06].
Exploit request, vulnerability scanner.
Hacking
Bad Web Bot
Web App Attack