Log in to view charts and search reports for this IP.
Log In
Reports Activity
Example preview
Report Categories (Last 60 Days)
Example preview
Top Reporter Countries (Last 60 Days)
Example preview
Account required for the enhanced features
Log inSign up
IP Abuse Reports for 143.105.147.42
This IP address has been reported a total of
32
times from
24 distinct
sources.
143.105.147.42 was first reported on
, and the most recent report was
.
In the last 60 days, the top reporter locations were:
United States of America
with 3
reports;
Germany
with 2
reports;
France
with 2
reports.
The most common categories in these recent reports were:
DDoS Attack
5
times;
Hacking
4
times;
Port Scan
3
times;
Bad Web Bot
3
times;
SSH
2
times;
Other
6
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
[Thu Oct 01 12:17:33.085108 2026] [security2:error] [pid 65043:tid 139958421550784] [client 143.105. ...
show more[Thu Oct 01 12:17:33.085108 2026] [security2:error] [pid 65043:tid 139958421550784] [client 143.105.147.42:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "208"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: %3a found within SERVER_NAME: staklim-jatim.bmkg.go.id request_line = GET /index.php/profil/arsip-artikel?catid=633&id=555556205%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-30-mei-5-juni-2017&start=80 HTTP/1.1 Request URI RAW = /index.php/profil/arsip-artikel?catid=633&id=555556205%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-30-mei-5-juni-..."] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/arsip-artikel"] [unique_id "ar3s7W3aNatr
...
show less
Repeated requests classified as pathological web bot behavior, for example: /[redacted]/search?f%5B0 ...
show moreRepeated requests classified as pathological web bot behavior, for example: /[redacted]/search?f%5B0%5D=digest_key_terms%3A388&f%5B1%5D=digest_key_terms%3A517&f%5B2%5D=digest_publication_type%3A927&field_article_edition%5B504%5D=504&field_key_terms%5B392%5D=392&page=3 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36")
show less
Large-scale coordinated botnet (2M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/S ...
show moreLarge-scale coordinated botnet (2M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]); Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]) employed by Angara Technologies Group | Attack Signature Blocked: /catalog/product_compare/add/product/232/uenc/aHR0cHM6Ly93d3cuZDJvZmZpY2UucnUvY2F0YWxvZ3NlYXJjaC9yZXN1bHQvP2NhdD00JmFtcDtwPTQmYW1wO3E9VGVsZXByZXNlbmNl/form_key/HmOtFPCRyPTSa3A0/ | UA: Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_0 rv:5.0; om-KE) AppleWebKit/534.28.3 (KHTML, like Gecko) Version/4.0.3 Safari/534.28.3 | (Magento Site)
show less
[v5-99] Firewall dropped 12 unsolicited packet(s) proto=tcp to port(s) 23,22 from 143.105.147.42 — W ...
show more[v5-99] Firewall dropped 12 unsolicited packet(s) proto=tcp to port(s) 23,22 from 143.105.147.42 — WAN scan (automated sensor)
show less
UDP flood (DDoS) vs AS215599: 10 pkts / 0.01 MB to UDP 80/8443 across 10 dst IP(s), 2026-08-19 21:46 ...
show moreUDP flood (DDoS) vs AS215599: 10 pkts / 0.01 MB to UDP 80/8443 across 10 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
UDP flood (DDoS) vs AS215599: 10 pkts / 0.01 MB to UDP 80/8443 across 10 dst IP(s), 2026-08-19 21:46 ...
show moreUDP flood (DDoS) vs AS215599: 10 pkts / 0.01 MB to UDP 80/8443 across 10 dst IP(s), 2026-08-19 21:46 to 2026-08-20 00:36 CEST. No legitimate service on these UDP ports (7-day baseline 0 GB/day). Carpet-bombing of a /24, likely botnet-compromised host. Evidence: sFlow + hardware ACL counters.
show less
DDoS Attack
Exploited Host
Anonymous
“HTTP Flood DDoS targeting domain.tld:443 via repeated GET requests to /[category]?q=Po%C4%8Det+stra ...
show more“HTTP Flood DDoS targeting domain.tld:443 via repeated GET requests to /[category]?q=Po%C4%8Det+stran-[random-numbers] (e.g., /2-vsechny-produkty?q=Po%C4%8Det+stran-112-144-160-368-96). Uses spoofed Chrome/Safari/Googlebot UAs. Returns 403/404 errors due to fail2ban. Likely Layer 7 attack to exhaust server resources via pagination brute-forcing.“
show less
