🇮🇩
hermawan
2023-04-14 10:54:18
(3 years ago)
[Fri Apr 14 17:54:16.847305 2023] [security2:error] [pid 120949:tid 140416055539264] [client 144.126 ...
show more
[Fri Apr 14 17:54:16.847305 2023] [security2:error] [pid 120949:tid 140416055539264] [client 144.126.131.132:40420] [client 144.126.131.132] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "137"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /api/.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/api/.env"] [unique_id "ZDkw2EeKwevhE6bAnr6xiwAAAQU"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[121006] [fqaUqdlSleA] [ZDkw2EeKwevhE6bAnr6xiwAAAQU] keep_alive=[0] [2023-04-14 17:54:16.847309] [R:ZDkw2EeKwevhE6bAnr6xiwAAAQU] UA:'Mozilla
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-04-11 20:33:53
(3 years ago)
[Wed Apr 12 03:33:51.555182 2023] [security2:error] [pid 38333:tid 139834515408448] [client 144.126. ...
show more
[Wed Apr 12 03:33:51.555182 2023] [security2:error] [pid 38333:tid 139834515408448] [client 144.126.131.132:43552] [client 144.126.131.132] ModSecurity: Access denied with code 403 (phase 2). Match of "pm AppleWebKit Android" against "REQUEST_HEADERS:User-Agent" required. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1628"] [id "920300"] [msg "Request Missing an Accept Header"] [data "Matched Data: host found within REQUEST_HEADERS:User-Agent: Go-http-client/2.0 request_line = GET /sftp.json HTTP/2.0"] [severity "NOTICE"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/sftp.json"] [unique_id "ZDXEL4TTlq9MbARVN2MTQAAAkRs"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[38361] [WxrKaK21mGM] [ZDXEL4TTlq9MbARVN2MTQA
...
show less
Hacking
Web App Attack
🇳🇱
mawan
2023-04-11 05:20:59
(3 years ago)
Suspected of having performed illicit activity on AMS server.
Web App Attack
🇺🇸
bigscoots.com
2023-04-11 03:19:30
(3 years ago)
(PERMBLOCK) 144.126.131.132 (US/United States/vmi1155256.contaboserver.net) has had more than 4 temp ...
show more
(PERMBLOCK) 144.126.131.132 (US/United States/vmi1155256.contaboserver.net) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: 1; Trigger: LF_PERMBLOCK_COUNT; Logs:
show less
Brute-Force
SSH
🇮🇩
hermawan
2023-04-10 13:57:35
(3 years ago)
[Mon Apr 10 20:57:33.892892 2023] [security2:error] [pid 21557:tid 140383682029120] [client 144.126. ...
show more
[Mon Apr 10 20:57:33.892892 2023] [security2:error] [pid 21557:tid 140383682029120] [client 144.126.131.132:39726] [client 144.126.131.132] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "137"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/wp-config.php"] [unique_id "ZDQVzSV6hTPoP47SxpRrcwAAAG8"], referer http://karangploso.jatim.bmkg.go.id/wp-config.php [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[21656] [SXawwcNEKSI] [ZDQVzSV6hTPoP47SxpRrcwAAAG8] keep
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-04-09 20:27:42
(3 years ago)
[Mon Apr 10 03:27:38.844191 2023] [security2:error] [pid 616017:tid 139888972260928] [client 144.126 ...
show more
[Mon Apr 10 03:27:38.844191 2023] [security2:error] [pid 616017:tid 139888972260928] [client 144.126.131.132:41718] [client 144.126.131.132] ModSecurity: Access denied with code 403 (phase 2). Match of "pm AppleWebKit Android" against "REQUEST_HEADERS:User-Agent" required. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1628"] [id "920300"] [msg "Request Missing an Accept Header"] [data "Matched Data: host found within REQUEST_HEADERS:User-Agent: Go-http-client/2.0 request_line = GET /sftp.json HTTP/2.0"] [severity "NOTICE"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/sftp.json"] [unique_id "ZDMfupZO5sHJp1bilbChyAAATQE"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[616019] [EwXlFn2H//Q] [ZDMfupZO5sHJp1bilbCh
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-04-06 12:32:40
(3 years ago)
[Thu Apr 06 19:32:38.650962 2023] [security2:error] [pid 228856:tid 140118625084992] [client 144.126 ...
show more
[Thu Apr 06 19:32:38.650962 2023] [security2:error] [pid 228856:tid 140118625084992] [client 144.126.131.132:47650] [client 144.126.131.132] ModSecurity: Access denied with code 403 (phase 2). Match of "pm AppleWebKit Android" against "REQUEST_HEADERS:User-Agent" required. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1628"] [id "920300"] [msg "Request Missing an Accept Header"] [data "Matched Data: host found within REQUEST_HEADERS:User-Agent: Go-http-client/2.0 request_line = GET /sftp.json HTTP/2.0"] [severity "NOTICE"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/sftp.json"] [unique_id "ZC675i8YoKYedgikkve-HQAAyAE"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[228858] [LISgGrr/e3E] [ZC675i8YoKYedgikkve-
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-04-05 17:38:19
(3 years ago)
[Thu Apr 06 00:38:17.572794 2023] [security2:error] [pid 269416:tid 140666331788864] [client 144.126 ...
show more
[Thu Apr 06 00:38:17.572794 2023] [security2:error] [pid 269416:tid 140666331788864] [client 144.126.131.132:48586] [client 144.126.131.132] ModSecurity: Access denied with code 403 (phase 2). Match of "pm AppleWebKit Android" against "REQUEST_HEADERS:User-Agent" required. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1628"] [id "920300"] [msg "Request Missing an Accept Header"] [data "Matched Data: host found within REQUEST_HEADERS:User-Agent: Go-http-client/2.0 request_line = GET /api/index.php/v1/config/application?public=true HTTP/2.0"] [severity "NOTICE"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/api/index.php/v1/config/application"] [unique_id "ZC2yCTMSRL2BMnkbdGkjkQAASzA"] [karangploso.jatim.bmkg.go.id] [karangploso.ja
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-04-05 09:38:53
(3 years ago)
[Wed Apr 05 16:38:45.294532 2023] [security2:error] [pid 652916:tid 139887787218496] [client 144.126 ...
show more
[Wed Apr 05 16:38:45.294532 2023] [security2:error] [pid 652916:tid 139887787218496] [client 144.126.131.132:39686] [client 144.126.131.132] ModSecurity: Access denied with code 403 (phase 2). Match of "pm AppleWebKit Android" against "REQUEST_HEADERS:User-Agent" required. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1628"] [id "920300"] [msg "Request Missing an Accept Header"] [data "Matched Data: host found within REQUEST_HEADERS:User-Agent: Go-http-client/2.0 request_line = GET /sftp.json HTTP/2.0"] [severity "NOTICE"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/sftp.json"] [unique_id "ZC1BpW91jkro7mhCbumlJgAAEyY"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[652955] [HrrmjsOz8cw] [ZC1BpW91jkro7mhCbuml
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-04-02 03:19:04
(3 years ago)
[Sun Apr 02 10:19:01.276643 2023] [security2:error] [pid 800762:tid 139943648962112] [client 144.126 ...
show more
[Sun Apr 02 10:19:01.276643 2023] [security2:error] [pid 800762:tid 139943648962112] [client 144.126.131.132:51156] [client 144.126.131.132] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "python-requests" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "151"] [id "913101"] [msg "Found User-Agent associated with scripting/generic HTTP client"] [data "Matched Data: python-requests found within REQUEST_HEADERS:User-Agent: python-requests/2.27.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scripting"] [tag "OWASP_CRS"] [tag "capec/1000/118/224/541/310"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/modules/mod_simplefileuploadv1.3/elements/Clean.php"] [unique_id "ZCj0JdXF2AWaiUpjLj8BKgAAAEo"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id]
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-03-31 13:44:21
(3 years ago)
[Fri Mar 31 20:44:18.688377 2023] [security2:error] [pid 677090:tid 140143249536576] [client 144.126 ...
show more
[Fri Mar 31 20:44:18.688377 2023] [security2:error] [pid 677090:tid 140143249536576] [client 144.126.131.132:49236] [client 144.126.131.132] ModSecurity: Access denied with code 403 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "923"] [id "920340"] [msg "Request Containing Content, but Missing Content-Type header"] [data "Matched Data: 19 found within REQUEST_HEADERS: 0 request_line = GET /public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1"] [severity "NOTICE"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/public/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "ZCbjssyKbJVWnpeb7dlvOgAAApk"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[677167] [DU/lZ4ppJVs]
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-03-31 13:10:53
(3 years ago)
[Fri Mar 31 20:10:50.957752 2023] [security2:error] [pid 621806:tid 139784991057472] [client 144.126 ...
show more
[Fri Mar 31 20:10:50.957752 2023] [security2:error] [pid 621806:tid 139784991057472] [client 144.126.131.132:53750] [client 144.126.131.132] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "python-requests" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-913-SCANNER-DETECTION.conf"] [line "151"] [id "913101"] [msg "Found User-Agent associated with scripting/generic HTTP client"] [data "Matched Data: python-requests found within REQUEST_HEADERS:User-Agent: python-requests/2.27.1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scripting"] [tag "OWASP_CRS"] [tag "capec/1000/118/224/541/310"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/.env"] [unique_id "ZCbb2oT2cBrHbRHrEaIZYgAAAEI"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[621860] [oGg18OHL1dQ] [ZCbb2oT2cBrHbRHrEaIZYgAAAEI] k
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-03-30 19:02:58
(3 years ago)
[Fri Mar 31 02:02:55.406737 2023] [security2:error] [pid 411609:tid 139876504360512] [client 144.126 ...
show more
[Fri Mar 31 02:02:55.406737 2023] [security2:error] [pid 411609:tid 139876504360512] [client 144.126.131.132:58330] [client 144.126.131.132] ModSecurity: Access denied with code 403 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "923"] [id "920340"] [msg "Request Containing Content, but Missing Content-Type header"] [data "Matched Data: AppleWebKit/537.36 found within REQUEST_HEADERS: 0 request_line = GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1"] [severity "NOTICE"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "ZCXc30XltsuaLPDkpYK19wAAAF8"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[411694]
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-03-29 23:32:38
(3 years ago)
[Thu Mar 30 06:32:35.562719 2023] [security2:error] [pid 510373:tid 140057201202752] [client 144.126 ...
show more
[Thu Mar 30 06:32:35.562719 2023] [security2:error] [pid 510373:tid 140057201202752] [client 144.126.131.132:39542] [client 144.126.131.132] ModSecurity: Access denied with code 403 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "923"] [id "920340"] [msg "Request Containing Content, but Missing Content-Type header"] [data "Matched Data: AppleWebKit/537.36 found within REQUEST_HEADERS: 0 request_line = GET /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1"] [severity "NOTICE"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "ZCTKk039lGei1CA3VYoHgAAAAK8"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[510472]
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-03-29 01:10:10
(3 years ago)
[Wed Mar 29 08:10:08.427431 2023] [security2:error] [pid 526659:tid 139654114100800] [client 144.126 ...
show more
[Wed Mar 29 08:10:08.427431 2023] [security2:error] [pid 526659:tid 139654114100800] [client 144.126.131.132:37706] [client 144.126.131.132] ModSecurity: Access denied with code 403 (phase 2). String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1313"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".inc"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [host
...
show less
Hacking
Web App Attack