🇮🇩
bebekpintar
2026-10-29 08:30:40
UTC ·
(2 weeks ago)
NETRA (CSIRT Bappenas) automated WAF report. IP was challenged at our perimeter. Attack type: Coordinated campaign (severity MEDIUM) Trigger: IP part of coordinated attack campaign universitas_brawijaya_UNITED STATES_175.45.191; challengeed by auto-d ...
show more
NETRA (CSIRT Bappenas) automated WAF report. IP was challenged at our perimeter. Attack type: Coordinated campaign (severity MEDIUM) Trigger: IP part of coordinated attack campaign universitas_brawijaya_UNITED STATES_175.45.191; challengeed by auto-defense bulk action Source: Bappenas CSIRT SOC campaign detection.
show less
Fraud Orders
🇮🇩
hermawan
2026-10-26 07:56:47
UTC ·
(2 weeks ago)
[Mon Oct 26 14:56:46.920790 2026] [security2:error] [pid 272358:tid 140267239757504] [client 175.45.191.254:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm /gtagku-v2.js /administrator/index.php?option=com_content /swiper-v114na.j ...
show more
[Mon Oct 26 14:56:46.920790 2026] [security2:error] [pid 272358:tid 140267239757504] [client 175.45.191.254:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm /gtagku-v2.js /administrator/index.php?option=com_content /swiper-v114na.js /ga-choise-v6.js /bmkg-192.png /800-600.webp /bmkg-192x192.png /ga-v5.js /favicon-16-16.png /matomo-partition-21-01-2026-5-5-0.js /script-v185.js /script-v188.js /script-v184.j ..." against "REQUEST_LINE" required. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "475"] [id "440008"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: If-Modified-Since found within REQUEST_LINE: GET /Whatsapp_Kantor_BMKG_Malang_Stasiun_Klimatologi_Jawa_Timur_40X40.webp HTTP/1.1 request_line = GET /Whatsapp_Kantor_BMKG_Malang_Stasiun_Klimatologi_Jawa_Timur_40X40.webp HTTP/1.1 Request URI RAW = /Whatsapp_Kantor_BMKG_Malang_Stasi
...
show less
Email Spam
Hacking
🇺🇸
kosada.com
2026-07-22 03:37:44
UTC ·
(3 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇺🇸
kosada.com
2026-07-11 07:04:27
UTC ·
(4 months ago)
Web bot: denial-of-service flood
DDoS Attack
Bad Web Bot
🇮🇩
hermawan
2026-06-26 09:06:56
UTC ·
(4 months ago)
[Fri Jun 26 16:06:54.953956 2026] [security2:error] [pid 94590:tid 139866655409856] [client 175.45.191.254:54902] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "apple-touch-icon-120x120-precomposed.png" at REQUEST_FILENAME. [file ...
show more
[Fri Jun 26 16:06:54.953956 2026] [security2:error] [pid 94590:tid 139866655409856] [client 175.45.191.254:54902] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "apple-touch-icon-120x120-precomposed.png" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "88"] [id "448101"] [msg "BAD REQUEST FILENAME - Detected and Blocked"] [data "Matched Data: apple-touch-icon-120x120-precomposed.png found within REQUEST_FILENAME: /apple-touch-icon-120x120-precomposed.png request_line = GET /apple-touch-icon-120x120-precomposed.png HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/apple-touch-icon-120x120-precomposed.png"] [unique_id "aj5BLluCDW4n2pM9Mu6muwAB1AQ"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[94595] [GWwdbmQdjVc] [aj5BLluCDW4n2pM9Mu6muwAB1AQ] keep_alive=[1] [2026-06-26 16:06:54.953959] [R:aj5BLluCDW4n2pM9Mu6muwAB1AQ] UA:'MobileSafari/8615.8.1.10.2 CFNetwork/1410
...
show less
Email Spam
Hacking
🇮🇩
hermawan
2026-06-23 02:24:02
UTC ·
(4 months ago)
[Tue Jun 23 09:23:58.274849 2026] [security2:error] [pid 1367171:tid 140213902325440] [client 175.45.191.254:51006] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/ ...
show more
[Tue Jun 23 09:23:58.274849 2026] [security2:error] [pid 1367171:tid 140213902325440] [client 175.45.191.254:51006] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "188"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: chatgpt found within SERVER_NAME: staklim-jatim.bmkg.go.id request_line = GET /?utm_source=chatgpt.com HTTP/2.0 Request URI RAW = /?utm_source=chatgpt.com Request Basename = "] [hostname "staklim-jatim.bmkg.go.id"] [uri "/"] [unique_id "ajnuPqKWconcF7i4p2gnRgAAzQg"], referer https://chatgpt.com/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[1367180] [8Fpgc2J1MGI] [ajnuPqKWconcF7i4p2gnRgAAzQg] keep_alive=[1] [2026-06-23 09:23:58.274854] [R:ajnuPqKWconcF7i4p2gnRgAAzQg] UA:'Mozilla/5.0 (Win
...
show less
Email Spam
Hacking
🇮🇩
hermawan
2026-06-04 00:23:16
UTC ·
(5 months ago)
06/04/2026-07:23:07.042641 [Drop] [**] [1:2210044:2] SURICATA STREAM Packet with invalid timestamp [**] [Classification: Generic Protocol Command Decode] [Priority: 3] {TCP} 175.45.191.254:48284 -> 103.166.156.58:443
...
Email Spam
Hacking
🇮🇩
hermawan
2026-06-03 09:22:45
UTC ·
(5 months ago)
[Wed Jun 03 16:22:45.249416 2026] [authz_core:error] [pid 234969:tid 140183237265088] [client 175.45.191.254:54446] AH01630: client denied by server configuration: /var/matomo/matomo.php, referer https://matomo.staklim-malang.info/ [matomo.staklim-ma ...
show more
[Wed Jun 03 16:22:45.249416 2026] [authz_core:error] [pid 234969:tid 140183237265088] [client 175.45.191.254:54446] AH01630: client denied by server configuration: /var/matomo/matomo.php, referer https://matomo.staklim-malang.info/ [matomo.staklim-malang.info] [matomo.staklim-malang.info] top=[234990] [4i5i+FWYPg0] [ah_yZeTw2ZKluYsFfcXZ0gABAgc] keep_alive=[1] [2026-06-03 16:22:45.249423] [R:ah_yZeTw2ZKluYsFfcXZ0gABAgc] UA:'Mozilla/5.0 (Linux; Android 14; Pixel 6 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.6261.119 Mobile Safari/537.36 OPR/81.2.4292.78581' Host:'matomo.staklim-malang.info:443' ACCEPT:'*/*' Referer:'https://matomo.staklim-malang.info/ Accept-Encoding:'gzip, deflate, br Accept-Language:'en-US,en;q=0.8
...
show less
Email Spam
Hacking
🇮🇩
hermawan
2026-06-02 08:48:37
UTC ·
(5 months ago)
[Tue Jun 02 15:48:34.163784 2026] [security2:error] [pid 273160:tid 140637056755392] [client 175.45.191.254:51452] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.yahoo.go.id" at REQUEST_HEADERS:Referer. [file "/etc/modsecurit ...
show more
[Tue Jun 02 15:48:34.163784 2026] [security2:error] [pid 273160:tid 140637056755392] [client 175.45.191.254:51452] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.yahoo.go.id" at REQUEST_HEADERS:Referer. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "582"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.yahoo.go.id found within REQUEST_HEADERS:Referer: https://www.yahoo.go.id/ request_line = GET /index.php/profil/meteorologi/geofisika/555558584-poster-skala-gempa-mmi HTTP/2.0"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/meteorologi/geofisika/555558584-poster-skala-gempa-mmi"] [unique_id "ah6Y4odO4l2wmX9kJk7bbwABwQo"], referer https://www.yahoo.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[273192] [10JJYAF9Z7k] [ah6Y4odO4l2wmX9kJk7bbwABwQo] keep_alive=[1] [2026-06-02 15:48:34.163800] [R:ah6Y4odO4l2wmX9kJk7bbwABwQo] UA:'Mozilla/5.0 (iPhone; CPU iP
...
show less
Email Spam
Hacking
🇮🇩
hermawan
2026-05-21 10:53:32
UTC ·
(5 months ago)
1779360799.167972 175.45.191.254 103.166.156.58 65535_2-1-3-1-1-4_1366_8 2026-05-21 17:53:19 WIB
...
Email Spam
Hacking
🇮🇩
hermawan
2026-05-12 06:31:46
UTC ·
(6 months ago)
1778566875.047355 175.45.191.254 103.166.156.58 65535_2-1-3-1-1-4_1354_8 2026-05-12 13:21:15 WIB
...
Email Spam
Hacking
🇮🇩
hermawan
2026-04-18 04:33:59
UTC ·
(6 months ago)
1776486832.578052 175.45.191.254 103.166.156.58 65535_2-1-3-1-1-8-4_1366_6 2026-04-18 11:33:52 WIB
...
Email Spam
Hacking
🇮🇩
hermawan
2026-03-12 05:06:38
UTC ·
(8 months ago)
03/12/2026-11:51:46.626445 [Drop] [**] [1:920078:1] match JA4 scan Uniq 33 [**] [Classification: (null)] [Priority: 3] {TCP} 175.45.191.254:8498 -> 103.166.156.58:443
...
Email Spam
Hacking
🇮🇩
hermawan
2026-03-11 06:56:55
UTC ·
(8 months ago)
03/11/2026-13:52:58.833946 [Drop] [**] [1:920078:1] match JA4 scan Uniq 33 [**] [Classification: (null)] [Priority: 3] {TCP} 175.45.191.254:13094 -> 103.166.156.58:443
...
Email Spam
Hacking
🇮🇩
hermawan
2026-03-06 01:53:54
UTC ·
(8 months ago)
03/06/2026-08:53:08.686304 [Drop] [**] [1:920078:1] match JA4 scan Uniq 33 [**] [Classification: (null)] [Priority: 3] {TCP} 175.45.191.254:8438 -> 103.166.156.58:443
...
Email Spam
Hacking
