180.251.182.27

[Thu Nov 12 15:55:23.890880 2026] [security2:error] [pid 724623:tid 139652606457536] [client 180.251.182.27:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/m ... show more [Thu Nov 12 15:55:23.890880 2026] [security2:error] [pid 724623:tid 139652606457536] [client 180.251.182.27:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "214"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: %3a found within SERVER_NAME: staklim-jatim.bmkg.go.id request_line = GET /index.php/profil/arsip-artikel?catid=617&id=2498%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-21-27-maret-2017&start=80 HTTP/1.1 Request URI RAW = /index.php/profil/arsip-artikel?catid=617&id=2498%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-21-27-maret-2017&start=80 ..."] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/arsip-artikel"] [unique_id "avV--_nyLcD ... show less

Web bot: denial-of-service flood

Detected by SentinelX honeypot: sent HTTP CONNECT request probing for an open proxy. Connection was hijacked and held in a tarpit to slow down the scan. Probed target: aincradmods.com:443

[Fri May 29 18:42:28.300855 2026] [authz_core:error] [pid 1566370:tid 139851966916288] [client 180.251.182.27:27896] AH01630: client denied by server configuration: /var/www/images/berita/2025/12/18-12-2025/Sekolah_Lapang_Iklim_Kabupaten_Jombang_Tahu ... show more [Fri May 29 18:42:28.300855 2026] [authz_core:error] [pid 1566370:tid 139851966916288] [client 180.251.182.27:27896] AH01630: client denied by server configuration: /var/www/images/berita/2025/12/18-12-2025/Sekolah_Lapang_Iklim_Kabupaten_Jombang_Tahun_2025_Peserta-600.webp, referer https://staklim-jatim.bmkg.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[1566383] [31fbVjP1eOk] [ahl7pKJvdrl3IXLZ2DBVpgAAUQw] keep_alive=[1] [2026-05-29 18:42:28.300858] [R:ahl7pKJvdrl3IXLZ2DBVpgAAUQw] UA:'Mozilla/5.0 (Linux; Android 13; SM-S901B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/112.0.0.0 Mobile Safari/537.36' Host:'staklim-jatim.bmkg.go.id:443' ACCEPT:'text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7' Referer:'https://staklim-jatim.bmkg.go.id/ Accept-Encoding:'gzip, deflate, br Accept-Language:'en-US,en;q=0.8 Upgrade-Insecure-Requests:'1 ... show less

Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER

Oct 13 20:02:38 RT-AX58U-50D8-8E617D2-C kernel: DROP IN=eth4 OUT=br0 MAC=d4:be:d9:f1:af:b2:0c:a4:02:35:6d:87:08:00 SRC=180.251.182.27 DST=192.168.100.108 LEN=52 TOS=0x00 PREC=0x00 TTL=111 ID=54784 DF PROTO=TCP SPT=6800 DPT=40509 SEQ=1613541900 ACK=0 ... show more Oct 13 20:02:38 RT-AX58U-50D8-8E617D2-C kernel: DROP IN=eth4 OUT=br0 MAC=d4:be:d9:f1:af:b2:0c:a4:02:35:6d:87:08:00 SRC=180.251.182.27 DST=192.168.100.108 LEN=52 TOS=0x00 PREC=0x00 TTL=111 ID=54784 DF PROTO=TCP SPT=6800 DPT=40509 SEQ=1613541900 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405840103030801010402) MARK=0x8000000 Oct 13 20:02:39 RT-AX58U-50D8-8E617D2-C kernel: DROP IN=eth4 OUT=br0 MAC=d4:be:d9:f1:af:b2:0c:a4:02:35:6d:87:08:00 SRC=180.251.182.27 DST=192.168.100.108 LEN=52 TOS=0x00 PREC=0x00 TTL=111 ID=54786 DF PROTO=TCP SPT=6800 DPT=40509 SEQ=1613541900 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405840103030801010402) MARK=0x8000000 Oct 13 20:02:41 RT-AX58U-50D8-8E617D2-C kernel: DROP IN=eth4 OUT=br0 MAC=d4:be:d9:f1:af:b2:0c:a4:02:35:6d:87:08:00 SRC=180.251.182.27 DST=192.168.100.108 LEN=52 TOS=0x00 PREC=0x00 TTL=111 ID=54787 DF PROTO=TCP SPT=6800 DPT=40509 SEQ=1613541900 ACK=0 WINDOW=64240 RES=0x00 SYN URGP=0 OPT (020405840103030801010402) MARK=0x8000000 ... show less

Unauthorized connection attempt from 180.251.182.27 to port 3306/TCP

F2B blocked SSH BF