|
๐จ๐ฆ
polycoda
|
|
๐ฅถ Part of massive botnet scraping campaign that nearly turned into a DDoS on 2025-11-27
|
DDoS Attack
|
|
|
Anonymous
|
|
botnet
|
DDoS Attack
|
|
|
๐ฉ๐ช
SMARTNET
|
|
Aisuru(Mirai variant) DDoS
|
DDoS Attack
|
|
|
Anonymous
|
|
scanning http requests from known botnet
|
Web App Attack
|
|
|
๐ฉ๐ช
london2038.com
|
|
Connection atttempts against closed TCP ports
Nov 20 16:45:58 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x0 ...
show more
Connection atttempts against closed TCP ports
Nov 20 16:45:58 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=50 ID=58895 DF PROTO=TCP SPT=28743 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Nov 20 16:45:59 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=50 ID=58896 DF PROTO=TCP SPT=28743 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Nov 20 16:46:00 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=50 ID=58897 DF PROTO=TCP SPT=28743 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
show less
|
Port Scan
|
|
|
Anonymous
|
|
scanning http requests from known botnet
|
Web App Attack
|
|
|
Anonymous
|
|
scanning http requests from known botnet
|
Web App Attack
|
|
|
๐ฎ๐ฉ
hermawan
|
|
[Thu Nov 13 19:54:44.165637 2025] [security2:error] [pid 1493853:tid 140633143379648] [client 217.14 ...
show more
[Thu Nov 13 19:54:44.165637 2025] [security2:error] [pid 1493853:tid 140633143379648] [client 217.142.21.14:49771] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "WOW64" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity/coreruleset-4.20.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "247"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: WOW64 found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3770.100 ADG/11.0.2510 AOLBUILD/11.0.2510 Safari/537.36 request_line = GET /index.php/profil/meteorologi/list-all-categories/3941-klimatologi/prakiraan-klimatologi/prakiraan-dasarian/prakiraan-curah-hujan-dasarian/prakiraan-probabilistik-curah-hujan-dasarian/prakiraan-probabilistik-curah-hujan-dasarian-provinsi-jawa-timur/prakiraan-probabilistik-curah-hujan-d..."] [severity "NOTICE"] [hostname "staklim-malang.info"] [uri "/index.php/profil/meteorologi/list-all-cate
...
show less
|
Hacking
Web App Attack
|
|
|
๐ฉ๐ช
london2038.com
|
|
Connection atttempts against closed TCP ports
Nov 6 21:38:17 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x0 ...
show more
Connection atttempts against closed TCP ports
Nov 6 21:38:17 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=47406 DF PROTO=TCP SPT=32581 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Nov 6 21:38:17 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=47407 DF PROTO=TCP SPT=32581 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Nov 6 21:38:18 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=47408 DF PROTO=TCP SPT=32581 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
show less
|
Port Scan
|
|
|
๐ฉ๐ช
london2038.com
|
|
Connection atttempts against closed TCP ports
Nov 5 08:34:00 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x0 ...
show more
Connection atttempts against closed TCP ports
Nov 5 08:34:00 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=11440 DF PROTO=TCP SPT=59648 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Nov 5 09:40:43 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=50 ID=11546 DF PROTO=TCP SPT=8410 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Nov 5 09:40:44 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=50 ID=11547 DF PROTO=TCP SPT=8410 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
show less
|
Port Scan
|
|
|
๐ฉ๐ช
london2038.com
|
|
Connection atttempts against closed TCP ports
Nov 2 20:10:07 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x0 ...
show more
Connection atttempts against closed TCP ports
Nov 2 20:10:07 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=49 ID=42723 DF PROTO=TCP SPT=22981 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Nov 2 20:10:10 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=49 ID=42727 DF PROTO=TCP SPT=22981 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Nov 2 23:57:44 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=49 ID=32724 DF PROTO=TCP SPT=57319 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
show less
|
Port Scan
|
|
|
๐ฉ๐ช
london2038.com
|
|
Connection atttempts against closed TCP ports
Oct 31 10:37:50 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x0 ...
show more
Connection atttempts against closed TCP ports
Oct 31 10:37:50 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=48 ID=52019 DF PROTO=TCP SPT=14881 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Oct 31 11:44:26 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=49 ID=22541 DF PROTO=TCP SPT=56473 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Oct 31 11:44:26 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=49 ID=22542 DF PROTO=TCP SPT=56473 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
show less
|
Port Scan
|
|
|
๐ฉ๐ช
london2038.com
|
|
Connection atttempts against closed TCP ports
Oct 28 04:13:22 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x0 ...
show more
Connection atttempts against closed TCP ports
Oct 28 04:13:22 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=50 ID=41044 DF PROTO=TCP SPT=40361 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Oct 28 04:13:23 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=50 ID=41045 DF PROTO=TCP SPT=40361 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Oct 28 04:13:24 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=50 ID=41046 DF PROTO=TCP SPT=40361 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
show less
|
Port Scan
|
|
|
๐ฉ๐ช
london2038.com
|
|
Connection atttempts against closed TCP ports
Oct 17 00:27:55 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x0 ...
show more
Connection atttempts against closed TCP ports
Oct 17 00:27:55 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=1066 DF PROTO=TCP SPT=24234 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Oct 17 00:27:55 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=1067 DF PROTO=TCP SPT=24234 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Oct 17 00:27:56 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=52 ID=1068 DF PROTO=TCP SPT=24234 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
show less
|
Port Scan
|
|
|
๐ฉ๐ช
london2038.com
|
|
Connection atttempts against closed TCP ports
Oct 12 08:57:14 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x0 ...
show more
Connection atttempts against closed TCP ports
Oct 12 08:57:14 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=51 ID=24749 DF PROTO=TCP SPT=41714 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Oct 12 08:57:15 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=51 ID=24750 DF PROTO=TCP SPT=41714 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
Oct 12 08:57:19 BLOCK SRC=217.142.21.14 LEN=52 TOS=0x00 PREC=0x00 TTL=51 ID=24752 DF PROTO=TCP SPT=41714 DPT=443 WINDOW=32044 RES=0x00 ACK FIN
show less
|
Port Scan
|
|