🇮🇹
mgarofano80
2026-11-10 08:33:11
UTC ·
(22 hours ago)
Brute-Force
Web App Attack
🇫🇷
abuseipdb.amaze321
2026-11-07 06:36:56
UTC ·
(4 days ago)
Automated reconnaissance: repeated requests for sensitive/non-existent paths.
Web App Attack
Bad Web Bot
🇮🇩
hermawan
2026-11-06 16:51:04
UTC ·
(4 days ago)
[Fri Nov 06 23:51:04.257046 2026] [security2:error] [pid 307147:tid 139782815798976] [client 2a03:2880:f800:22:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/co ...
show more
[Fri Nov 06 23:51:04.257046 2026] [security2:error] [pid 307147:tid 139782815798976] [client 2a03:2880:f800:22:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/profil/meteorologi/list-all-categories/4166-klimatologi/infografis/infografis-klimatologi/infografis-dasarian/infografis-dasarian-tahun-2023/2456-infografis-dasarian-informasi-iklim-jatim-update-10-juni-..."] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/meteorologi/list-
...
show less
Email Spam
Hacking
🇫🇷
Entalpi.net
2026-11-05 11:04:23
UTC ·
(5 days ago)
Repeated scrapping attempts on unallowed content and/or repeated tarpit hits
Bad Web Bot
🇮🇩
hermawan
2026-11-05 05:54:23
UTC ·
(6 days ago)
[Thu Nov 05 12:54:23.135782 2026] [security2:error] [pid 73174:tid 139789860837056] [client 2a03:2880:f800:22:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/cor ...
show more
[Thu Nov 05 12:54:23.135782 2026] [security2:error] [pid 73174:tid 139789860837056] [client 2a03:2880:f800:22:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/prakiraan-iklim/prakiraan-dasarian/prakiraan-dasarian-daerah-potensi-banjir/555560658-prakiraan-dasarian-daerah-potensi-banjir-di-provinsi-jawa-timur-untuk-bulan-januari-dasarian-ii-tahun-2024-tanggal-11..."] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/prakiraan-iklim/prakiraan
...
show less
Email Spam
Hacking
🇮🇩
hermawan
2026-11-04 06:09:24
UTC ·
(1 week ago)
[Wed Nov 04 13:09:23.277351 2026] [security2:error] [pid 398882:tid 139766993499840] [client 2a03:2880:f800:22:::0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/ ...
show more
[Wed Nov 04 13:09:23.277351 2026] [security2:error] [pid 398882:tid 139766993499840] [client 2a03:2880:f800:22:::0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "224"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: type= found within SERVER_NAME: staklim-jatim.bmkg.go.id request_line = GET /index.php/profil/meteorologi/list-of-all-tags/analisis-distribusi-curah-hujan-malang-bulanan-tahun-2015?format=feed&type=atom HTTP/1.1 Request URI RAW = /index.php/profil/meteorologi/list-of-all-tags/analisis-distribusi-curah-hujan-malang-bulanan-tahun-2015?format=feed&type=atom Request Basename = analisis-distribusi-curah-h..."] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/meteorologi/list-of-all-tags/anali
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-11-04 02:04:12
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:22:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 21:04:07.712281 2026] [security2:error] [pid 12279:tid 12279] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:22:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 21:04:07.712281 2026] [security2:error] [pid 12279:tid 12279] [client 2a03:2880:f800:22:::24480] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.lumentravel.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.lumentravel.com"] [uri "/lumentravel.com"] [unique_id "auqSl5_LNTUwCPgQNhgwlgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 19:35:22
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:22:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 14:35:18.855228 2026] [security2:error] [pid 1567:tid 1567] [client 2a03:2880:f8 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:22:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 14:35:18.855228 2026] [security2:error] [pid 1567:tid 1567] [client 2a03:2880:f800:22:::49106] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.dalessalesandservice.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.dalessalesandservice.com"] [uri "/central-vacuums/[email protected] "] [unique_id "auo3dqE8R1D1Ud6sgMeX6gAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Entalpi.net
2026-11-03 17:05:11
UTC ·
(1 week ago)
Repeated scrapping attempts on unallowed content and/or repeated tarpit hits
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-03 08:49:34
UTC ·
(1 week ago)
(mod_security) mod_security (id:210381) triggered by 2a03:2880:f800:22:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:49:28.688162 2026] [security2:error] [pid 2719232:tid 2719239] [client 2a03:2 ...
show more
(mod_security) mod_security (id:210381) triggered by 2a03:2880:f800:22:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:49:28.688162 2026] [security2:error] [pid 2719232:tid 2719239] [client 2a03:2880:f800:22:::55262] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "82"] [id "210381"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||marketingfirm.org.aafm.us|F|4"] [data "REQUEST_URI=/%url%"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "marketingfirm.org.aafm.us"] [uri "/%url%"] [unique_id "aumgGEjQa_lMME_9z5550gAAAQE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-10-31 20:02:36
UTC ·
(1 week ago)
[Sun Nov 01 03:02:35.618990 2026] [security2:error] [pid 92870:tid 140141284812480] [client 2a03:2880:f800:22:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/cor ...
show more
[Sun Nov 01 03:02:35.618990 2026] [security2:error] [pid 92870:tid 140141284812480] [client 2a03:2880:f800:22:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/prakiraan-musim/4330-prakiraan-musim-hujan/prakiraan-awal-musim-hujan/prakiraan-awal-musim-hujan-propinsi-jawa-timur/prediksi-6-bulanan-prediksi-awal-musim-hujan-tahun-2025-2026-zona-musim-di-provinsi-ja..."] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/prakiraan-musim/4330-prak
...
show less
Email Spam
Hacking
🇮🇩
hermawan
2026-10-31 14:22:53
UTC ·
(1 week ago)
[Sat Oct 31 21:22:52.706212 2026] [security2:error] [pid 162565:tid 140162633823936] [client 2a03:2880:f800:22:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/co ...
show more
[Sat Oct 31 21:22:52.706212 2026] [security2:error] [pid 162565:tid 140162633823936] [client 2a03:2880:f800:22:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/prakiraan-iklim/prakiraan-bulanan/daerah-potensi-banjir-di-provinsi-jawa-timur/555561717-prakiraan-bulanan-daerah-potensi-banjir-di-provinsi-jawa-timur-untuk-bulan-april-tahun-2025-update-10-februari-202..."] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/prakiraan-iklim/prakiraa
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-10-25 05:02:12
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:22:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 01:02:08.558088 2026] [security2:error] [pid 31495:tid 31495] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:22:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 01:02:08.558088 2026] [security2:error] [pid 31495:tid 31495] [client 2a03:2880:f800:22:::48222] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||mitchellamazing.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mitchellamazing.com"] [uri "/mitchellamazing.com"] [unique_id "at2NUDsfssEosHzuqMDKeAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 00:44:46
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:22:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 20:44:39.596180 2026] [security2:error] [pid 16643:tid 16643] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:22:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 20:44:39.596180 2026] [security2:error] [pid 16643:tid 16643] [client 2a03:2880:f800:22:::32262] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bjfrancislaw.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bjfrancislaw.com"] [uri "/bjfrancislaw.com"] [unique_id "at1Q97PsltCEZrWjVBd2sgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
abuseipdb.amaze321
2026-10-24 06:36:33
UTC ·
(2 weeks ago)
Automated reconnaissance: repeated requests for sensitive/non-existent paths.
Web App Attack
Bad Web Bot
