🇵🇱
Budyn
2026-11-11 02:37:10
UTC ·
(1 day ago)
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: sql.astropot.website | Path: /.env | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: CRITICAL: ModSecurity WAF Exploit Block | Summary: Request triggered an emulated security trap. | Evidence: | Host: sql.astropot.website | Path: /.env | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.faceb... | Request: [Empty / GET Request]
show less
Hacking
Web App Attack
🇺🇸
ipblock.com
2026-11-10 22:29:00
UTC ·
(1 day ago)
IPBlock protected site ID [2815-wdn][s=02].
Persistent 404, vulnerability scanner
Hacking
Bad Web Bot
Web App Attack
🇫🇷
abuseipdb.amaze321
2026-11-08 06:36:38
UTC ·
(3 days ago)
Automated reconnaissance: repeated requests for sensitive/non-existent paths.
Web App Attack
Bad Web Bot
🇮🇩
hermawan
2026-11-06 14:17:14
UTC ·
(5 days ago)
[Fri Nov 06 21:17:13.287340 2026] [security2:error] [pid 244492:tid 139781254149824] [client 2a03:2880:f800:24:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/co ...
show more
[Fri Nov 06 21:17:13.287340 2026] [security2:error] [pid 244492:tid 139781254149824] [client 2a03:2880:f800:24:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /images/Klimatologi/Buletin/Musim/Musim_Kemarau/2026/Buletin_Prediksi_Musim_Kemarau_Tahun_2026_di_Provinsi_Jawa_Timur.pdf HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/images/Klimatologi/Buletin/Musim/Musim_Kemarau/2026/Buletin_Prediksi_Musim_Kemarau_Tahun_2026_di_Provinsi_Jawa_Timur.pdf"
...
show less
Email Spam
Hacking
🇮🇹
mgarofano80
2026-11-06 07:07:10
UTC ·
(5 days ago)
Brute-Force
Web App Attack
🇫🇷
Entalpi.net
2026-11-05 11:08:53
UTC ·
(6 days ago)
Repeated scrapping attempts on unallowed content and/or repeated tarpit hits
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-05 02:53:38
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:24:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 21:53:31.186403 2026] [security2:error] [pid 28687:tid 28687] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:24:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 21:53:31.186403 2026] [security2:error] [pid 28687:tid 28687] [client 2a03:2880:f800:24:::62656] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||darkalleyproductions.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "darkalleyproductions.com"] [uri "/darkalleyproductions.com"] [unique_id "auvvqz79y7NH3T8bhgOq4gAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 02:00:12
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:24:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 21:00:08.212125 2026] [security2:error] [pid 14900:tid 14900] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:24:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 21:00:08.212125 2026] [security2:error] [pid 14900:tid 14900] [client 2a03:2880:f800:24:::38946] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||leirstein.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "leirstein.com"] [uri "/leirstein.com"] [unique_id "auvjKGC0j4q9Y7fi9aeBbQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-11-04 10:52:34
UTC ·
(1 week ago)
[Wed Nov 04 17:52:33.087725 2026] [security2:error] [pid 70913:tid 139814674364096] [client 2a03:2880:f800:24:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/cor ...
show more
[Wed Nov 04 17:52:33.087725 2026] [security2:error] [pid 70913:tid 139814674364096] [client 2a03:2880:f800:24:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/profil/meteorologi/list-all-categories/3965-klimatologi/infografis/infografis-klimatologi/555563373-mengenal-faktor-pengendali-iklim-di-indonesia HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/meteorologi/list-all-categories/3965-klimatologi/infografis/info
...
show less
Email Spam
Hacking
🇫🇷
Entalpi.net
2026-11-03 17:01:39
UTC ·
(1 week ago)
Repeated scrapping attempts on unallowed content and/or repeated tarpit hits
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-01 08:12:30
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:24:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 03:12:26.239554 2026] [security2:error] [pid 6077:tid 6077] [client 2a03:2880:f8 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:24:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 03:12:26.239554 2026] [security2:error] [pid 6077:tid 6077] [client 2a03:2880:f800:24:::25674] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||kiinlog.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "kiinlog.com"] [uri "/kiinlog.com"] [unique_id "aub0arAvSVbmDZmAMeiogAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-10-31 19:00:26
UTC ·
(1 week ago)
[Sun Nov 01 02:00:26.025956 2026] [security2:error] [pid 48580:tid 140141383272128] [client 2a03:2880:f800:24:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/cor ...
show more
[Sun Nov 01 02:00:26.025956 2026] [security2:error] [pid 48580:tid 140141383272128] [client 2a03:2880:f800:24:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/analisis-iklim/analisis-musim/perbandingan/perbandingan-prediksi-puncak-musim-hujan-dengan-normalnya HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/analisis-iklim/analisis-musim/perbandingan/perbandingan-prediksi-puncak-musim-hujan-dengan-normalnya"] [unique_id "auY6yuO
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-10-31 13:37:51
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:24:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 09:37:46.216137 2026] [security2:error] [pid 27956:tid 27956] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:24:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 09:37:46.216137 2026] [security2:error] [pid 27956:tid 27956] [client 2a03:2880:f800:24:::65390] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||swindon-itf.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "swindon-itf.com"] [uri "/swindon-itf.com"] [unique_id "auXvKokUFaofOZgI_UUjzwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-10-31 13:23:23
UTC ·
(1 week ago)
[Sat Oct 31 20:23:23.123830 2026] [security2:error] [pid 122371:tid 140161753016000] [client 2a03:2880:f800:24:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/co ...
show more
[Sat Oct 31 20:23:23.123830 2026] [security2:error] [pid 122371:tid 140161753016000] [client 2a03:2880:f800:24:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/profil/meteorologi/list-all-categories/4247-klimatologi/infografis/infografis-klimatologi/infografis-bulanan/infografis-bulanan-iklim-ekstrim/infografis-bulanan-iklim-ekstrim-tahun-2024/555561597-infogra..."] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/meteorologi/list-
...
show less
Email Spam
Hacking
🇺🇸
ph
2026-10-27 19:14:12
UTC ·
(2 weeks ago)
Bad web bot attempting to run SiteMap.aspx on non-WP site
Hacking
Bad Web Bot
Web App Attack