🇮🇩
hermawan
2026-11-06 13:57:52
UTC ·
(4 hours ago)
[Fri Nov 06 20:57:52.259660 2026] [security2:error] [pid 244520:tid 139782395000512] [client 2a03:2880:f800:34:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/co ...
show more
[Fri Nov 06 20:57:52.259660 2026] [security2:error] [pid 244520:tid 139782395000512] [client 2a03:2880:f800:34:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/prediksi-iklim/prediksi-bulanan/sifat-hujan/3-bulan-ke-depan/555563194-prediksi-bulanan-sifat-hujan-bulan-agustus-tahun-2026-update-dari-analisis-bulan-mei-tahun-2026-di-provinsi-jawa-timur HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/prediksi-iklim/prediksi-bu
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-11-06 10:41:02
UTC ·
(7 hours ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:34:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:40:55.087140 2026] [security2:error] [pid 25360:tid 25404] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:34:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:40:55.087140 2026] [security2:error] [pid 25360:tid 25404] [client 2a03:2880:f800:34:::25010] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||giorgiogranozio.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "giorgiogranozio.com"] [uri "/giorgiogranozio.com"] [unique_id "au2utwIJ9TWq9Flm0rJ1IwAAAM8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 11:56:07
UTC ·
(1 day ago)
(mod_security) mod_security (id:225170) triggered by 2a03:2880:f800:34:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 06:56:03.666173 2026] [security2:error] [pid 27662:tid 27662] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:225170) triggered by 2a03:2880:f800:34:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 06:56:03.666173 2026] [security2:error] [pid 27662:tid 27662] [client 2a03:2880:f800:34:::50260] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.livingminimal.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.livingminimal.com"] [uri "/wp-json/wp/v2/users/2"] [unique_id "auxu0_U_S_XKSfTcpTfHgwAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Entalpi.net
2026-11-05 10:58:50
UTC ·
(1 day ago)
Repeated scrapping attempts on unallowed content and/or repeated tarpit hits
Bad Web Bot
🇮🇩
hermawan
2026-11-04 02:57:24
UTC ·
(2 days ago)
[Wed Nov 04 09:57:24.509909 2026] [security2:error] [pid 318291:tid 139767548315328] [client 2a03:2880:f800:34:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/co ...
show more
[Wed Nov 04 09:57:24.509909 2026] [security2:error] [pid 318291:tid 139767548315328] [client 2a03:2880:f800:34:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/prediksi-iklim/prediksi-bulanan/sifat-hujan/3-bulan-ke-depan/555563285-prediksi-bulanan-sifat-hujan-bulan-oktober-tahun-2026-update-dari-analisis-bulan-juni-tahun-2026-di-provinsi-jawa-timur HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/prediksi-iklim/prediksi-b
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-11-03 20:35:26
UTC ·
(2 days ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:34:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 15:35:23.149497 2026] [security2:error] [pid 18395:tid 18395] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:34:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 15:35:23.149497 2026] [security2:error] [pid 18395:tid 18395] [client 2a03:2880:f800:34:::26686] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.civilwarscout.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.civilwarscout.com"] [uri "/images/desktop.ini"] [unique_id "aupFi80fiyOvFKTbJKBX9gAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Entalpi.net
2026-11-03 16:58:11
UTC ·
(3 days ago)
Repeated scrapping attempts on unallowed content and/or repeated tarpit hits
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-03 03:16:37
UTC ·
(3 days ago)
(mod_security) mod_security (id:225170) triggered by 2a03:2880:f800:34:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 22:16:31.401273 2026] [security2:error] [pid 23366:tid 23366] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:225170) triggered by 2a03:2880:f800:34:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 22:16:31.401273 2026] [security2:error] [pid 23366:tid 23366] [client 2a03:2880:f800:34:::23580] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.susanleeward.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.susanleeward.com"] [uri "/wp-json/wp/v2/users/1"] [unique_id "aulSD_BUbVoIBVneiZufXwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-11-01 11:02:11
UTC ·
(5 days ago)
[Sun Nov 01 18:02:11.496509 2026] [security2:error] [pid 8664:tid 140593103615680] [client 2a03:2880:f800:34:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/core ...
show more
[Sun Nov 01 18:02:11.496509 2026] [security2:error] [pid 8664:tid 140593103615680] [client 2a03:2880:f800:34:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/prediksi-iklim/prediksi-musim-tiap-6-bulan-sekali/prediksi-musim-kemarau/prediksi-curah-hujan-musim-kemarau HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/prediksi-iklim/prediksi-musim-tiap-6-bulan-sekali/prediksi-musim-kemarau/prediksi-curah-hujan-musim-kemarau"] [uniqu
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-10-31 15:46:16
UTC ·
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:34:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 11:46:10.163625 2026] [security2:error] [pid 10228:tid 10228] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:34:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 11:46:10.163625 2026] [security2:error] [pid 10228:tid 10228] [client 2a03:2880:f800:34:::45584] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||amazingwelding.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "amazingwelding.com"] [uri "/amazingwelding.com"] [unique_id "auYNQv5uE2R8XVdfz_eNjwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-10-31 12:55:18
UTC ·
(6 days ago)
[Sat Oct 31 19:55:18.542935 2026] [security2:error] [pid 104192:tid 140162398926528] [client 2a03:2880:f800:34:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/co ...
show more
[Sat Oct 31 19:55:18.542935 2026] [security2:error] [pid 104192:tid 140162398926528] [client 2a03:2880:f800:34:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /b/bulananponorogo.pdf HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/b/bulananponorogo.pdf"] [unique_id "auXlNjK9OJzYpeq4S4pLVgAAAA0"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[104232] [kHbDbCJ6sUk] [auXlNjK9OJzYpeq4S4pLVgAAAA0] keep_alive=[0] [2026-10-31 19:55:18.542943]
...
show less
Email Spam
Hacking
🇩🇪
nyuuzyou
2026-10-30 10:27:23
UTC ·
(1 week ago)
Client failed challenge verification, marked as suspicious. HTTP request received over TCP on application ports 80/443. Observed 2026-10-30T10:27:23Z.
Bad Web Bot
🇫🇷
abuseipdb.amaze321
2026-10-26 03:36:32
UTC ·
(1 week ago)
Automated reconnaissance: repeated requests for sensitive/non-existent paths.
Web App Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-26 01:00:40
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:34:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 21:00:32.905880 2026] [security2:error] [pid 17715:tid 17715] [client 2a03:2880: ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:34:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 21:00:32.905880 2026] [security2:error] [pid 17715:tid 17715] [client 2a03:2880:f800:34:::45692] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||major33.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "major33.com"] [uri "/major33.com"] [unique_id "at6mMDVC-EzOb9__-6dLBwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 04:20:29
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:34:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 00:20:24.289063 2026] [security2:error] [pid 1583:tid 1583] [client 2a03:2880:f8 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:34:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 00:20:24.289063 2026] [security2:error] [pid 1583:tid 1583] [client 2a03:2880:f800:34:::36516] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.sargous.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.sargous.com"] [uri "/sargous.com"] [unique_id "at2DiC_SeLTuoyUEiX1e8gAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
