🇮🇩
hermawan
2026-11-06 09:29:58
UTC ·
(8 hours ago)
[Fri Nov 06 16:29:57.855207 2026] [security2:error] [pid 138703:tid 139782880786112] [client 2a03:2880:f800:d:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/cor ...
show more
[Fri Nov 06 16:29:57.855207 2026] [security2:error] [pid 138703:tid 139782880786112] [client 2a03:2880:f800:d:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/prediksi-iklim/prediksi-musim-tiap-6-bulan-sekali/prediksi-musim-hujan/prediksi-awal-musim-hujan HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/prediksi-iklim/prediksi-musim-tiap-6-bulan-sekali/prediksi-musim-hujan/prediksi-awal-musim-hujan"] [unique_id "au2eFbsXI
...
show less
Email Spam
Hacking
🇵🇱
Budyn
2026-11-06 05:11:03
UTC ·
(12 hours ago)
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: pma.dont-eat-the-pudding.online | Path: /backup.sql | User-Agent: Mozilla/5.0 (X11; Linux x8 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: pma.dont-eat-the-pudding.online | Path: /backup.sql | User-Agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sha... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇫🇷
Entalpi.net
2026-11-05 11:04:10
UTC ·
(1 day ago)
Repeated scrapping attempts on unallowed content and/or repeated tarpit hits
Bad Web Bot
🇮🇩
hermawan
2026-11-04 11:15:07
UTC ·
(2 days ago)
[Wed Nov 04 18:15:07.267809 2026] [security2:error] [pid 79118:tid 139814624007872] [client 2a03:2880:f800:d:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/core ...
show more
[Wed Nov 04 18:15:07.267809 2026] [security2:error] [pid 79118:tid 139814624007872] [client 2a03:2880:f800:d:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/profil/meteorologi/list-of-all-tags/peringatan-dini-cuaca-dan-iklim-provinsi-jawa-timur-tahun-2025 HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/meteorologi/list-of-all-tags/peringatan-dini-cuaca-dan-iklim-provinsi-jawa-timur-tahun-2025"] [unique_id "ausTu4
...
show less
Email Spam
Hacking
🇫🇷
Entalpi.net
2026-11-03 17:00:20
UTC ·
(3 days ago)
Repeated scrapping attempts on unallowed content and/or repeated tarpit hits
Bad Web Bot
🇺🇸
TPI-Abuse
2026-11-03 08:47:38
UTC ·
(3 days ago)
(mod_security) mod_security (id:210381) triggered by 2a03:2880:f800:d:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:47:31.658703 2026] [security2:error] [pid 2719133:tid 2719151] [client 2a03:28 ...
show more
(mod_security) mod_security (id:210381) triggered by 2a03:2880:f800:d:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:47:31.658703 2026] [security2:error] [pid 2719133:tid 2719151] [client 2a03:2880:f800:d:::23980] ModSecurity: Access denied with code 403 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "82"] [id "210381"] [rev "6"] [msg "COMODO WAF: URL Encoding Abuse Attack Attempt||marketingfirm.org.aafm.us|F|4"] [data "REQUEST_URI=/%url%"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "marketingfirm.org.aafm.us"] [uri "/%url%"] [unique_id "aumfo9efKuXVLWjLnFnyqQAAAMY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
abuseipdb.amaze321
2026-11-02 12:36:19
UTC ·
(4 days ago)
Automated reconnaissance: repeated requests for sensitive/non-existent paths.
Web App Attack
Bad Web Bot
🇧🇷
alcacerlab
2026-11-02 06:51:25
UTC ·
(4 days ago)
2a03:2880:f800:d:: - - [02/Nov/2026:03:51:23 -0300] "GET / HTTP/2" 200 54111 "-" "facebookexternalhit/1.1 (+http://www.facebook.com/externalhit_uatext.php)"
...
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-11-01 11:22:12
UTC ·
(5 days ago)
[Sun Nov 01 18:22:12.612755 2026] [security2:error] [pid 24641:tid 140594051532480] [client 2a03:2880:f800:d:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/core ...
show more
[Sun Nov 01 18:22:12.612755 2026] [security2:error] [pid 24641:tid 140594051532480] [client 2a03:2880:f800:d:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/all-tags/1216-kalender-tanam-katam-terpadu-kecamatan-arjasa-kabupaten-sumenep-tahun-2016-2017 HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/all-tags/1216-kalender-tanam-katam-terpadu-kecamatan-arjasa-kabupaten-sumenep-tahun-2016-2017"] [unique_id "aucg5DsWPARV0c1D
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-10-26 21:44:00
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:d:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 17:43:55.674244 2026] [security2:error] [pid 12134:tid 12134] [client 2a03:2880:f ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:d:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 17:43:55.674244 2026] [security2:error] [pid 12134:tid 12134] [client 2a03:2880:f800:d:::50648] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||major33.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "major33.com"] [uri "/major33.com"] [unique_id "at_Jm8_xFQ0lsOTeahJyBQAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-10-22 03:47:39
UTC ·
(2 weeks ago)
[Thu Oct 22 10:47:39.664826 2026] [security2:error] [pid 904893:tid 140093553624768] [client 2a03:2880:f800:d:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/cor ...
show more
[Thu Oct 22 10:47:39.664826 2026] [security2:error] [pid 904893:tid 140093553624768] [client 2a03:2880:f800:d:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/meteorologi/prakiraan-cuaca-hari-ini-dan-besok-hari-beberapa-kota-di-jawa-timur/83-akar/maritim/99-informasi-angin-pelayaran-wilayah-jawa-timur HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/meteorologi/prakiraan-cuaca-hari-ini-dan-besok-hari-beberapa-kota-di-jawa-timur
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-10-20 11:55:05
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:d:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 07:55:00.625790 2026] [security2:error] [pid 10442:tid 10442] [client 2a03:2880:f ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:d:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 07:55:00.625790 2026] [security2:error] [pid 10442:tid 10442] [client 2a03:2880:f800:d:::42876] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||bjfrancislaw.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "bjfrancislaw.com"] [uri "/bjfrancislaw.com"] [unique_id "atdWlAXR1zqsWx-NMDqIJQAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-10-20 01:59:24
UTC ·
(2 weeks ago)
[Tue Oct 20 08:59:24.540622 2026] [security2:error] [pid 26677:tid 139775885440704] [client 2a03:2880:f800:d:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/core ...
show more
[Tue Oct 20 08:59:24.540622 2026] [security2:error] [pid 26677:tid 139775885440704] [client 2a03:2880:f800:d:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/prakiraan-iklim/prakiraan-musim/prakiraan-musim-hujan/prakiraan-durasi-musim-hujan HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/prakiraan-iklim/prakiraan-musim/prakiraan-musim-hujan/prakiraan-durasi-musim-hujan"] [unique_id "atbK_FXn1AvcJpFangwEHAAAANY"] [staklim
...
show less
Email Spam
Hacking
🇮🇩
hermawan
2026-10-20 00:33:20
UTC ·
(2 weeks ago)
[Tue Oct 20 07:33:19.453865 2026] [security2:error] [pid 1834898:tid 139927878624960] [client 2a03:2880:f800:d:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/co ...
show more
[Tue Oct 20 07:33:19.453865 2026] [security2:error] [pid 1834898:tid 139927878624960] [client 2a03:2880:f800:d:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /b/musiman.pdf HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/b/musiman.pdf"] [unique_id "ata2z3JQpI7qtzXAfuwqAgAAAFc"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[1834948] [B/L2xro7Axk] [ata2z3JQpI7qtzXAfuwqAgAAAFc] keep_alive=[0] [2026-10-20 07:33:19.453873] [R:ata2z3JQpI7
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-10-19 18:24:14
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:d:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 14:24:07.254164 2026] [security2:error] [pid 4830:tid 4830] [client 2a03:2880:f80 ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:d:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 14:24:07.254164 2026] [security2:error] [pid 4830:tid 4830] [client 2a03:2880:f800:d:::49250] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||mitchellart.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mitchellart.com"] [uri "/mitchellart.com"] [unique_id "atZgR3mI9KOPigSnrrt18gAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack