🇫🇷
abuseipdb.amaze321
2026-11-07 21:31:13
UTC ·
(1 day ago)
Automated reconnaissance: repeated requests for sensitive/non-existent paths.
Web App Attack
Bad Web Bot
🇮🇩
hermawan
2026-11-06 10:26:47
UTC ·
(3 days ago)
[Fri Nov 06 17:26:46.943179 2026] [security2:error] [pid 170595:tid 139782873609920] [client 2a03:2880:f800:f:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/cor ...
show more
[Fri Nov 06 17:26:46.943179 2026] [security2:error] [pid 170595:tid 139782873609920] [client 2a03:2880:f800:f:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/informasi-iklim/infografis-iklim/infografis-bulanan/infografis-bulanan-iklim-ekstrim/555562868-infografis-bulanan-iklim-kecepatan-angin-maksimum-bulan-maret-tahun-2026-di-provinsi-jawa-timur HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/informasi-iklim/infografis
...
show less
Email Spam
Hacking
🇵🇱
Budyn
2026-11-06 06:21:45
UTC ·
(3 days ago)
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: jira.dont-eat-the-pudding.online | Path: /backup.sql | User-Agent: Mozilla/5.0 (Windows NT 1 ...
show more
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: jira.dont-eat-the-pudding.online | Path: /backup.sql | User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.co... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇫🇷
Entalpi.net
2026-11-05 11:00:41
UTC ·
(4 days ago)
Repeated scrapping attempts on unallowed content and/or repeated tarpit hits
Bad Web Bot
🇮🇩
hermawan
2026-11-04 10:53:11
UTC ·
(5 days ago)
[Wed Nov 04 17:53:10.587909 2026] [security2:error] [pid 70942:tid 139815882323648] [client 2a03:2880:f800:f:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/core ...
show more
[Wed Nov 04 17:53:10.587909 2026] [security2:error] [pid 70942:tid 139815882323648] [client 2a03:2880:f800:f:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/analisis-bulanan/4299-analisis-distribusi-hujan/analisis-distribusi-curah-hujan/analisis-distribusi-curah-hujan-jawa-timur-bulanan/analisis-bulanan-distribusi-curah-hujan-di-provinsi-jawa-timur-tahun-202..."] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/analisis-bulanan/4299-anal
...
show less
Email Spam
Hacking
🇮🇹
mgarofano80
2026-11-04 01:56:26
UTC ·
(5 days ago)
Brute-Force
Web App Attack
🇫🇷
Entalpi.net
2026-11-03 17:04:46
UTC ·
(5 days ago)
Repeated scrapping attempts on unallowed content and/or repeated tarpit hits
Bad Web Bot
🇵🇱
Budyn
2026-11-03 09:10:04
UTC ·
(6 days ago)
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: grafana.sweetpuddingtrap.top | Path: /.env | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac O ...
show more
[Budyn Honeypot Sinkhole] | Attack type: Enterprise & Framework Recon Scanner | Summary: Web scanner triggered an emulated security trap. | Evidence: | Host: grafana.sweetpuddingtrap.top | Path: /.env | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.faceb... | Request: [Empty / GET Request]
show less
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-11-01 12:06:11
UTC ·
(1 week ago)
[Sun Nov 01 19:06:10.558125 2026] [security2:error] [pid 52819:tid 140594172610240] [client 2a03:2880:f800:f:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/core ...
show more
[Sun Nov 01 19:06:10.558125 2026] [security2:error] [pid 52819:tid 140594172610240] [client 2a03:2880:f800:f:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/profil/meteorologi/list-of-all-tags/analisis-dasarian-monitoring-hari-tanpa-hujan-berturut-turut-provinsi-jawa-timur-tahun-2021 HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/meteorologi/list-of-all-tags/analisis-dasarian-monitoring-hari-tanpa-hujan-berturut-turut
...
show less
Email Spam
Hacking
🇺🇸
TPI-Abuse
2026-11-01 10:33:58
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:f:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 05:33:51.619227 2026] [security2:error] [pid 12752:tid 12752] [client 2a03:2880:f ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:f:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 05:33:51.619227 2026] [security2:error] [pid 12752:tid 12752] [client 2a03:2880:f800:f:::24238] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.cpking.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.cpking.com"] [uri "/cpking.com"] [unique_id "aucVj42rfPX5CljxDF6rsgAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 09:53:29
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:f:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 04:53:22.084813 2026] [security2:error] [pid 17886:tid 17941] [client 2a03:2880:f ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:f:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 04:53:22.084813 2026] [security2:error] [pid 17886:tid 17941] [client 2a03:2880:f800:f:::34998] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||mouserart.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mouserart.com"] [uri "/mouserart.com"] [unique_id "aucMEhAEN8bd4RKaXW6tGQAAAQw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-10-31 19:11:43
UTC ·
(1 week ago)
[Sun Nov 01 02:11:43.356829 2026] [security2:error] [pid 56623:tid 140140177499840] [client 2a03:2880:f800:f:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/core ...
show more
[Sun Nov 01 02:11:43.356829 2026] [security2:error] [pid 56623:tid 140140177499840] [client 2a03:2880:f800:f:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /index.php/informasi-iklim/buletin-1/buletin-bulanan-analisis-dan-prediksi HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/informasi-iklim/buletin-1/buletin-bulanan-analisis-dan-prediksi"] [unique_id "auY9b2KBzmaKsDLz7EbJqAAAAFY"] [staklim-jatim.bmkg.go.id] [staklim-ja
...
show less
Email Spam
Hacking
🇺🇸
ph
2026-10-31 05:10:54
UTC ·
(1 week ago)
Bad web bot attempting to run SiteMap.aspx on non-WP site
Hacking
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 23:18:24
UTC ·
(1 week ago)
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:f:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 19:18:17.190087 2026] [security2:error] [pid 25288:tid 25288] [client 2a03:2880:f ...
show more
(mod_security) mod_security (id:210730) triggered by 2a03:2880:f800:f:: (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 19:18:17.190087 2026] [security2:error] [pid 25288:tid 25288] [client 2a03:2880:f800:f:::37980] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.sargous.com|F|2"] [data ".com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.sargous.com"] [uri "/sargous.com"] [unique_id "auExOfBu8S-8DV3x2ZGifAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-10-27 02:54:39
UTC ·
(1 week ago)
[Tue Oct 27 09:54:39.194515 2026] [security2:error] [pid 62303:tid 139872857749184] [client 2a03:2880:f800:f:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/core ...
show more
[Tue Oct 27 09:54:39.194515 2026] [security2:error] [pid 62303:tid 139872857749184] [client 2a03:2880:f800:f:::0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "Indexer" at REQUEST_HEADERS:user-agent. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "290"] [id "440000"] [msg "BAD BOT - Detected and Blocked"] [data "Matched Data: Indexer found within REQUEST_HEADERS:user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 (compatible; meta-webindexer/1.1 (+https://developers.facebook.com/docs/sharing/webmasters/crawler)) request_line = GET /images/Klimatologi/Konferensi_Pers/2025/Pers_Rilis_Prediksi_Musim_Hujan_Tahun_2025-2026_Provinsi_Jawa_Timur.pdf HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/images/Klimatologi/Konferensi_Pers/2025/Pers_Rilis_Prediksi_Musim_Hujan_Tahun_2025-2026_Provinsi_Jawa_Timur.pdf"] [unique_id "auASb9
...
show less
Email Spam
Hacking