🇺🇸
SX Communications
2026-11-10 15:23:23
UTC ·
(18 hours ago)
HTTP application-layer DoS / botnet traffic from 38.121.203.143: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
SX Communications
2026-11-09 13:25:01
UTC ·
(1 day ago)
HTTP application-layer DoS / botnet traffic from 38.121.203.143: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇮🇩
hermawan
2026-11-08 18:54:52
UTC ·
(2 days ago)
[Mon Nov 09 01:54:52.089519 2026] [security2:error] [pid 65285:tid 140015430514368] [client 38.121.203.143:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/core ...
show more
[Mon Nov 09 01:54:52.089519 2026] [security2:error] [pid 65285:tid 140015430514368] [client 38.121.203.143:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "608"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.bmkg.go.id found within REQUEST_HEADERS:referer: https://www.bmkg.go.id/ request_line = GET /index.php/informasi-iklim/infografis-iklim/infografis-klimat-story/555561581-mengenal-fenomena-la-nina-si-pembawa-hujan HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/informasi-iklim/infografis-iklim/infografis-klimat-story/555561581-mengenal-fenomena-la-nina-si-pembawa-hujan"] [unique_id "avDFfFYY6ufzoUKB4nG_dwAAAMc"], referer https://www.bmkg.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[65346] [mqVgYUgJq/w] [avDFfFYY6ufzoUKB4nG_dwAAAMc] keep_alive=[0] [2026-
...
show less
Email Spam
Hacking
🇮🇩
hermawan
2026-10-29 14:19:38
UTC ·
(1 week ago)
[Thu Oct 29 21:17:15.528787 2026] [security2:error] [pid 76415:tid 140717624129216] [client 38.121.203.143:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/mo ...
show more
[Thu Oct 29 21:17:15.528787 2026] [security2:error] [pid 76415:tid 140717624129216] [client 38.121.203.143:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "224"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: %3a found within SERVER_NAME: staklim-jatim.bmkg.go.id request_line = GET /index.php/profil/arsip-artikel?catid=477&id=600%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-7-juli-13-juli-2015&start=110 HTTP/1.1 Request URI RAW = /index.php/profil/arsip-artikel?catid=477&id=600%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-7-juli-13-juli-2015&star..."] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/arsip-artikel"] [unique_id "auNVawb451r-
...
show less
Email Spam
Hacking
🇺🇸
SX Communications
2026-10-17 23:57:00
UTC ·
(3 weeks ago)
HTTP application-layer DoS / botnet traffic from 38.121.203.143: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇮🇩
hermawan
2026-09-25 04:08:51
UTC ·
(1 month ago)
[Fri Sep 25 11:06:46.728759 2026] [security2:error] [pid 125645:tid 139671229052608] [client 38.121.203.143:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/m ...
show more
[Fri Sep 25 11:06:46.728759 2026] [security2:error] [pid 125645:tid 139671229052608] [client 38.121.203.143:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "208"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: %3a found within SERVER_NAME: staklim-jatim.bmkg.go.id request_line = GET /index.php/profil/arsip-artikel?catid=639&id=2444%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-28-februari-6-maret-2017&start=50 HTTP/1.1 Request URI RAW = /index.php/profil/arsip-artikel?catid=639&id=2444%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-28-februari-6-mare..."] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/arsip-artikel"] [unique_id "arXzVt3UxF3
...
show less
Email Spam
Hacking
🇮🇩
hermawan
2026-09-24 02:16:29
UTC ·
(1 month ago)
Captured JA4H: ge11n_4afaac0d80e2 | Log: 38.121.203.143 - - [24/Sep/2026:09:15:16 +0700] "GET /index.php/profil/arsip-artikel?catid=621&id=555555659%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-26-april-02-mei-2017&start ...
show more
Captured JA4H: ge11n_4afaac0d80e2 | Log: 38.121.203.143 - - [24/Sep/2026:09:15:16 +0700] "GET /index.php/profil/arsip-artikel?catid=621&id=555555659%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-26-april-02-mei-2017&start=190 HTTP/1.1" 403 3738 "https://www.bmkg.go.id/" "Mozilla/5.0 (iPhone; CPU iPhone OS 18_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/140.0.7339.122 Mobile/15E148 Safari/604.1" ge11n_host,x-forwarded-scheme,x-forwarded-proto,x-forwarded-for,x-real-ip,connection,sec-fetch-user,cf-ew-via,cdn-loop,sec-fetch-site,sec-fetch-mode,cf-ray,accept-encoding,accept-language,accept,referer,user-agent,cf-connecting-ip,sec-fetch-dest,cf-visitor,cf-ipcountry...
...
show less
Email Spam
Hacking
🇺🇸
SX Communications
2026-09-20 22:03:14
UTC ·
(1 month ago)
HTTP application-layer DoS / botnet traffic from 38.121.203.143: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇮🇩
hermawan
2026-09-20 01:16:22
UTC ·
(1 month ago)
[Sun Sep 20 08:16:22.012589 2026] [security2:error] [pid 231875:tid 140496760465088] [client 38.121.203.143:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/cor ...
show more
[Sun Sep 20 08:16:22.012589 2026] [security2:error] [pid 231875:tid 140496760465088] [client 38.121.203.143:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/coreruleset-4.26.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "601"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.bmkg.go.id found within REQUEST_HEADERS:referer: https://www.bmkg.go.id/ request_line = GET /index.php/prakiraan-bulanan/3977-prakiraan-bulanan-tingkat-ketersediaan-air-bagi-tanaman/prakiraan-bulanan-tingkat-ketersediaan-air-bagi-tanaman-di-provinsi-jawa-timur/prakiraan-bulanan-tingkat-ketersediaan-air-bagi-tanaman-di-provinsi-jawa-timur-tahun-2019 HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/prakiraan-bulanan/3977-prakiraan-bulanan-tingkat-ketersediaan-air-bagi-tanaman/prakiraan-bulanan-tingkat-ketersediaan-air-bagi-tanaman-di-provinsi-jawa-timur/prakiraan-bulanan-tin
...
show less
Email Spam
Hacking
Anonymous
2026-09-10 04:24:05
UTC ·
(2 months ago)
Web attack
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-07-22 19:03:51
UTC ·
(3 months ago)
HTTP application-layer DoS / botnet traffic from 38.121.203.143: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
Anonymous
2025-10-19 19:05:37
UTC ·
(1 year ago)
"Brute force botnet"
Brute-Force
Anonymous
2025-10-19 19:05:37
UTC ·
(1 year ago)
"Brute force botnet"
Brute-Force