🇬🇧
SilverZippo
2023-08-04 09:51:15
(3 years ago)
Web App Attack
Web App Attack
🇬🇧
hcsystems
2023-08-04 05:49:04
(3 years ago)
Unauthorized API request blocked
Hacking
🇦🇺
ozisp.com.au
2023-08-03 17:40:28
(3 years ago)
US_RIPE_<33>1691084426 [120:7:2] (http_inspect) SERVER CONSECUTIVE SMALL CHUNK SIZES [Classification ...
show more
US_RIPE_<33>1691084426 [120:7:2] (http_inspect) SERVER CONSECUTIVE SMALL CHUNK SIZES [Classification: Unknown Traffic] [Priority: 3] {TCP} 203.176.121.146:80
show less
Hacking
🇺🇸
mnsf
2023-08-03 16:03:27
(3 years ago)
Scanning/Probing (11)
Brute-Force
Web App Attack
🇦🇺
weblite
2023-08-03 15:24:53
(3 years ago)
WP_SCANNING
Web App Attack
🇬🇧
findlab
2023-08-03 14:07:26
(3 years ago)
Backdrop CMS module - Request: /prevlaravel/sftp-config.json
Bad Web Bot
Web App Attack
🇩🇪
iNetWorker
2023-08-03 12:31:40
(3 years ago)
trolling for resource vulnerabilities
Web App Attack
2023-08-03 09:38:29
(3 years ago)
Malicious activity detected
Hacking
Brute-Force
🇦🇺
MAGIC
2023-08-03 09:16:10
(3 years ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
2023-08-03 08:48:45
(3 years ago)
Web Spam
Email Spam
Blog Spam
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2023-07-28 15:13:15
(3 years ago)
[Fri Jul 28 22:13:12.772264 2023] [security2:error] [pid 37929:tid 140244144600640] [client 65.21.22 ...
show more
[Fri Jul 28 22:13:12.772264 2023] [security2:error] [pid 37929:tid 140244144600640] [client 65.21.227.62:62624] [client 65.21.227.62] ModSecurity: Access denied with code 403 (phase 2). Match of "pm AppleWebKit Android" against "REQUEST_HEADERS:User-Agent" required. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1628"] [id "920300"] [msg "Request Missing an Accept Header"] [data "Matched Data: host found within REQUEST_HEADERS:User-Agent: Go-http-client/2.0 request_line = GET / HTTP/2.0"] [severity "NOTICE"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/"] [unique_id "ZMPbCFHnRdHkpcCDIAG6XAABuw0"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[37943] [xyfvhE32IqY] [ZMPbCFHnRdHkpcCDIAG6XAABuw0] keep_alive=[1] [2023-07-28 22
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-07-28 13:55:09
(3 years ago)
[Fri Jul 28 20:55:06.094385 2023] [security2:error] [pid 272747:tid 139771456935488] [client 65.21.2 ...
show more
[Fri Jul 28 20:55:06.094385 2023] [security2:error] [pid 272747:tid 139771456935488] [client 65.21.227.62:49696] [client 65.21.227.62] ModSecurity: Access denied with code 403 (phase 2). Match of "pm AppleWebKit Android" against "REQUEST_HEADERS:User-Agent" required. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1628"] [id "920300"] [msg "Request Missing an Accept Header"] [data "Matched Data: host found within REQUEST_HEADERS:User-Agent: Go-http-client/2.0 request_line = GET / HTTP/2.0"] [severity "NOTICE"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/"] [unique_id "ZMPIuhZLg06ZhpG9lSEGNwABeCI"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[272782] [4tmVbSS9r6Y] [ZMPIuhZLg06ZhpG9lSEGNwABeCI] keep_alive=[1]
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-07-28 09:08:11
(3 years ago)
[Fri Jul 28 16:08:07.399429 2023] [security2:error] [pid 291894:tid 140101360928320] [client 65.21.2 ...
show more
[Fri Jul 28 16:08:07.399429 2023] [security2:error] [pid 291894:tid 140101360928320] [client 65.21.227.62:62103] [client 65.21.227.62] ModSecurity: Access denied with code 403 (phase 2). Match of "pm AppleWebKit Android" against "REQUEST_HEADERS:User-Agent" required. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1628"] [id "920300"] [msg "Request Missing an Accept Header"] [data "Matched Data: host found within REQUEST_HEADERS:User-Agent: Go-http-client/2.0 request_line = GET /sftp.json HTTP/2.0"] [severity "NOTICE"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [tag "paranoia-level/2"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/sftp.json"] [unique_id "ZMOFd-HwA3M6fguSkv6-MQAAaGM"] [karangploso.jatim.bmkg.go.id] [karangploso.jatim.bmkg.go.id] top=[291994] [XY5Ea+C58pc] [ZMOFd-HwA3M6fguSkv6-MQAAaG
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-07-27 20:40:49
(3 years ago)
[Fri Jul 28 03:40:47.198058 2023] [security2:error] [pid 31401:tid 140652184593984] [client 65.21.22 ...
show more
[Fri Jul 28 03:40:47.198058 2023] [security2:error] [pid 31401:tid 140652184593984] [client 65.21.227.62:59409] [client 65.21.227.62] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "wp-config.php" at REQUEST_FILENAME. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "137"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: wp-config.php found within REQUEST_FILENAME: /wp-config.php.7"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/wp-config.php.7"] [unique_id "ZMLWT_IOBIpN-fHk_AU86QAAALs"], referer http://staklim-jatim.bmkg.go.id/wp-config.php.7 [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[31590] [IraW+pXyv1w] [ZMLWT_IOBIpN-fHk_AU86QAAALs] keep_alive=[0] [2023
...
show less
Hacking
Web App Attack
🇮🇩
hermawan
2023-07-27 19:23:57
(3 years ago)
[Fri Jul 28 02:23:49.697524 2023] [security2:error] [pid 283871:tid 139993141978688] [client 65.21.2 ...
show more
[Fri Jul 28 02:23:49.697524 2023] [security2:error] [pid 283871:tid 139993141978688] [client 65.21.227.62:62409] [client 65.21.227.62] ModSecurity: Access denied with code 403 (phase 2). String match within ".asa/ .asax/ .ascx/ .axd/ .backup/ .bak/ .bat/ .cdx/ .cer/ .cfg/ .cmd/ .com/ .config/ .conf/ .cs/ .csproj/ .csr/ .dat/ .db/ .dbf/ .dll/ .dos/ .htr/ .htw/ .ida/ .idc/ .idq/ .inc/ .ini/ .key/ .licx/ .lnk/ .log/ .mdb/ .old/ .pass/ .pdb/ .pol/ .printer/ .pwd/ .rdb/ .resources/ .resx/ .sql/ .swp/ .sys/ .vb/ .vbs/ .vbproj/ .vsdisco/ .webinfo/ .xsd/ .xsx/" at TX:extension. [file "/etc/modsecurity/coreruleset-3.3.4/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "1313"] [id "920440"] [msg "URL file extension is restricted by policy"] [data ".backup"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostnam
...
show less
Hacking
Web App Attack