Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Nov 8 18:03:46 zurich-2 sshd[3984129]: Invalid user datahighway from 71.225.77.159 port 39401
Nov 8 18:03:46 zurich-2 sshd[3984129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=71.225.77.159
Nov 8 18:03 ...
show moreNov 8 18:03:46 zurich-2 sshd[3984129]: Invalid user datahighway from 71.225.77.159 port 39401
Nov 8 18:03:46 zurich-2 sshd[3984129]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=71.225.77.159
Nov 8 18:03:48 zurich-2 sshd[3984129]: Failed password for invalid user datahighway from 71.225.77.159 port 39401 ssh2
...
show less
Brute-Force
SSH
Anonymous
Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show moreLarge-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Attack Signature Blocked: /wishlist/index/add/product/9414/form_key/1mg5vU5nkp2GfqRX/ | UA: Mozilla/5.0 (iPhone; CPU iPhone OS 17_4_1 like Mac OS X) AppleWebKit/534.1 (KHTML, like Gecko) CriOS/24.0.866.0 Mobile/28J448 Safari/534.1 | (Magento Site)
show less
Captured JA4H: ge11n_6095c6f1f3d8 | Log: 71.225.77.159 - - [31/Oct/2026:19:02:40 +0700] "GET / HTTP/1.1" 200 17206 "https://staklim-jatim.bmkg.go.id/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Ed ...
show moreCaptured JA4H: ge11n_6095c6f1f3d8 | Log: 71.225.77.159 - - [31/Oct/2026:19:02:40 +0700] "GET / HTTP/1.1" 200 17206 "https://staklim-jatim.bmkg.go.id/" "Mozilla/5.0 (iPhone; CPU iPhone OS 17_6 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) EdgiOS/128.0.2739.60 Version/17.0 Mobile/15E148 Safari/604.1" ge11n_host,x-forwarded-scheme,x-forwarded-proto,x-forwarded-for,x-real-ip,connection,sec-fetch-site,cf-ew-via,cdn-loop,sec-fetch-mode,sec-fetch-dest,cf-ray,accept-encoding,accept-language,accept,referer,user-agent,cf-connecting-ip,cf-visitor,cf-ipcountry...
...
show less
[Sat Oct 03 06:46:49.051202 2026] [security2:error] [pid 825884:tid 140632947369664] [client 71.225.77.159:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/mo ...
show more[Sat Oct 03 06:46:49.051202 2026] [security2:error] [pid 825884:tid 140632947369664] [client 71.225.77.159:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "208"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: %3a found within SERVER_NAME: staklim-jatim.bmkg.go.id request_line = GET /index.php/profil/arsip-artikel?catid=635&id=2413%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-7-13-februari-2017&start=60 HTTP/1.1 Request URI RAW = /index.php/profil/arsip-artikel?catid=635&id=2413%3Aprakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-7-13-februari-2017&start..."] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/arsip-artikel"] [unique_id "asBCaSm-XeqQ
...
show less
