🇩🇪
conseilgouz
2026-11-12 14:05:31
UTC ·
(17 hours ago)
law-Joomla User : try to access forms...
Hacking
🇫🇷
security.rdmc.fr
2026-11-12 13:42:37
UTC ·
(18 hours ago)
Port Scan Attack dst:80
Port Scan
🇫🇷
conseilgouz
2026-11-12 12:31:08
UTC ·
(19 hours ago)
slw-(visforms) : try to access forms...
Hacking
🇫🇷
conseilgouz
2026-11-12 06:46:18
UTC ·
(1 day ago)
maw-(visforms) : try to access forms...
Hacking
🇳🇱
Ike57
2026-11-07 18:48:48
UTC ·
(5 days ago)
Detected activity: Malicious activity detected; Abuse Confidence score over set treshold; Blocked by web application firewall; Is also listed in DNSBL: (Justspam + Spamrats) | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/53 ...
show more
Detected activity: Malicious activity detected; Abuse Confidence score over set treshold; Blocked by web application firewall; Is also listed in DNSBL: (Justspam + Spamrats) | User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126 Safari/537.36
show less
Bad Web Bot
Web App Attack
🇮🇩
hermawan
2026-11-06 03:06:33
UTC ·
(1 week ago)
[Fri Nov 06 10:06:32.833002 2026] [security2:error] [pid 118773:tid 140165813085888] [client 81.4.164.154:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/mod ...
show more
[Fri Nov 06 10:06:32.833002 2026] [security2:error] [pid 118773:tid 140165813085888] [client 81.4.164.154:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm matomo.staklim-malang.info " against "SERVER_NAME" required. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "224"] [id "440235"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: ?id= found within SERVER_NAME: staklim-jatim.bmkg.go.id request_line = GET /index.php/profil/arsip-artikel?id=499&start=20 HTTP/1.1 Request URI RAW = /index.php/profil/arsip-artikel?id=499&start=20 Request Basename = arsip-artikel"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/arsip-artikel"] [unique_id "au1EOKZABhMG88J4SHpI4QAAAAs"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[118786] [myg85roOLwg] [au1EOKZABhMG88J4SHpI4QAAAAs] keep_alive=[0] [2026-11-06 10:06:32.833011] [R:a
...
show less
Email Spam
Hacking
🇨🇦
Anytech
2026-10-30 07:35:56
UTC ·
(2 weeks ago)
Blocked by Conn-Monitor: http-bad-user-agent
Web App Attack
Bad Web Bot
🇫🇷
regishoussin
2026-10-23 12:07:50
UTC ·
(2 weeks ago)
Automated web scanning detected by Wazuh (rule 100180): repeated 400/404 errors from mass probing of admin/backdoor paths (e.g. wp-login.php, known CMS shell filenames) on an Apache web server, on 2026-10-23 12:07 UTC.
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-23 06:31:30
UTC ·
(3 weeks ago)
Wordlist path sweep | method: GET | path: /contact-us, /nous-joindre, /contactez-nous (+9 more) | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0 Safari/537.36
Port Scan
Web App Attack
🇮🇩
hermawan
2026-10-15 05:25:22
UTC ·
(4 weeks ago)
[Thu Oct 15 12:24:44.518635 2026] [security2:error] [pid 190830:tid 139626383644352] [client 81.4.164.154:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/corer ...
show more
[Thu Oct 15 12:24:44.518635 2026] [security2:error] [pid 190830:tid 139626383644352] [client 81.4.164.154:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "www.bmkg.go.id" at REQUEST_HEADERS:referer. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "618"] [id "440068"] [msg "BAD Referer"] [data "Matched Data: www.bmkg.go.id found within REQUEST_HEADERS:referer: https://www.bmkg.go.id/ request_line = GET /index.php/profil/arsip-artikel?catid=478&id=1031:prakiraan-cuaca-daerah-malang-dan-batu-seminggu-ke-depan-berlaku-tanggal-14-20-juni-2017&start=80 HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/index.php/profil/arsip-artikel"] [unique_id "atBjnJqKSA2l2fgODB14tgAAANc"], referer https://www.bmkg.go.id/ [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[190942] [0NvyQ1qkTqk] [atBjnJqKSA2l2fgODB14tgAAANc] keep_alive=[0] [2026-10-15 12:24:44.518645] [R:atBjnJqKSA2l2fgODB14tgAAANc] UA:'Moz
...
show less
Email Spam
Hacking
🇺🇸
SX Communications
2026-10-13 13:48:50
UTC ·
(4 weeks ago)
HTTP application-layer DoS / botnet traffic from 81.4.164.154: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇮🇩
hermawan
2026-10-12 01:34:06
UTC ·
(1 month ago)
[Mon Oct 12 08:34:04.926238 2026] [security2:error] [pid 1661793:tid 140630005098176] [client 81.4.164.154:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm /gtagku-v2.js /administrator/index.php?option=com_content /swiper-v114na.js ...
show more
[Mon Oct 12 08:34:04.926238 2026] [security2:error] [pid 1661793:tid 140630005098176] [client 81.4.164.154:0] ModSecurity: Access denied with code 403 (phase 1). Match of "pm /gtagku-v2.js /administrator/index.php?option=com_content /swiper-v114na.js /ga-choise-v6.js /bmkg-192.png /800-600.webp /bmkg-192x192.png /ga-v5.js /favicon-16-16.png /matomo-partition-21-01-2026-5-5-0.js /script-v185.js /script-v188.js /script-v184.j ..." against "REQUEST_HEADERS:referer" required. [file "/etc/modsecurity/coreruleset-4.29.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "475"] [id "440008"] [msg "BAD REQUEST Bro"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: If-Modified-Since found within REQUEST_HEADERS:referer: https://www.bing.go.id/ request_line = GET /images/Klimatologi/Prakiraan/04_Prakiraan_6_Bulanan/Prakiraan_Musim/Lampiran/9_Ilustrasi_1_Awal_Musim_Hujan_dan_Awal_Musim_Kemarau.jpg HTTP/1.1 Request URI RAW = /images/
...
show less
Email Spam
Hacking
🇺🇸
SX Communications
2026-10-09 05:38:31
UTC ·
(1 month ago)
HTTP application-layer DoS / botnet traffic from 81.4.164.154: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
heyzg
2026-07-05 23:50:02
UTC ·
(4 months ago)
API LLMjacking (Ollama) (observed): 7 HTTP, 7.3m; attempted outbound scan & cryptomining; Ollama: /api/tags,/api/generate,/api/version,/api/ps
Hacking
Web App Attack
🇫🇮
FDC
2026-07-05 23:45:50
UTC ·
(4 months ago)
Malicious activity from 81.4.164.154 detected by FDC honeypots. Categories: 14,15,21. 8 events in last 24h.
Port Scan
Hacking
Web App Attack
