City: unknown
Region: unknown
Country: None
Internet Service Provider: unknown
Hostname: unknown
Organization: unknown
Usage Type: unknown
| IP | Type | Details | Datetime |
|---|---|---|---|
| 173.252.95.36 | attack | [Sun Sep 06 23:53:43.920622 2020] [:error] [pid 31433:tid 140397593237248] [client 173.252.95.36:54642] [client 173.252.95.36] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/TableFilter/total-v62.js"] [unique_id "X1UUF3Jrmc0na8dwfwZeEAAAZgo"] ... |
2020-09-07 21:40:00 |
| 173.252.95.35 | attack | Port Scan: TCP/80 |
2020-09-07 21:32:14 |
| 173.252.95.36 | attackbots | [Sun Sep 06 23:53:43.920622 2020] [:error] [pid 31433:tid 140397593237248] [client 173.252.95.36:54642] [client 173.252.95.36] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/TableFilter/total-v62.js"] [unique_id "X1UUF3Jrmc0na8dwfwZeEAAAZgo"] ... |
2020-09-07 13:25:14 |
| 173.252.95.35 | attack | Port Scan: TCP/80 |
2020-09-07 13:17:20 |
| 173.252.95.36 | attack | [Sun Sep 06 23:53:43.920622 2020] [:error] [pid 31433:tid 140397593237248] [client 173.252.95.36:54642] [client 173.252.95.36] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/TableFilter/total-v62.js"] [unique_id "X1UUF3Jrmc0na8dwfwZeEAAAZgo"] ... |
2020-09-07 05:59:58 |
| 173.252.95.35 | attack | [Sun Sep 06 23:53:54.625273 2020] [:error] [pid 31435:tid 140397542881024] [client 173.252.95.35:42156] [client 173.252.95.35] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/depan/service-worker-v4.js"] [unique_id "X1UUIqKFltyTD6lc4lcewAAAOwQ"], referer: https://karangploso.jatim.bmkg.go.id/depan/service-worker-v4.js ... |
2020-09-07 05:53:17 |
| 173.252.95.35 | attackspambots | [Sat Aug 15 19:25:50.690691 2020] [:error] [pid 3316:tid 140592583423744] [client 173.252.95.35:45702] [client 173.252.95.35] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/index.php/prakiraan-iklim/prakiraan-bulanan/prakiraan-daerah-potensi-banjir-di-provinsi-jawa-timur/555558208-prakiraan-bulanan-daerah-potensi-banjir-di-provinsi-jawa-timur-untuk-bulan-september-tahun-2020-update-10-agustus-2020"] [unique_id "XzfUTua0Xgxjnrgkau-8LgACeAM"] ... |
2020-08-15 20:38:36 |
| 173.252.95.112 | attackbotsspam | [Sat Aug 15 19:25:56.354856 2020] [:error] [pid 1165:tid 140592558245632] [client 173.252.95.112:49236] [client 173.252.95.112] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/image-loader-worker-v3.js"] [unique_id "XzfUVOniW-eKEEIJLUNKMQABwwA"] ... |
2020-08-15 20:32:24 |
| 173.252.95.21 | attackspam | [Sat Aug 15 19:25:57.336250 2020] [:error] [pid 1165:tid 140592558245632] [client 173.252.95.21:64936] [client 173.252.95.21] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/TableFilter/system-v116.css"] [unique_id "XzfUVeniW-eKEEIJLUNKMwABxAA"] ... |
2020-08-15 20:31:58 |
| 173.252.95.117 | attackbots | [Thu Aug 13 04:03:06.401428 2020] [:error] [pid 3529:tid 140197992204032] [client 173.252.95.117:50316] [client 173.252.95.117] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/OneSignalSDKWorker-v3.js"] [unique_id "XzRZCoqBmYA0JFMXc6nlYgACSgM"], referer: https://karangploso.jatim.bmkg.go.id/OneSignalSDKWorker-v3.js ... |
2020-08-13 06:03:44 |
| 173.252.95.36 | attackbots | [Wed Jul 15 01:28:22.702077 2020] [:error] [pid 13074:tid 140254315534080] [client 173.252.95.36:64308] [client 173.252.95.36] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/script-v49.js"] [unique_id "Xw35Rp6BljNWiMsO2yWGSwABwwM"] ... |
2020-07-15 02:54:47 |
| 173.252.95.11 | attackbotsspam | [Tue May 12 10:50:34.541334 2020] [:error] [pid 5113:tid 140143871072000] [client 173.252.95.11:35676] [client 173.252.95.11] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/TableFilter/system-v116.css"] [unique_id "XrodCpwLuor3aXL5YyIHIAACHAA"] ... |
2020-05-12 16:18:21 |
| 173.252.95.17 | attackbots | [Tue May 12 10:50:34.938882 2020] [:error] [pid 4767:tid 140143879464704] [client 173.252.95.17:33180] [client 173.252.95.17] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/timeout-worker-v1.js"] [unique_id "XrodCu0L6urHhe@iJKLGrQAB8QE"] ... |
2020-05-12 16:16:46 |
| 173.252.95.23 | attackbots | [Tue May 12 10:50:36.509570 2020] [:error] [pid 4667:tid 140143871072000] [client 173.252.95.23:60624] [client 173.252.95.23] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "&REQUEST_HEADERS:Transfer-Encoding" required. [file "/etc/modsecurity/owasp-modsecurity-crs-3.2.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "202"] [id "920171"] [msg "GET or HEAD Request with Transfer-Encoding."] [data "1"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/INVALID_HREQ"] [tag "CAPEC-272"] [hostname "karangploso.jatim.bmkg.go.id"] [uri "/disquss-v2.js"] [unique_id "XrodDHfX6Pwr632XfqBBPgAAtgA"] ... |
2020-05-12 16:15:02 |
| 173.252.95.16 | attackspambots | (mod_security) mod_security (id:20000006) triggered by 173.252.95.16 (US/United States/fwdproxy-atn-016.fbsv.net): 5 in the last 300 secs |
2020-05-09 13:37:25 |
b; <<>> DiG 9.10.3-P4-Ubuntu <<>> 173.252.95.7
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NXDOMAIN, id: 1268
;; flags: qr rd ra; QUERY: 1, ANSWER: 0, AUTHORITY: 1, ADDITIONAL: 0
;; QUESTION SECTION:
;173.252.95.7. IN A
;; AUTHORITY SECTION:
. 153 IN SOA a.root-servers.net. nstld.verisign-grs.com. 2022020700 1800 900 604800 86400
;; Query time: 19 msec
;; SERVER: 183.60.83.19#53(183.60.83.19)
;; WHEN: Mon Feb 07 19:15:38 CST 2022
;; MSG SIZE rcvd: 1057.95.252.173.in-addr.arpa domain name pointer fwdproxy-atn-007.fbsv.net.Server: 183.60.83.19
Address: 183.60.83.19#53
Non-authoritative answer:
7.95.252.173.in-addr.arpa name = fwdproxy-atn-007.fbsv.net.
Authoritative answers can be found from:| IP | Type | Details | Datetime |
|---|---|---|---|
| 185.175.93.18 | attack | ET DROP Dshield Block Listed Source group 1 - port: 43962 proto: TCP cat: Misc Attack |
2020-03-29 03:07:14 |
| 211.167.76.130 | attackspam | ET SCAN Suspicious inbound to MSSQL port 1433 - port: 1433 proto: TCP cat: Potentially Bad Traffic |
2020-03-29 03:03:01 |
| 49.88.112.109 | attackspam | 03/28/2020-12:06:56.263612 49.88.112.109 Protocol: 6 ET CINS Active Threat Intelligence Poor Reputation IP group 50 |
2020-03-29 02:59:43 |
| 144.217.34.147 | attackbots | Unauthorized connection attempt from IP address 144.217.34.147 on Port 137(NETBIOS) |
2020-03-29 03:11:36 |
| 162.243.128.147 | attack | 162.243.128.147 - - - [28/Mar/2020:16:52:40 +0000] "GET / HTTP/1.1" 404 162 "-" "Mozilla/5.0 zgrab/0.x" "-" "-" |
2020-03-29 03:10:47 |
| 185.202.1.240 | attackbotsspam | SSH Authentication Attempts Exceeded |
2020-03-29 02:33:24 |
| 50.236.62.30 | attackbots | SSH Authentication Attempts Exceeded |
2020-03-29 02:58:16 |
| 103.124.92.184 | attackbots | Mar 28 12:39:11 server1 sshd\[794\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.124.92.184 Mar 28 12:39:13 server1 sshd\[794\]: Failed password for invalid user ktd from 103.124.92.184 port 45122 ssh2 Mar 28 12:43:54 server1 sshd\[2248\]: Invalid user egg from 103.124.92.184 Mar 28 12:43:54 server1 sshd\[2248\]: pam_unix\(sshd:auth\): authentication failure\; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.124.92.184 Mar 28 12:43:56 server1 sshd\[2248\]: Failed password for invalid user egg from 103.124.92.184 port 58608 ssh2 ... |
2020-03-29 02:49:35 |
| 65.229.5.158 | attackspambots | SSH Brute Force |
2020-03-29 02:56:33 |
| 131.72.201.147 | attack | SSH Brute Force |
2020-03-29 02:45:05 |
| 80.82.77.33 | attackbotsspam | ET DROP Dshield Block Listed Source group 1 - port: 6666 proto: TCP cat: Misc Attack |
2020-03-29 02:54:56 |
| 103.99.2.234 | attackbots | 03/28/2020-12:36:40.582259 103.99.2.234 Protocol: 6 ET SCAN NMAP -sS window 1024 |
2020-03-29 02:50:04 |
| 69.229.6.6 | attackbots | Invalid user tiv from 69.229.6.6 port 53350 |
2020-03-29 02:56:17 |
| 145.239.91.88 | attack | leo_www |
2020-03-29 02:43:54 |
| 185.175.93.14 | attackspambots | ET DROP Dshield Block Listed Source group 1 - port: 20833 proto: TCP cat: Misc Attack |
2020-03-29 03:07:39 |