Blocked by UFW on amperetwo [1433/tcp]
Source port: 6510
TTL: 116
Packet length: 60
TOS: 0x00
This ...
show moreBlocked by UFW on amperetwo [1433/tcp]
Source port: 6510
TTL: 116
Packet length: 60
TOS: 0x00
This report was generated by:
https://github.com/sefinek/UFW-AbuseIPDB-Reporter
show less
Rule : MSSQLSERVER
sa Motivo: la contraseña no es válida para el inicio de sesión proporcionado. [ ...
show moreRule : MSSQLSERVER
sa Motivo: la contraseña no es válida para el inicio de sesión proporcionado. [CLIENTE: 118.99.84.71]
show less
[Tue Mar 10 08:50:24.797841 2026] [security2:error] [pid 297599:tid 139778585618112] [client 118.99. ...
show more[Tue Mar 10 08:50:24.797841 2026] [security2:error] [pid 297599:tid 139778585618112] [client 118.99.84.71:7139] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:^|b[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?u[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?s[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0- ..." at ARGS_NAMES:id. [file "/etc/modsecurity/coreruleset-4.24.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "3199"] [id "932350"] [msg "Remote Command Execution: Direct Unix Command Execution (No Arguments)"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: id found within ARGS_NAMES:id: id request_line = GET /index.php/component/search/?Itemid=1310&id=408:gempa-terkini&format=opensearch HTTP/2.0 Request URI
...
show less
[Sun Mar 08 22:04:21.902165 2026] [security2:error] [pid 197090:tid 140398847547072] [client 118.99. ...
show more[Sun Mar 08 22:04:21.902165 2026] [security2:error] [pid 197090:tid 140398847547072] [client 118.99.84.71:48605] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:^|b[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?u[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?s[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0- ..." at ARGS_NAMES:id. [file "/etc/modsecurity/coreruleset-4.24.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "3199"] [id "932350"] [msg "Remote Command Execution: Direct Unix Command Execution (No Arguments)"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: id found within ARGS_NAMES:id: id request_line = GET /index.php/component/search/?Itemid=1310&id=408:gempa-terkini&format=opensearch HTTP/2.0 Request UR
...
show less
Web App Attack
Hacking
Anonymous
Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ...
show moreDistributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in thread-skip.asp
show less
Exploited Host
Bad Web Bot
Showing 1 to
15
of 20 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩