🇩🇪
www.Examensfragen.de
2024-06-20 21:28:47
(2 years ago)
Web Spam
Bad Web Bot
🇺🇸
TPI-Abuse
2024-06-19 03:06:04
(2 years ago)
(mod_security) mod_security (id:218420) triggered by 152.42.227.183 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:218420) triggered by 152.42.227.183 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 18 23:05:37.900947 2024] [security2:error] [pid 12941] [client 152.42.227.183:41762] [client 152.42.227.183] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||192.64.150.243|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.243"] [uri "/php-cgi/php-cgi.exe"] [unique_id "ZnJLAT_dVm3WQr8vGA0wBQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-06-18 20:15:49
(2 years ago)
(mod_security) mod_security (id:218420) triggered by 152.42.227.183 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:218420) triggered by 152.42.227.183 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 18 16:15:41.559758 2024] [security2:error] [pid 4112] [client 152.42.227.183:58578] [client 152.42.227.183] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||192.64.150.244|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.244"] [uri "/php-cgi/php-cgi.exe"] [unique_id "ZnHq7dvi3N7YrAds4ZGp3QAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-06-18 19:55:29
(2 years ago)
(mod_security) mod_security (id:218420) triggered by 152.42.227.183 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:218420) triggered by 152.42.227.183 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jun 18 15:55:22.740461 2024] [security2:error] [pid 21766] [client 152.42.227.183:44576] [client 152.42.227.183] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||www.barigby.com|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "www.barigby.com"] [uri "/php-cgi/php-cgi.exe"] [unique_id "ZnHmKhgUjvLq9bx5uLUESwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
MAGIC
2024-06-17 11:06:53
(2 years ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
🇺🇸
TPI-Abuse
2024-06-13 08:33:49
(2 years ago)
(mod_security) mod_security (id:218420) triggered by 152.42.227.183 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:218420) triggered by 152.42.227.183 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jun 13 04:33:45.804941 2024] [security2:error] [pid 4450] [client 152.42.227.183:57108] [client 152.42.227.183] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||chezlubacov.xyz|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "chezlubacov.xyz"] [uri "/php-cgi/php-cgi.exe"] [unique_id "Zmqu6ZSwmyeMaX8kKmjtdwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
10dencehispahard SL
2024-06-13 02:05:43
(2 years ago)
Unauthorized login attempts [ accesslogs]
Brute-Force
🇨🇦
yukon.ca
2024-06-13 01:51:00
(2 years ago)
Web Server Enforcement Violation: PHP CGI Argument Injection (CVE-2024-4577)
Port:80
Hacking
Exploited Host
🇮🇪
Jim Keir
2024-06-12 23:04:18
(2 years ago)
2024-06-12 23:04:17 152.42.227.183 File scanning, blocking 152.42.227.183 for 5 minutes
Web App Attack
🇺🇸
TPI-Abuse
2024-06-12 22:23:16
(2 years ago)
(mod_security) mod_security (id:218420) triggered by 152.42.227.183 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:218420) triggered by 152.42.227.183 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 12 18:23:11.274510 2024] [security2:error] [pid 26975] [client 152.42.227.183:52108] [client 152.42.227.183] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||stamford.org|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "stamford.org"] [uri "/php-cgi/php-cgi.exe"] [unique_id "ZmofzyOvzt4AwJxGVzWEnAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-06-12 21:01:39
(2 years ago)
(mod_security) mod_security (id:218420) triggered by 152.42.227.183 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:218420) triggered by 152.42.227.183 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 12 17:01:36.607561 2024] [security2:error] [pid 29562] [client 152.42.227.183:60512] [client 152.42.227.183] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)php://(std(in|out|err)|(in|out)put|fd|memory|temp|filter)" at ARGS_NAMES:\\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/21_PHP_PHPGen.conf"] [line "22"] [id "218420"] [rev "2"] [msg "COMODO WAF: PHP Injection Attack: I/O Stream Found||192.64.150.19|F|2"] [data "Matched Data: php://input found within ARGS_NAMES:\\x5cxadd allow_url_include=1 \\x5cxadd auto_prepend_file=php://input: \\xadd allow_url_include=1 \\xadd auto_prepend_file=php://input"] [severity "CRITICAL"] [tag "CWAF"] [tag "PHPGen"] [hostname "192.64.150.19"] [uri "/php-cgi/php-cgi.exe"] [unique_id "ZmoMsPQlIkQdw2Rlor3YEwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
ozisp.com.au
2024-06-12 11:48:22
(2 years ago)
US_DigitalOcean,_<33>1718192901 [1:2016982:2] ET WEB_SERVER auto_prepend_file PHP config option in u ...
show more
US_DigitalOcean,_<33>1718192901 [1:2016982:2] ET WEB_SERVER auto_prepend_file PHP config option in uri [Classification: A Network Trojan was detected] [Priority: 1] {TCP} 152.42.227.183:51032
show less
Hacking
🇹🇭
MWA SOC
2024-06-12 07:41:22
(2 years ago)
Hacking
🇩🇪
ISPLtd
2024-06-12 07:28:33
(2 years ago)
Jun 12 04:28:29 SRC=152.42.227.183 PROTO=TCP SPT=48856 DPT=8080 SYN
Jun 12 04:28:30 SRC=152.42.227.1 ...
show more
Jun 12 04:28:29 SRC=152.42.227.183 PROTO=TCP SPT=48856 DPT=8080 SYN
Jun 12 04:28:30 SRC=152.42.227.183 PROTO=TCP SPT=48856 DPT=8080 SYN
Jun 12 04:28:32 SRC=152.42.227.183 PROTO=TCP SPT=48856 DPT=8080
...
show less
Port Scan
🇮🇹
LTM
2024-06-11 06:20:01
(2 years ago)
WebServer - Attempts to exploit
Hacking
Brute-Force
Web App Attack