|
🇳🇱
m00nst0n3
|
|
C2
|
Port Scan
Hacking
Brute-Force
Exploited Host
|
|
|
🇺🇦
URAN Publishing Service
|
|
157.230.34.45 - - [03/Aug/2024:16:07:46 +0300] "GET /wp-admin/ HTTP/1.1" 404 2857 "-" "Mozilla/5.0 ( ...
show more
157.230.34.45 - - [03/Aug/2024:16:07:46 +0300] "GET /wp-admin/ HTTP/1.1" 404 2857 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
157.230.34.45 - - [03/Aug/2024:16:07:47 +0300] "GET /wp-admin/ HTTP/1.1" 404 2860 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36"
...
show less
|
Web App Attack
|
|
|
Anonymous
|
|
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
|
Brute-Force
SSH
|
|
|
🇺🇸
mawan
|
|
Suspected of having performed illicit activity on LAX server.
|
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 157.230.34.45 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 157.230.34.45 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 31 07:45:31.801118 2024] [security2:error] [pid 32117:tid 32130] [client 157.230.34.45:58301] [client 157.230.34.45] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||batonrougegazette.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "batonrougegazette.com"] [uri "/wp-json/wp/v2/users/"] [unique_id "Zqoj294e2_3yunVkNGLEggAAAIs"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇮🇩
hermawan
|
|
[Wed Jul 31 15:01:20.593440 2024] [security2:error] [pid 52048:tid 135437676971584] [client 157.230. ...
show more
[Wed Jul 31 15:01:20.593440 2024] [security2:error] [pid 52048:tid 135437676971584] [client 157.230.34.45:54800] [client 157.230.34.45] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "300" at REQUEST_HEADERS:Keep-Alive. [file "/etc/modsecurity/coreruleset-4.3.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "119"] [id "440004"] [msg "Keep Alive Header"] [data "Matched Data: 300 found within REQUEST_HEADERS:Keep-Alive: 300 request_line = GET / HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/"] [unique_id "ZqnvUDOzzTHizE1QTsYPOQAAAMw"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[52102] [rXTnf17lNlk] [ZqnvUDOzzTHizE1QTsYPOQAAAMw] keep_alive=[0] [2024-07-31 15:01:20.593449] [R:ZqnvUDOzzTHizE1QTsYPOQAAAMw] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36' Host:'staklim-jatim.bmkg.go.id' ACCEPT:'text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=
...
show less
|
Hacking
Web App Attack
|
|
|
🇸🇬
pusathosting.com
|
|
2ds22 bruteforce
|
Brute-Force
Web App Attack
|
|
|
🇮🇩
hermawan
|
|
[Tue Jul 30 10:21:19.368101 2024] [security2:error] [pid 747935:tid 125819645068864] [client 157.230 ...
show more
[Tue Jul 30 10:21:19.368101 2024] [security2:error] [pid 747935:tid 125819645068864] [client 157.230.34.45:51195] [client 157.230.34.45] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "300" at REQUEST_HEADERS:Keep-Alive. [file "/etc/modsecurity/coreruleset-4.3.0/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "119"] [id "440004"] [msg "Keep Alive Header"] [data "Matched Data: 300 found within REQUEST_HEADERS:Keep-Alive: 300 request_line = GET //wp-includes/wlwmanifest.xml HTTP/1.1"] [severity "NOTICE"] [hostname "staklim-jatim.bmkg.go.id"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ZqhcL_SwS4xTJfPgTGReewAAAM8"] [staklim-jatim.bmkg.go.id] [staklim-jatim.bmkg.go.id] top=[747992] [gOugePadMfM] [ZqhcL_SwS4xTJfPgTGReewAAAM8] keep_alive=[0] [2024-07-30 10:21:19.368106] [R:ZqhcL_SwS4xTJfPgTGReewAAAM8] UA:'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.114 Safari/537.36' Host:'staklim-jatim.bmkg.go.id' ACCEPT:'tex
...
show less
|
Hacking
Web App Attack
|
|
|
🇸🇬
pusathosting.com
|
|
2ds22 bruteforce
|
Brute-Force
Web App Attack
|
|
|
🇮🇩
penjaga BRIN
|
|
Multiple WP scan detected from same source ip.-111
|
Brute-Force
|
|
|
🇨🇿
Countryman
|
|
repeated unauthorized connection attempts, host sweep, port scan
|
Port Scan
|
|
|
🇨🇿
Countryman
|
|
ZGrab.Scanner
|
Port Scan
|
|
|
🇩🇰
buusbudde.dk
|
|
[Tue Jun 27 07:09:25.848860 2023] [:error] [pid 1084333] [client 157.230.34.45:55538] [client 157.23 ...
show more
[Tue Jun 27 07:09:25.848860 2023] [:error] [pid 1084333] [client 157.230.34.45:55538] [client 157.230.34.45] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "www.buusbudde.dk"] [uri "/ab2g"] [unique_id "ZJpvBUdF5ffRLkrLYPIrSAAAAAU"], referer: https://85.191.50.194/ab2g
[Tue Jun 27 07:09:27.465356 2023] [:error] [pid 1137342] [client 157.230.34.45:55552] [client 157.230.34.45] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [sever
...
show less
|
Web App Attack
|
|
|
Anonymous
|
|
Malicious activity detected
|
Hacking
Web App Attack
|
|
|
🇺🇸
MPL
|
|
tcp/443
|
Port Scan
|
|