159.69.19.85

block ruleset Badbot using very old user-agents 5CF3CDB778C7D82564405B86B9242E612F378C68

[ThuJun1804:28:39.0937822026][security2:error][pid4039743:tid4040115][client159.69.19.85:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(\^w3c-\|systran\\\\\\\\\)\)\"against\"REQUEST_HEADERS:User-Agent\"required.[file\"/etc/apache2/conf. ... show more [ThuJun1804:28:39.0937822026][security2:error][pid4039743:tid4040115][client159.69.19.85:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(\^w3c-\|systran\\\\\\\\\)\)\"against\"REQUEST_HEADERS:User-Agent\"required.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"218\"][id\"331039\"][rev\"1\"][msg\"Atomicorp.comWAFRules:SuspiciousUnusualUserAgent\(Python-urllib\).DisablethisruleifyouusePython-urllib.\"][severity\"CRITICAL\"][hostname\"hostingedominio.ch\"][uri\"/\"][unique_id\"ajNX1zSk0AYxG3VKN2LTzwAAAE8\"] show less

Blocked by UFW (TCP on 80) Source port: 54628 TTL: 46 Packet length: 60 TOS: 0x00 This report (for 159.69.19.85) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter

[MonJun1502:12:13.4943072026][security2:error][pid408598:tid409170][client159.69.19.85:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(\^w3c-\|systran\\\\\\\\\)\)\"against\"REQUEST_HEADERS:User-Agent\"required.[file\"/etc/apache2/conf.d/ ... show more [MonJun1502:12:13.4943072026][security2:error][pid408598:tid409170][client159.69.19.85:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(\^w3c-\|systran\\\\\\\\\)\)\"against\"REQUEST_HEADERS:User-Agent\"required.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"218\"][id\"331039\"][rev\"1\"][msg\"Atomicorp.comWAFRules:SuspiciousUnusualUserAgent\(Python-urllib\).DisablethisruleifyouusePython-urllib.\"][severity\"CRITICAL\"][hostname\"hostingedominio.com\"][uri\"/\"][unique_id\"ai9DXf_-gZqpGn9Ezv2jpAAAAQw\"] show less

[MonMay2503:32:13.3853062026][security2:error][pid2207784:tid2207997][client159.69.19.85:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(\^w3c-\|systran\\\\\\\\\)\)\"against\"REQUEST_HEADERS:User-Agent\"required.[file\"/etc/apache2/conf. ... show more [MonMay2503:32:13.3853062026][security2:error][pid2207784:tid2207997][client159.69.19.85:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(\^w3c-\|systran\\\\\\\\\)\)\"against\"REQUEST_HEADERS:User-Agent\"required.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"218\"][id\"331039\"][rev\"1\"][msg\"Atomicorp.comWAFRules:SuspiciousUnusualUserAgent\(Python-urllib\).DisablethisruleifyouusePython-urllib.\"][severity\"CRITICAL\"][hostname\"4server.ch\"][uri\"/\"][unique_id\"ahOmneQUhqK0vRlCj1OazgAAAM4\"] show less

[MonApr0611:33:46.6593792026][security2:error][pid2910349:tid2910371][client159.69.19.85:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(\^w3c-\|systran\\\\\\\\\)\)\"against\"REQUEST_HEADERS:User-Agent\"required.[file\"/etc/apache2/conf. ... show more [MonApr0611:33:46.6593792026][security2:error][pid2910349:tid2910371][client159.69.19.85:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Matchof\"rx\(\^w3c-\|systran\\\\\\\\\)\)\"against\"REQUEST_HEADERS:User-Agent\"required.[file\"/etc/apache2/conf.d/modsec_rules/20_asl_useragents.conf\"][line\"218\"][id\"331039\"][rev\"1\"][msg\"Atomicorp.comWAFRules:SuspiciousUnusualUserAgent\(Python-urllib\).DisablethisruleifyouusePython-urllib.\"][severity\"CRITICAL\"][hostname\"www.4server.ch\"][uri\"/\"][unique_id\"adN9-n9eHMHGdvSXYMGVAAAAANM\"] show less

(apache-useragents) Failed apache-useragents trigger with match [redacted] from 159.69.19.85 (DE/Germany/n0.trixing.net)

VM1 Bad user agents ignoring web crawling rules. Draing bandwidth

Suspicious user agent detected Python-urllib/2.7. Threat Score: 3.1/10 (LOW). Confidence: 30%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 36%. MITRE ATT&CK: T1016 (System Network Configura ... show more Suspicious user agent detected Python-urllib/2.7. Threat Score: 3.1/10 (LOW). Confidence: 30%. CVSS v3.1: 0/10 (None). CVSS Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:N. Bayesian Probability: 36%. MITRE ATT&CK: T1016 (System Network Configuration Discovery). Tactic: TA0001. Freshness: Stale. Source Reputation: UNKNOWN. Methodology: CVSS 3.1 + Bayesian + Temporal + Environmental + MITRE ATT&CK + OWASP. Standards: ISO/IEC 27065:2022, NIST SP 800-30, IEEE S&P 2020. Reported by TangerangKota-CSIRT show less

Suspicious user agent detected Python-urllib/2.7. Threat Score: 0/10 (INFORMATIONAL). Reported by TangerangKota-CSIRT

[WAZUH] Suspicious user agent detected Python-urllib/2.7

(apache-useragents) Failed apache-useragents trigger with match [redacted] from 159.69.19.85 (DE/Germany/n0.trixing.net)

Blocked by UFW (TCP on 80) Source port: 55456 TTL: 49 Packet length: 60 TOS: 0x00 This report (for 159.69.19.85) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter

block ruleset 3D3AFA921A373ECE19B6BA285C2D722163304638