🇺🇸
TPI-Abuse
2024-07-29 16:32:10
(2 years ago)
(mod_security) mod_security (id:240335) triggered by 162.158.78.40 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:240335) triggered by 162.158.78.40 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 29 12:32:03.527234 2024] [security2:error] [pid 30380:tid 30380] [client 162.158.78.40:35136] [client 162.158.78.40] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at IP. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5956"] [id "240335"] [rev "5"] [msg "COMODO WAF: XML-RPC Attack Identified (CVE-2013-0235)|Source 82.102.23.139 (+1 hits since last alert)|www.upskirtcrazy.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.upskirtcrazy.com"] [uri "/xmlrpc.php"] [unique_id "ZqfEA9wgD9UERy8NfWsiXAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-06-25 02:08:08
(2 years ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇪🇸
el-brujo
2024-06-15 22:52:25
(2 years ago)
16/Jun/2024:00:52:21.687397 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
16/Jun/2024:00:52:21.687397 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 162.158.78.40] ModSecurity: Warning. Pattern match "(?:^|=)\\\\\\\\s*(?:{|\\\\\\\\s*\\\\\\\\(\\\\\\\\s*|\\\\\\\\w+=(?:[^\\\\\\\\s]*|\\\\\\\\$.*|\\\\\\\\$.*|<.*|>.*|\\\\\\\\'.*\\\\\\\\'|\\\\".*\\\\")\\\\\\\\s+|!\\\\\\\\s*|\\\\\\\\$)*\\\\\\\\s*(?:'|\\\\")*(?:[\\\\\\\\?\\\\\\\\*\\\\\\\\[\\\\\\\\]\\\\\\\\(\\\\\\\\)\\\\\\\\-\\\\\\\\|+\\\\\\\\w'\\\\"\\\\\\\\./\\\\\\\\\\\\\\\\]+/)?[\\\\\\\\\\\\\\\\'\\\\"]*(?:l[\\\\\\\\\\\\\\\\'\\\\"]*(?:s(?:[\\\\\\\\\\\\\\\\'\\\\"]*(?:b[\\\\\\\\\\\\\\\\'\\\\"]*_[\\\\\\\\\\\\\\\\'\\\\"]*r[\\\\\\\\\\\\\\\\'\\\\"]*e[\\\\\\\\\\\\\\\\'\\\\"]*l[\\\\\\\\\\\\\\\\' ..." at ARGS:anos. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "464"] [id "932150"] [msg "Remote Command Execution: Direct Unix Command Execution"] [data "Matched Data: =\\\\x22ls found within ARGS:anos: \\\\x22><!--#EXEC cmd=\\\\x22ls /\\\\x22--><"] [sever
...
show less
Hacking
Web App Attack
🇪🇸
el-brujo
2024-06-14 00:55:28
(2 years ago)
14/Jun/2024:02:55:27.804503 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
14/Jun/2024:02:55:27.804503 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 162.158.78.40] ModSecurity: Warning. detected SQLi using libinjection with fingerprint 'nk1o(' [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "66"] [id "942100"] [msg "SQL Injection Attack Detected via libinjection"] [data "Matched Data: nk1o( found within ARGS:mail: skHVrIbI where 0 in (select sleep(15) ) -- "] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/66"] [tag "PCI/6.5.2"] [hostname "warzone.elhacker.net"] [uri "/reg.php"] [unique_id "ZmuU_6ooGfipPfMhto-6qAAATRA"]
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2024-06-03 21:58:23
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 162.158.78.40 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.78.40 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 03 17:58:18.106693 2024] [security2:error] [pid 1975006] [client 162.158.78.40:55460] [client 162.158.78.40] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "zevikz.com"] [uri "/laravel/.env"] [unique_id "Zl48eprMdsgbBIbBwVO8owAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-05-09 02:00:44
(2 years ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2024-05-07 23:19:16
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 162.158.78.40 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 162.158.78.40 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 07 19:19:11.574418 2024] [security2:error] [pid 17273] [client 162.158.78.40:25954] [client 162.158.78.40] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sportsbookcommission.com"] [uri "/.env"] [unique_id "Zjq27_El7jZlr5cLz8cO-gAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2024-05-01 03:29:38
(2 years ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2024-04-23 03:18:11
(2 years ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
🇺🇸
TPI-Abuse
2024-04-17 00:25:37
(2 years ago)
(mod_security) mod_security (id:210580) triggered by 162.158.78.40 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210580) triggered by 162.158.78.40 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 16 20:25:30.502755 2024] [security2:error] [pid 29536] [client 162.158.78.40:29328] [client 162.158.78.40] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "etc/passwd" at ARGS:content. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||barracuda.assistguide.com|F|2"] [data "Matched Data: etc/passwd found within ARGS:content: ../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "barracuda.assistguide.com"] [uri "/index.php"] [unique_id "Zh8W-ltQlC8piO5H1CjKRwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2024-02-29 18:26:16
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 162.158.78.40 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 162.158.78.40 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Feb 29 13:26:09.826535 2024] [security2:error] [pid 25759] [client 162.158.78.40:12806] [client 162.158.78.40] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||ruralcommunitycare.org|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "ruralcommunitycare.org"] [uri "/wp-json/wp/v2/users/"] [unique_id "ZeDMQQop5RN-6R7PU5-lsgAAAAM"], referer: http://ruralcommunitycare.org///wp-json/wp/v2/users/
show less
Brute-Force
Bad Web Bot
Web App Attack
2023-10-04 18:19:50
(3 years ago)
Web Spam
Email Spam
Blog Spam
Bad Web Bot
Web App Attack
🇺🇸
octageeks.com
2023-09-03 04:14:37
(3 years ago)
Wordpress malicious attack:[octa404]
Web App Attack
🇺🇸
octageeks.com
2023-09-02 04:14:33
(3 years ago)
Wordpress malicious attack:[octa404]
Web App Attack
🇺🇸
octageeks.com
2023-09-01 04:14:28
(3 years ago)
Wordpress malicious attack:[octa404]
Web App Attack