Distributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to ...
show moreDistributed web crawl botnet attack (like Mellowtel), likely illicit scraping of AI training data to bypass firewall/robots.txt restrictions in printer-friendly.asp
show less
[Askari] | Behavior: Slow-read attack, HTTP/1.1 over TLS, Concurrent page load during attack, Target ...
show more[Askari] | Behavior: Slow-read attack, HTTP/1.1 over TLS, Concurrent page load during attack, Targeting specific pages, URL template abuse
show less
[Tue Apr 14 18:19:55.770132 2026] [security2:error] [pid 84564:tid 140202692499136] [client 192.147. ...
show more[Tue Apr 14 18:19:55.770132 2026] [security2:error] [pid 84564:tid 140202692499136] [client 192.147.114.17:58723] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i)(?:^|b[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?u[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0-9\\\\?@_a-\\\\{]*)?\\\\x5c?s[\\"'\\\\)\\\\[\\\\x5c]*(?:(?:(?:\\\\|\\\\||&&)[\\\\s\\\\x0b]*)?\\\\$[!#\\\\(\\\\*\\\\-0- ..." at ARGS_NAMES:id. [file "/etc/modsecurity/coreruleset-4.25.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "3254"] [id "932350"] [msg "Remote Command Execution: Direct Unix Command Execution (No Arguments)"] [data " Matched Data ARGS charset: - Matched Data TX.1: found within Content-Type multipart form Matched Data: id found within ARGS_NAMES:id: id request_line = GET /index.php/component/search/?Itemid=439&catid=3111&id=3111&format=opensearch HTTP/2.0 Request URI
...
show less