193.32.70.18

Port Scan Attack proto:TCP src:1390 dst:23

Port Scan on Honeypot | Ports: 23/Telnet | Proto: TCP(1) | Events: 1 | F2B/telnet-honeypot-scan@2026-11-11T07:00:19Z

monitor: on VM-0-7-ubuntu | port: 38890 | ttl: 251 script: github.com/sefinek/UFW-AbuseIPDB-Reporter

Bad web bot: Spoofed/obsolete UA (Mozilla/5.0 (compatible; MSIE 7.0; Windows NT 11.0; Trident/5.1)). Mass-scanning WordPress plugin. Coordinated large-scale bot attack.

1 attack(s) detected, such as these: {"event":"nginx_block","ip":"193.32.70.18","host":"ns.big.marche-be.com","request":"GET /adminer.php HTTP/1.1","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/ ... show more 1 attack(s) detected, such as these: {"event":"nginx_block","ip":"193.32.70.18","host":"ns.big.marche-be.com","request":"GET /adminer.php HTTP/1.1","user_agent":"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36","reason":"404","timestamp":"2025-10-22T12:09:50 00:00","logentry":"ns.big.marche-be.com 193.32.70.18 - - [22/Oct/2025:12:09:50 0000] GET /adminer.php HTTP/1.1 404 0 - Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36 172.25.79.41:5380 matched:-"} * Report Details *: https://p4u.xyz/5W5NWLY5Q3R/1* IP Details *: https://p4u.xyz/5W5NWLY5Q3R/2 show less

[Tue Oct 21 21:05:54.764839 2025] [php7:error] [pid 1043318] [client 193.32.70.18:36018] script '/var/www/html/campus-perpignan/mah.php' not found or unable to stat [Tue Oct 21 21:05:54.799187 2025] [php7:error] [pid 1042291] [client 193.32.70.18:372 ... show more [Tue Oct 21 21:05:54.764839 2025] [php7:error] [pid 1043318] [client 193.32.70.18:36018] script '/var/www/html/campus-perpignan/mah.php' not found or unable to stat [Tue Oct 21 21:05:54.799187 2025] [php7:error] [pid 1042291] [client 193.32.70.18:37284] script '/var/www/html/campus-perpignan/goods.php' not found or unable to stat [Tue Oct 21 21:05:55.291752 2025] [php7:error] [pid 1042155] [client 193.32.70.18:36881] script '/var/www/html/campus-perpignan/chosen.php' not found or unable to stat [Tue Oct 21 21:07:18.667223 2025] [php7:error] [pid 1042977] [client 193.32.70.18:37359] script '/var/www/html/campus-perpignan/mah.php' not found or unable to stat [Tue Oct 21 21:07:18.691727 2025] [php7:error] [pid 1042305] [client 193.32.70.18:37270] script '/var/www/html/campus-perpignan/chosen.php' not found or unable to stat ... show less

wordpress-trap

Vulnerability Probe

379 requests with url.path */wp-content/plugins/litespeed-cache/readme.txt

Triggered Cloudflare WAF (firewallCustom) from UA. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /i.php UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 OP ... show more Triggered Cloudflare WAF (firewallCustom) from UA. Action taken: MANAGED_CHALLENGE Protocol: HTTP/1.1 (GET method) Endpoint: /i.php UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/137.0.0.0 Safari/537.36 OPR/121.0.0.0 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less

(mod_security) mod_security (id:234930) triggered by 193.32.70.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 14 14:14:12.701534 2025] [security2:error] [pid 7085:tid 7085] [client 193.32.70.18:36944] ModSe ... show more (mod_security) mod_security (id:234930) triggered by 193.32.70.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 14 14:14:12.701534 2025] [security2:error] [pid 7085:tid 7085] [client 193.32.70.18:36944] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\/lib\\\\/php\\\\/connector\\\\.minimal\\\\.php$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/27_Apps_WPPlugin.conf"] [line "6778"] [id "234930"] [rev "2"] [msg "COMODO WAF: File upload vulnerability in the file manager plugin before 6.9 for WordPress (CVE-2020-25213)||mobi-app-licious.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WPPlugin"] [hostname "mobi-app-licious.com"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "aO6S9IC8YhYZKO-p2MBZ5QAAABo"] show less

(mod_security) mod_security (id:234930) triggered by 193.32.70.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 14 07:20:50.070514 2025] [security2:error] [pid 32332:tid 32332] [client 193.32.70.18:36024] Mod ... show more (mod_security) mod_security (id:234930) triggered by 193.32.70.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 14 07:20:50.070514 2025] [security2:error] [pid 32332:tid 32332] [client 193.32.70.18:36024] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\/lib\\\\/php\\\\/connector\\\\.minimal\\\\.php$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/27_Apps_WPPlugin.conf"] [line "6778"] [id "234930"] [rev "2"] [msg "COMODO WAF: File upload vulnerability in the file manager plugin before 6.9 for WordPress (CVE-2020-25213)||chickiesbeef.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WPPlugin"] [hostname "chickiesbeef.com"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "aO4yEubeRSUqKqdLAD674AAAAAo"] show less

Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 24

(mod_security) mod_security (id:234930) triggered by 193.32.70.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 14 03:14:36.295122 2025] [security2:error] [pid 15322:tid 15322] [client 193.32.70.18:37353] Mod ... show more (mod_security) mod_security (id:234930) triggered by 193.32.70.18 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 14 03:14:36.295122 2025] [security2:error] [pid 15322:tid 15322] [client 193.32.70.18:37353] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\/lib\\\\/php\\\\/connector\\\\.minimal\\\\.php$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/27_Apps_WPPlugin.conf"] [line "6778"] [id "234930"] [rev "2"] [msg "COMODO WAF: File upload vulnerability in the file manager plugin before 6.9 for WordPress (CVE-2020-25213)||hid.ficklepassionproductions.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WPPlugin"] [hostname "hid.ficklepassionproductions.com"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "aO34XJm5uoTlM9ZgL9YMowAAAAU"] show less

Too many Status 40X (13)