🇩🇪
Egon Bart
2024-01-09 10:00:00
(2 years ago)
Cisco ASA SSL VPN bruteforcing/exploting
DDoS Attack
FTP Brute-Force
VPN IP
Port Scan
Hacking
Brute-Force
Exploited Host
Web App Attack
🇫🇷
Kenshin869
2023-12-29 12:18:04
(2 years ago)
Wordpress unauthorized access attempt
Brute-Force
🇩🇪
FeG Deutschland
2023-12-28 22:38:05
(2 years ago)
Looking for CMS/PHP/SQL vulnerablilities
Exploited Host
Web App Attack
🇩🇪
niceshops.com
2023-12-28 13:01:53
(2 years ago)
Web Attack multi (Dec 23 14:01:53 Matching rules: Detect possible SQL injection - E.g. Select * fro ...
show more
Web Attack multi (Dec 23 14:01:53 Matching rules: Detect possible SQL injection - E.g. Select * from )
show less
SQL Injection
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
niceshops.com
2023-12-27 07:42:53
(2 years ago)
Web Attack multi (Dec 23 08:42:53 Matching rules: Detect possible SQL injection - Too many SQL keyw ...
show more
Web Attack multi (Dec 23 08:42:53 Matching rules: Detect possible SQL injection - Too many SQL keywords (more than 3 times),Detect possible SQL injection - E.g. CHR(72),Detect possible SQL injection - E.g. Select * from )
show less
SQL Injection
Brute-Force
Bad Web Bot
Web App Attack
🇲🇾
Rizzy
2023-12-26 08:27:03
(2 years ago)
Multiple WAF Violations
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2023-12-25 22:09:38
(2 years ago)
(mod_security) mod_security (id:225170) triggered by 194.233.74.31 (tor-exit-router-a28.quido.org): ...
show more
(mod_security) mod_security (id:225170) triggered by 194.233.74.31 (tor-exit-router-a28.quido.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 25 17:09:31.633109 2023] [security2:error] [pid 2040] [client 194.233.74.31:50036] [client 194.233.74.31] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.rodandreelpiercam.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.rodandreelpiercam.com"] [uri "/wp-json/wp/v2/users/4"] [unique_id "ZYn9m1YFqEdP7oW0XRSyJAAAAA0"], referer: https://www.rodandreelpiercam.com/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
niceshops.com
2023-12-25 13:58:49
(2 years ago)
Web Attack multi (Dec 23 14:58:49 Matching rules: Detect possible SQL injection - E.g. Select * fro ...
show more
Web Attack multi (Dec 23 14:58:49 Matching rules: Detect possible SQL injection - E.g. Select * from )
show less
SQL Injection
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2023-12-25 10:41:04
(2 years ago)
Looking for CMS/PHP/SQL vulnerablilities
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2023-12-25 09:12:27
(2 years ago)
(mod_security) mod_security (id:210831) triggered by 194.233.74.31 (tor-exit-router-a28.quido.org): ...
show more
(mod_security) mod_security (id:210831) triggered by 194.233.74.31 (tor-exit-router-a28.quido.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 25 04:12:23.404218 2023] [security2:error] [pid 20188] [client 194.233.74.31:33464] [client 194.233.74.31] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:(?:^(?:microsoft url|user-Agent|www\\\\.weblogs\\\\.com|(?:jakart|vi)a|(google|i{0,1}explorer{0,1}\\\\.exe|(ms){0,1}ie( [0-9.]{1,}){0,1} {0,1}(compatible( browser){0,1}){0,1})$)|\\\\bdatacha0s\\\\b|; widows|\\\\\\\\r|a(?: href=|d(?:sarobot|vanced email extractor ..." at REQUEST_HEADERS:User-Agent. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/03_Global_Agents.conf"] [line "29"] [id "210831"] [rev "2"] [msg "COMODO WAF: Rogue web site crawler||www.consultmonarch.com|F|4"] [data "panscient.com"] [severity "WARNING"] [tag "CWAF"] [tag "Agents"] [hostname "www.consultmonarch.com"] [uri "/robots.txt"] [unique_id "ZYlHdzl2IJNH29FM2SjKmwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2023-12-25 06:23:06
(2 years ago)
(mod_security) mod_security (id:210492) triggered by 194.233.74.31 (tor-exit-router-a28.quido.org): ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.74.31 (tor-exit-router-a28.quido.org): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 25 01:23:00.447296 2023] [security2:error] [pid 16896] [client 194.233.74.31:54630] [client 194.233.74.31] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lilpiggiescardgame.com"] [uri "/wp-content/themes/NativeChurch/download/download.php"] [unique_id "ZYkfxHuFE1eH66hdhkZ7ywAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
MAGIC
2023-12-24 03:05:12
(2 years ago)
VM1 Bad user agents ignoring web crawling rules. Draing bandwidth
DDoS Attack
Bad Web Bot
2023-12-23 07:30:01
(2 years ago)
| Multiple common web attacks from same source ip. (multiple servers)
Hacking
SQL Injection
Web App Attack
🇺🇸
rsiddall
2023-12-22 00:19:49
(2 years ago)
194.233.74.31 - - [21/Dec/2023:19:19:48 -0500] "POST /xmlrpc.php HTTP/1.1" 403 1809 "-" "Mozilla/5.0 ...
show more
194.233.74.31 - - [21/Dec/2023:19:19:48 -0500] "POST /xmlrpc.php HTTP/1.1" 403 1809 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0"
194.233.74.31 - - [21/Dec/2023:19:19:48 -0500] "POST /xmlrpc.php HTTP/1.1" 403 1809 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0"
...
show less
Brute-Force
🇩🇪
sverson
2023-12-21 06:52:35
(2 years ago)
Vulnerability probe of page
Hacking