🇬🇧
Trapper67
2023-05-28 21:01:12
(3 years ago)
Wordpress hacking
Hacking
Web App Attack
🇩🇪
ps-center
2023-05-17 18:45:28
(3 years ago)
MYH: Web Attack GET /wp-content/
Web Spam
Hacking
Bad Web Bot
Web App Attack
🇬🇧
CrystalMaker
2023-05-17 14:36:23
(3 years ago)
Wordpress attack - GET /wordpress; GET /wordpress; GET /wp; GET /wp; GET /blog; GET /blog; GET /new; ...
show more
Wordpress attack - GET /wordpress; GET /wordpress; GET /wp; GET /wp; GET /blog; GET /blog; GET /new; GET /new; GET /old; GET /old; GET /test; GET /test; GET /main; GET /main; GET /testing; GET /testing; GET /wp-content/themes/seotheme/db.php?u; POST /wp-plain.php; POST /ALFA_DATA/alfacgiapi/perl.alfa; POST /ALFA_DATA/alfacgiapi/perl.alfa; GET /wp-content/themes/seotheme/db.php?u; POST /wp-plain.php; GET /upgvteej.php?Fox=d3wL7; GET /wp-content/themes/seotheme/db.php?u; POST /alfacgiapi/perl.alfa; POST /alfacgiapi/perl.alfa; GET /wp-content/themes/seotheme/db.php?u; GET /gxvpnscf.php?Fox=d3wL7
show less
Web App Attack
🇬🇧
David Gebler
2023-05-17 14:00:01
(3 years ago)
20.197.3.65 - - [17/May/2023:14:00:01 +0000] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 404 ...
show more
20.197.3.65 - - [17/May/2023:14:00:01 +0000] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 404 6567 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
20.197.3.65 - - [17/May/2023:14:00:01 +0000] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 404 1228 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
show less
Brute-Force
Web App Attack
🇺🇸
mawan
2023-05-17 04:41:44
(3 years ago)
Suspected of having performed illicit activity on LAX server.
Web App Attack
🇺🇸
sumnone
2023-05-17 02:38:22
(3 years ago)
Wordpress vulnerability probing: Error 404. The requested page (/wp-content/themes/seotheme/db.php) ...
show more
Wordpress vulnerability probing: Error 404. The requested page (/wp-content/themes/seotheme/db.php) was not found
show less
Bad Web Bot
Exploited Host
Web App Attack
🇩🇪
DAILYKANBAN.COM
2023-05-16 20:40:32
(3 years ago)
(mod_security) mod_security (id:1000001) triggered by 20.197.3.65 (IN/India/-): 2 in the last 600 se ...
show more
(mod_security) mod_security (id:1000001) triggered by 20.197.3.65 (IN/India/-): 2 in the last 600 secs (CF_ENABLE); Ports: *; Direction: inout; Trigger: LF_MODSEC; Logs: [Tue May 16 20:40:29.636683 2023] [security2:error] [pid 1729870:tid 23131437811456] [client 20.197.3.65:0] [client 20.197.3.65] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/blog" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "9"] [id "1000001"] [msg "Restricted File Probe"] [data "Matched Data: /blog found within REQUEST_URI"] [severity "CRITICAL"] [tag "paranoia-level/2"] [hostname "magicalmysteryplanttour.group"] [uri "/blog"] [unique_id "ZGPqPenzpNNc2w12HbBU0QAAAA0"]
[Tue May 16 20:40:29.888182 2023] [security2:error] [pid 1729870:tid 23131458823936] [client 20.197.3.65:0] [client 20.197.3.65] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/blog" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec/modsec2.user.conf"] [line "9"] [id "1000001"] [msg "Restricted Fil
show less
Web App Attack
🇺🇸
Donovan_DMC
2023-05-16 20:21:14
(3 years ago)
POST /wp-plain.php - 20.197.3.65 (Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleW ...
show more
POST /wp-plain.php - 20.197.3.65 (Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36)
[php-scanner]: PHP Scanner
show less
Bad Web Bot
Web App Attack
🇩🇪
ps-center
2023-05-16 20:11:57
(3 years ago)
MYH: Web Attack GET /wp-content/themes/seotheme/db.php?u
Web Spam
Hacking
Bad Web Bot
Web App Attack
🇳🇱
CryptoYakari
2023-05-16 16:45:53
(3 years ago)
20.197.3.65 - - [16/May/2023:19:45:50 +0300] "POST /ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.0" 404 325 ...
show more
20.197.3.65 - - [16/May/2023:19:45:50 +0300] "POST /ALFA_DATA/alfacgiapi/perl.alfa HTTP/1.0" 404 3252 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
20.197.3.65 - - [16/May/2023:19:45:50 +0300] "POST /wp-plain.php HTTP/1.0" 404 200 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
20.197.3.65 - - [16/May/2023:19:45:51 +0300] "GET /reowxpok.php?Fox=d3wL7 HTTP/1.0" 404 200 "www.google.com" "Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
20.197.3.65 - - [16/May/2023:19:45:51 +0300] "GET /wp-content/themes/seotheme/db.php?u HTTP/1.0" 404 3252 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHT
...
show less
Web Spam
Blog Spam
Bad Web Bot
Web App Attack
🇺🇸
myagent.site
2023-05-16 15:56:49
(3 years ago)
Blocking for trying to access an exploit file: /wp-plain.php
Hacking
🇺🇸
charmicat
2023-05-16 14:31:17
(3 years ago)
AUTOMATED REPORT - suspicious request from 20.197.3.65: [Tue, 16 May 2023 10:31:17 -0400] GET /wp-co ...
show more
AUTOMATED REPORT - suspicious request from 20.197.3.65: [Tue, 16 May 2023 10:31:17 -0400] GET /wp-content/themes/seotheme/db.php?u HTTP/1.1 Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
show less
Web App Attack
🇺🇸
Donovan_DMC
2023-05-16 13:51:23
(3 years ago)
GET /wp-content/themes/seotheme/db.php?u - 20.197.3.65 (Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bu ...
show more
GET /wp-content/themes/seotheme/db.php?u - 20.197.3.65 (Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36)
[wp-content]: WordPress Content Scanner
[php-scanner]: PHP Scanner
show less
Bad Web Bot
Web App Attack
🇫🇷
oh.mg
2023-05-15 15:10:55
(3 years ago)
(mod_security) mod_security (id:949110) triggered by 20.197.3.65 (IN/India/-): 1 in the last 3600 se ...
show more
(mod_security) mod_security (id:949110) triggered by 20.197.3.65 (IN/India/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon May 15 15:10:49.937645 2023] [:error] [pid 2109441:tid 140487943960320] [client 20.197.3.65:57104] [client 20.197.3.65] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "184"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 10)"] [ver "OWASP_CRS/4.0.0-rc1"] [tag "anomaly-evaluation"] [hostname "oh.mg"] [uri "/wp-plain.php"] [unique_id "ZGJLeb4Dn7RIKZ@cnA9PzwAAABc"], referer: www.google.com
show less
Port Scan
🇺🇸
Donovan_DMC
2023-05-15 13:40:15
(3 years ago)
POST /wp-plain.php - 20.197.3.65 (Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleW ...
show more
POST /wp-plain.php - 20.197.3.65 (Mozilla/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36)
[php-scanner]: PHP Scanner
show less
Bad Web Bot
Web App Attack