|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:212620) triggered by 43.245.119.74 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:212620) triggered by 43.245.119.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 26 22:25:43.359253 2024] [security2:error] [pid 12545:tid 12610] [client 43.245.119.74:36199] [client 43.245.119.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||kettlehill.net|F|2"] [data "Matched Data: <script found within REQUEST_URI: /wp-login.php?login-error=<script>alert(document.domain)</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "kettlehill.net"] [uri "/wp-login.php"] [unique_id "Zx2kpz4Zp7GZDS7DVHfUuAAAAUQ"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:211190) triggered by 43.245.119.74 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:211190) triggered by 43.245.119.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 04 00:12:26.558954 2024] [security2:error] [pid 9526:tid 9526] [client 43.245.119.74:43881] [client 43.245.119.74] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||www.stdavids-media.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /?option=com_helpdeskpro&task=ticket.download_attachment&filename=/../../../../../../../../../../../../etc/passwd&original_filename=AnyFileName.exe"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.stdavids-media.com"] [uri "/"] [unique_id "ZtfeKsvvaqBcT1zjVhOXgwAAAAg"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 43.245.119.74 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 43.245.119.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 27 16:23:30.373843 2024] [security2:error] [pid 5466:tid 5536] [client 43.245.119.74:39895] [client 43.245.119.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htpasswd" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.kettlehill.net"] [uri "/.htpasswd"] [unique_id "ZqVXQvYoJo47UgPCj7zwEQAAAUI"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇩🇪
ps-center
|
|
SS1: Web Attack GET /web/phpmyadmin/scripts/setup.php
|
Web Spam
Hacking
Bad Web Bot
Web App Attack
|
|
|
🇪🇸
10dencehispahard SL
|
|
Unauthorized login attempts [ accesslogs]
|
Brute-Force
|
|
|
🇪🇸
10dencehispahard SL
|
|
Unauthorized login attempts []
|
Brute-Force
|
|
|
🇪🇸
10dencehispahard SL
|
|
Web Attack
|
DDoS Attack
Brute-Force
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 43.245.119.74 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 43.245.119.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 01 06:40:51.926820 2024] [security2:error] [pid 27353:tid 46945076791040] [client 43.245.119.74:53493] [client 43.245.119.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webdisk.staging.kettlehill.com"] [uri "/.env.live"] [unique_id "ZjIcM5ywbXAzCxh1QbjEZQAAAVY"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
Anonymous
|
|
Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK
|
Brute-Force
SSH
|
|
|
🇪🇸
10dencehispahard SL
|
|
Unauthorized login attempts [ BI-16635]
|
Brute-Force
|
|
|
🇪🇸
10dencehispahard SL
|
|
WP scan
|
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 43.245.119.74 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 43.245.119.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Feb 13 18:55:01.946098 2024] [security2:error] [pid 13159:tid 46964593641216] [client 43.245.119.74:49507] [client 43.245.119.74] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whm.staging.kettlehill.com"] [uri "/wp-config.php-backup"] [unique_id "ZcwBVRLdQ7ghlPWmv_jS9gAAAUY"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210730) triggered by 43.245.119.74 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210730) triggered by 43.245.119.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 26 07:32:36.395379 2024] [security2:error] [pid 14884] [client 43.245.119.74:39359] [client 43.245.119.74] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy||mail.stdavids-media.com|F|2"] [data ".conf"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "mail.stdavids-media.com"] [uri "/conf/nginx.conf"] [unique_id "ZbOmZIp2M9YSrHM1eyUmFQAAAAI"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
Anonymous
|
|
Common attack or app scan event detected and blocked
|
Port Scan
Hacking
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:212620) triggered by 43.245.119.74 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:212620) triggered by 43.245.119.74 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 28 18:30:30.404716 2023] [security2:error] [pid 31708:tid 47281315313408] [client 43.245.119.74:33329] [client 43.245.119.74] ModSecurity: Access denied with code 403 (phase 2). Pattern match "<script\\\\b" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/07_XSS_XSS.conf"] [line "65"] [id "212620"] [rev "4"] [msg "COMODO WAF: Cross-site Scripting (XSS) Attack||autodiscover.kettlehill.net|F|2"] [data "Matched Data: <script found within REQUEST_URI: /oauth/idp/logout?post_logout_redirect_uri=<script>console.log(`xss`)</script>"] [severity "CRITICAL"] [tag "CWAF"] [tag "XSS"] [hostname "autodiscover.kettlehill.net"] [uri "/oauth/idp/logout"] [unique_id "ZWZ4Fvhjua4Um2B4ADQ7sgAAANQ"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|