Anonymous
2022-11-24 03:10:40
UTC ·
(3 years ago)
49.12.96.167 - - [24/Nov/2022:09:10:09 +0100] "GET //wp-content/plugins/dzs-zoomsounds/savepng.php?location=a57bze8931.php HTTP/2.0" 444 0 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like G ...
show more
49.12.96.167 - - [24/Nov/2022:09:10:09 +0100] "GET //wp-content/plugins/dzs-zoomsounds/savepng.php?location=a57bze8931.php HTTP/2.0" 444 0 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
49.12.96.167 - - [24/Nov/2022:09:10:10 +0100] "GET //wp-content/plugins/dzs-zoomsounds/a57bze8931.php HTTP/2.0" 444 0 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
49.12.96.167 - - [24/Nov/2022:09:10:11 +0100] "GET /wp-content/plugins/ioptimizations/IOptimizes.php?hamlorszd HTTP/2.0" 444 0 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
49.12.96.167 - - [24/Nov/2022:09:10:12 +0100] "GET /wp-content/plugins/ioptimizations/a57bze8931.php
...
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
2022-11-24 03:07:05
UTC ·
(3 years ago)
Attacks Targeting WordPress Vulnerability
Start: 24/Nov/2022:14:19:09 +0900
End : 24/Nov/2022:14:22:13 +0900
malware (Backdoor:PHP/WebShell!MSR) was detected.
Below is the Apache log of the detection:
49.12.96.167 - - [24/Nov/2022:14:19:23 +09 ...
show more
Attacks Targeting WordPress Vulnerability
Start: 24/Nov/2022:14:19:09 +0900
End : 24/Nov/2022:14:22:13 +0900
malware (Backdoor:PHP/WebShell!MSR) was detected.
Below is the Apache log of the detection:
49.12.96.167 - - [24/Nov/2022:14:19:23 +0900] "POST /wp-content/plugins/ioptimizations/IOptimizes.php?hamlorszd HTTP/1.1" 301 -
49.12.96.167 - - [24/Nov/2022:14:19:38 +0900] "POST /wp-content/plugins/ioptimization/IOptimize.php?rchk HTTP/1.1" 301 -
49.12.96.167 - - [24/Nov/2022:14:19:50 +0900] "POST /wp-content/plugins/wp-engine-module/wp-engine.php HTTP/1.1" 301 -
49.12.96.167 - - [24/Nov/2022:14:20:24 +0900] "POST /wp-content/plugins/cherry-plugin/admin/import-export/upload.php HTTP/1.1" 301 -
49.12.96.167 - - [24/Nov/2022:14:20:39 +0900] "POST /wp-content/plugins/formcraft/file-upload/server/php/ HTTP/1.1" 301 -
show less
Hacking
Web App Attack
🇨🇭
backslash
2022-11-24 02:32:45
UTC ·
(3 years ago)
Bad Web Bot
🇺🇸
octageeks.com
2022-11-24 00:06:06
UTC ·
(3 years ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇩🇪
mxinfra
2022-11-23 23:43:33
UTC ·
(3 years ago)
Fail2Ban triggered by plesk-modsecurity Thu 24 Nov 2022 05:43:33 AM CET
Hacking
Brute-Force
Web App Attack
Anonymous
2022-11-23 23:21:09
UTC ·
(3 years ago)
Attacks websites by trying to access known vulnerables of plugins, brute-force of backends or probing of administrative tools
Brute-Force
Web App Attack
🇧🇷
AC - Team
2022-11-23 22:52:26
UTC ·
(3 years ago)
49.12.96.167 - - [24/Nov/2022:00:52:24 -0300] "GET /wp-content/plugins/wpcargo/includes/barcode.php?text=x1x1111x1xx1xx111xx11111xx1x111x1x1x1xxx11x1111xx1x11xxxx1xx1xxxxx1x1x1xx1x1x11xx1xxxx1x11xx111xxx1xx1xx1x1x1xxx11x1111xxx1xxx1xx1x111xxx1x1xx1xx ...
show more
49.12.96.167 - - [24/Nov/2022:00:52:24 -0300] "GET /wp-content/plugins/wpcargo/includes/barcode.php?text=x1x1111x1xx1xx111xx11111xx1x111x1x1x1xxx11x1111xx1x11xxxx1xx1xxxxx1x1x1xx1x1x11xx1xxxx1x11xx111xxx1xx1xx1x1x1xxx11x1111xxx1xxx1xx1x111xxx1x1xx1xxx1x1x1xx1x1x11xxx11xx1x11xx111xx1xxx1xx11x1x11x11x1111x1x11111x1x1xxxx&sizefactor=.090909090909&size=1&filepath=../../../x.php HTTP/2.0" 404 531 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
...
show less
Exploited Host
Web App Attack
🇩🇪
eminovic.ba
2022-11-23 22:37:03
UTC ·
(3 years ago)
BRUTE FORCE: Excessive 404 hits
...
Hacking
Brute-Force
Web App Attack
🇸🇮
dsmidge
2022-11-23 22:04:29
UTC ·
(3 years ago)
ljubimkozmetiko.si:80 49.12.96.167 - - [24/Nov/2022:04:03:31 +0100] "POST /wp-admin/admin-ajax.php?action=uploadFontIcon HTTP/1.1" 301 581 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like G ...
show more
ljubimkozmetiko.si:80 49.12.96.167 - - [24/Nov/2022:04:03:31 +0100] "POST /wp-admin/admin-ajax.php?action=uploadFontIcon HTTP/1.1" 301 581 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
ljubimkozmetiko.si:443 49.12.96.167 - - [24/Nov/2022:04:03:32 +0100] "GET /wp-admin/admin-ajax.php?action=uploadFontIcon HTTP/1.1" 400 5788 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
ljubimkozmetiko.si:80 49.12.96.167 - - [24/Nov/2022:04:03:52 +0100] "POST /wp-admin/admin-ajax.php HTTP/1.1" 301 537 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36"
ljubimkozmetiko.si:443 49.12.96.167 - - [24/Nov/2022:04:03:52 +0100] "GET /wp-admin/admi
...
show less
Web App Attack
🇩🇪
dwmp
2022-11-23 13:06:06
UTC ·
(3 years ago)
[Wed Nov 23 19:06:01.471576 2022] [authz_core:error] [pid 3602794:tid 139849810306816] [client 49.12.96.167:63858] AH01630: client denied by server configuration: /var/www/vhosts/advgroups.it/httpdocs/wp-content/plugins/wp-time-capsule, referer: http ...
show more
[Wed Nov 23 19:06:01.471576 2022] [authz_core:error] [pid 3602794:tid 139849810306816] [client 49.12.96.167:63858] AH01630: client denied by server configuration: /var/www/vhosts/advgroups.it/httpdocs/wp-content/plugins/wp-time-capsule, referer: https://www.google.com
[Wed Nov 23 19:06:02.622994 2022] [authz_core:error] [pid 3602794:tid 139849411577600] [client 49.12.96.167:50078] AH01630: client denied by server configuration: /var/www/vhosts/advgroups.it/httpdocs/wp-content/plugins/themegrill-demo-importer, referer: https://www.google.com
[Wed Nov 23 19:06:03.767873 2022] [authz_core:error] [pid 3602793:tid 139849705191168] [client 49.12.96.167:50086] AH01630: client denied by server configuration: /var/www/vhosts/advgroups.it/httpdocs/wp-content/plugins/advanced-import, referer: https://www.google.com
[Wed Nov 23 19:06:04.883087 2022] [authz_core:error] [pid 3602793:tid 139849529009920] [client 49.12.96.167:54749] AH01630: client denied by server configuration: /var/www/vhosts/advgr
...
show less
Brute-Force
🇺🇦
URAN Publishing Service
2022-11-23 11:56:30
UTC ·
(3 years ago)
49.12.96.167 - - [23/Nov/2022:18:56:29 +0200] "GET /wp-content/plugins/iwp-client/readme.txt HTTP/1.1" 404 274 "https://www.google.com" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/53 ...
show more
49.12.96.167 - - [23/Nov/2022:18:56:29 +0200] "GET /wp-content/plugins/iwp-client/readme.txt HTTP/1.1" 404 274 "https://www.google.com" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇺🇸
WebpodsLLC
2022-11-23 10:20:43
UTC ·
(3 years ago)
Direction: in Trigger: LF_MODSEC;
Port Scan
Brute-Force
Web App Attack
Anonymous
2022-11-23 10:16:09
UTC ·
(3 years ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 49.12.96.167 (DE/Germany/static.167.96.12.49.clients.your-server.de)
Port Scan
🇺🇦
URAN Publishing Service
2022-11-23 07:49:36
UTC ·
(3 years ago)
49.12.96.167 - - [23/Nov/2022:14:49:35 +0200] "GET /wp-content/plugins/iwp-client/readme.txt HTTP/1.1" 404 275 "https://www.google.com" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/53 ...
show more
49.12.96.167 - - [23/Nov/2022:14:49:35 +0200] "GET /wp-content/plugins/iwp-client/readme.txt HTTP/1.1" 404 275 "https://www.google.com" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36"
...
show less
Web App Attack
🇨🇭
Galaxyweb AG
2022-11-23 07:39:18
UTC ·
(3 years ago)
(apache-scanners) Failed apache-scanners trigger with match [redacted] from 49.12.96.167 (DE/Germany/-/-/static.167.96.12.49.clients.your-server.de)
Port Scan