🇪🇸
pipeline.es
2026-11-12 10:08:55
UTC ·
(15 hours ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sat Oct 31 01:36:42.801500 2026] [:error] [pid 2884336] [client 51.158.183.207:35250] [client 51.158.183.207] WAF: Access denied with code 403 (phase 2). Operator GT mat ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sat Oct 31 01:36:42.801500 2026] [:error] [pid 2884336] [client 51.158.183.207:35250] [client 51.158.183.207] WAF: Access denied with code 403 (phase 2). Operator GT matched 0 at TX:php_injection_score. [file \"/etc/httpd/conf.d/zz-WAF-php2shell.conf\"] [line \"17\"] [id \"9261008\"] [msg \"php2shell: inyeccion PHP (CRS 933) en bloqueo\"] [tag \"php2shell\"] [hostname \"vgalapagos.com\"] [uri \"/ | ASN: Scaleway S.a.s. | Country: NL
show less
Web App Attack
🇪🇸
pipeline.es
2026-11-11 08:30:12
UTC ·
(1 day ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sat Oct 31 01:36:42.801500 2026] [:error] [pid 2884336] [client 51.158.183.207:35250] [client 51.158.183.207] WAF: Access denied with code 403 (phase 2). Operator GT mat ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sat Oct 31 01:36:42.801500 2026] [:error] [pid 2884336] [client 51.158.183.207:35250] [client 51.158.183.207] WAF: Access denied with code 403 (phase 2). Operator GT matched 0 at TX:php_injection_score. [file \"/etc/httpd/conf.d/zz-WAF-php2shell.conf\"] [line \"17\"] [id \"9261008\"] [msg \"php2shell: inyeccion PHP (CRS 933) en bloqueo\"] [tag \"php2shell\"] [hostname \"vgalapagos.com\"] [uri \"/ | ASN: Scaleway S.a.s. | Country: NL
show less
Web App Attack
🇪🇸
pipeline.es
2026-11-09 03:09:02
UTC ·
(3 days ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sat Oct 31 01:36:42.801500 2026] [:error] [pid 2884336] [client 51.158.183.207:35250] [client 51.158.183.207] WAF: Access denied with code 403 (phase 2). Operator GT mat ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sat Oct 31 01:36:42.801500 2026] [:error] [pid 2884336] [client 51.158.183.207:35250] [client 51.158.183.207] WAF: Access denied with code 403 (phase 2). Operator GT matched 0 at TX:php_injection_score. [file \"/etc/httpd/conf.d/zz-WAF-php2shell.conf\"] [line \"17\"] [id \"9261008\"] [msg \"php2shell: inyeccion PHP (CRS 933) en bloqueo\"] [tag \"php2shell\"] [hostname \"vgalapagos.com\"] [uri \"/ | ASN: Scaleway S.a.s. | Country: NL
show less
Web App Attack
🇪🇸
pipeline.es
2026-11-08 01:20:46
UTC ·
(4 days ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sat Oct 31 01:36:42.801500 2026] [:error] [pid 2884336] [client 51.158.183.207:35250] [client 51.158.183.207] WAF: Access denied with code 403 (phase 2). Operator GT mat ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sat Oct 31 01:36:42.801500 2026] [:error] [pid 2884336] [client 51.158.183.207:35250] [client 51.158.183.207] WAF: Access denied with code 403 (phase 2). Operator GT matched 0 at TX:php_injection_score. [file \"/etc/httpd/conf.d/zz-WAF-php2shell.conf\"] [line \"17\"] [id \"9261008\"] [msg \"php2shell: inyeccion PHP (CRS 933) en bloqueo\"] [tag \"php2shell\"] [hostname \"vgalapagos.com\"] [uri \"/ | ASN: Scaleway S.a.s. | Country: NL
show less
Web App Attack
🇪🇸
pipeline.es
2026-11-05 13:08:07
UTC ·
(1 week ago)
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sat Oct 31 01:36:42.801500 2026] [:error] [pid 2884336] [client 51.158.183.207:35250] [client 51.158.183.207] WAF: Access denied with code 403 (phase 2). Operator GT mat ...
show more
PHP RCE exploit attempt (php2shell, CVE-2026-109618) blocked by WAF | Evidence: [Sat Oct 31 01:36:42.801500 2026] [:error] [pid 2884336] [client 51.158.183.207:35250] [client 51.158.183.207] WAF: Access denied with code 403 (phase 2). Operator GT matched 0 at TX:php_injection_score. [file \"/etc/httpd/conf.d/zz-WAF-php2shell.conf\"] [line \"17\"] [id \"9261008\"] [msg \"php2shell: inyeccion PHP (CRS 933) en bloqueo\"] [tag \"php2shell\"] [hostname \"vgalapagos.com\"] [uri \"/ | ASN: Scaleway S.a.s. | Country: NL
show less
Web App Attack
🇺🇦
URAN Publishing Service
2026-11-04 18:16:54
UTC ·
(1 week ago)
[04/Nov/2026:20:16:54 +0200] -- 51.158.183.207 Ban reason: User-Agent Python/
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-11-04 15:28:11
UTC ·
(1 week ago)
Blocked abusive HTTP application-layer DoS / botnet traffic from 51.158.183.207: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user hos ...
show more
Blocked abusive HTTP application-layer DoS / botnet traffic from 51.158.183.207: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host.
show less
DDoS Attack
Bad Web Bot
Exploited Host
🇪🇸
Francisco Vallejo
2026-11-04 14:44:03
UTC ·
(1 week ago)
[Wed Nov 04 15:44:02.344263 2026] [security2:error] [pid 131774:tid 131794] [client 51.158.183.207:37058] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-9 ...
show more
[Wed Nov 04 15:44:02.344263 2026] [security2:error] [pid 131774:tid 131794] [client 51.158.183.207:37058] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.8"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "barluna.es"] [uri "/"] [unique_id "autEsi5IIBGNeS5gHYCM5AAAAJI"]
[Wed Nov 04 15:44:02.759398 2026] [security2:error] [pid 131774:tid 131797] [client 51.158.183.207:37064] ModSecurity: Access denied with code 400 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/etc/modsecurity/modsecurity.conf"] [line "93"] [id "200003"] [msg "Multipart request body failed strict validation: PE 0, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM 0, IQ 0, IP 0, IH 0, FL 0"] [hostn
...
show less
Brute-Force
SSH
2026-11-04 13:19:14
UTC ·
(1 week ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
🇨🇭
4server
2026-11-04 13:05:52
UTC ·
(1 week ago)
[WedNov0414:05:46.6136502026][security2:error][pid3427705:tid3427826][client51.158.183.207:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\|finite\)\|n\(\?:u\(\?:meric\|ll\)\| ...
show more
[WedNov0414:05:46.6136502026][security2:error][pid3427705:tid3427826][client51.158.183.207:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\(\?i\)\\\\\\\\b\(\?:i\(\?:s\(\?:_\(\?:in\(\?:t\(\?:eger\)\?\|finite\)\|n\(\?:u\(\?:meric\|ll\)\|an\)\|\(\?:calla\|dou\)ble\|s\(\?:calar\|tring\)\|f\(\?:inite\|loat\)\|re\(\?:source\|al\)\|l\(\?:ink\|ong\)\|a\(\?:rray\)\?\|object\|bool\)\|set\)\|n\(\?:\(\?:clud\|vok\)e\|t\(\?:div\|val\)\)\|\(\?:mplod\|dat\)e\|conv\)\|s\(\?:t\(\?:r\(\?:\(\?:le\|sp\)n\|...\"atARGS:0.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"582\"][id\"380026\"][rev\"27\"][msg\"Atomicorp.comWAFRules:PHPpayloaddetected\"][data\"function\(\'returnimport\(\\\\x5c\\\\x22node:child_process\\\\x5c\\\\x22\)\'\)\(\)\,function\(\'returnimport\(\\\\x5c\\\\x22node:zlib\\\\x5c\\\\x22\)\'\)\(\)]\).then\(\([cp\,zlib]\)=\>{returnnewpromise\(\(resolve\,reject\)=\>{try{varuser_code=global[string.fromcharcode\(66\,117\,102\,102\,101\,114\)].from\(\'286173796e632066756e6374696f6e28297b636f
show less
Hacking
Web App Attack
🇩🇪
FeG Deutschland
2026-11-04 07:08:56
UTC ·
(1 week ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 2
Exploited Host
Web App Attack
🇺🇸
francelink.fr
2026-11-04 00:19:27
UTC ·
(1 week ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-03T04:47:13.000Z.
Web App Attack
🇦🇺
paulshipley.com.au
2026-11-03 06:40:13
UTC ·
(1 week ago)
[Tue Nov 03 17:40:12.042677 2026] [security2:error] [pid 217743] [client 51.158.183.207:34748] [client 51.158.183.207] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/RE ...
show more
[Tue Nov 03 17:40:12.042677 2026] [security2:error] [pid 217743] [client 51.158.183.207:34748] [client 51.158.183.207] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/modsecurity/crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "94"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ccideas.com.au"] [uri "/"] [unique_id "aumBzDT56TrgrLIs6HMmNQAAAAc"]
...
show less
Web App Attack
🇪🇸
el-brujo
2026-11-03 04:30:43
UTC ·
(1 week ago)
03/Nov/2026:05:30:42.759767 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 51.158.183.207] ModSecurity: Rule 5637d6c7d5d0 [id "932105"][file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][ ...
show more
03/Nov/2026:05:30:42.759767 +0100Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 51.158.183.207] ModSecurity: Rule 5637d6c7d5d0 [id "932105"][file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"][line "159"] - Execution error - PCRE limits exceeded (-8): (null). [hostname "elhacker.info"] [uri "/"] [unique_id "auljch4I77vQ8g_qNDeQsQAADPc"]
...
show less
Hacking
Web App Attack
🇺🇸
francelink.fr
2026-11-03 01:06:27
UTC ·
(1 week ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-11-02T21:56:42.000Z.
Web App Attack
