Large-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies G ...
show moreLarge-scale coordinated botnet (8M+ IPs). Ordered by Alexander Pen'kov (alexander-pen-kov-7b41aa6a/Shursky [yordim|LIS|MOW]): Retaliation after theft; Attacker: Mikhail Smirnov (mikhail-smirnov-79830323/Aidan [MOW]): Employed by Angara Technologies Group | Bait Path Attack Blocked: /sendfriend/product/send/id/1167/ | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/123.0.0.0 Safari/537.36 | (Magento Site)
show less
[SatOct1713:25:05.1075952026][security2:error][pid2502763:tid2502797][client59.153.103.53:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\" ...
show more[SatOct1713:25:05.1075952026][security2:error][pid2502763:tid2502797][client59.153.103.53:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"pluriball.ch\"][uri\"/xmlrpc.php\"][unique_id\"atNbEdgeUaL4vjCva9gLnQAAAEA\"]
show less
Repeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=51&topics%5B3%5D=53&topics%5B4%5D=54&topics%5B5%5D=58 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko ...
show moreRepeated requests classified as pathological web bot behavior, for example: /[redacted]?topics%5B0%5D=51&topics%5B3%5D=53&topics%5B4%5D=54&topics%5B5%5D=58 (HTTP/2.0 port 443, user agent: "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0")
show less
[TueOct1321:57:30.0845952026][security2:error][pid1508882:tid1509000][client59.153.103.53:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\" ...
show more[TueOct1321:57:30.0845952026][security2:error][pid1508882:tid1509000][client59.153.103.53:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"ecosuber.com\"][uri\"/xmlrpc.php\"][unique_id\"as6NKkXXpU9Zq9VRli3gEwAAARA\"]
show less
[TueOct0608:18:01.0422122026][security2:error][pid3294000:tid3294014][client59.153.103.53:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\" ...
show more[TueOct0608:18:01.0422122026][security2:error][pid3294000:tid3294014][client59.153.103.53:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"170\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"bestrestmaterassi.ch\"][uri\"/xmlrpc.php\"][unique_id\"asSSmbdD9z2ED9cWM0WCeAAAAAM\"]
show less