|
Anonymous
|
|
2024/08/16 Suspicious 404s, likely probing for vulnerabilities
|
Web App Attack
|
|
|
🇮🇪
RoboSOC
|
|
Joomla Remote Code Execution Vulnerability, PTR: cumbersome-number_n8.aeza.network.
|
Hacking
|
|
|
🇬🇧
WeymouthSC
|
|
Hacking attempt - Drupal user/register
|
Phishing
Hacking
|
|
|
🇪🇸
el-brujo
|
|
16/Aug/2024:11:07:52.893154 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
16/Aug/2024:11:07:52.893154 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 79.137.195.86] ModSecurity: Warning. Matched phrase ".htaccess" at ARGS:name[#markup]. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "98"] [id "930120"] [msg "OS File Access Attempt"] [data "Matched Data: .htaccess found within ARGS:name[#markup]: echo 77u/r0lgodlhowo8p3boccakzxjyb3jfcmvwb3j0aw5nkevfquxmif4grv9ot1rjq0upowply2hvicc8c2nyaxb0pgpkb2n1bwvudc50axrszsa9igf0b2ioilywrkdjrupavuvgvfv5qlzvrxhquvvsrlvnpt0iktskd2luzg93lmfkzev2zw50tglzdgvuzxioikrptunvbnrlbnrmb2fkzwqilgz1bmn0aw9ukcl7bgv0igu9zg9jdw1lbnquy3jlyxrlrwxlbwvudcgizm9ybsipo2uubwv0ag9kpsjwb3n0iixllmvuy3r5cgu9im11bhrpcgfydc9mb3jtlwrhdgeio2xldcb0pwrvy3vtzw50lmnyzwf0zuvszw1lbnqoimluchv0iik7dc50exblpsjmawxliix0lm5hbwu9imzpbguilhqucmvxdwl..."] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "p
...
show less
|
Hacking
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 79.137.195.86 (cumbersome-number_n8.aeza.networ ...
show more
(mod_security) mod_security (id:225170) triggered by 79.137.195.86 (cumbersome-number_n8.aeza.network): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 16 03:54:43.464637 2024] [security2:error] [pid 2566580:tid 2566580] [client 79.137.195.86:58146] [client 79.137.195.86] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||iee-usa.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "iee-usa.com"] [uri "/blogs/wp-json/wp/v2/users/1"] [unique_id "Zr8Fw5s6qtiByq8Iq5qLbgAAAAE"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇪🇸
el-brujo
|
|
16/Aug/2024:09:27:19.214875 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
16/Aug/2024:09:27:19.214875 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 79.137.195.86] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "178"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "812"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "elhacker.info"] [uri "/Cursos/node/1"] [unique_id "Zr7_V8jWfw7LHb-XqI1z_gABXhA"]
...
show less
|
Hacking
Web App Attack
|
|
|
🇪🇸
el-brujo
|
|
16/Aug/2024:07:30:09.510484 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
16/Aug/2024:07:30:09.510484 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 79.137.195.86] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "178"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "812"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "elhacker.info"] [uri "/Cursos/node/1"] [unique_id "Zr7j4cjWfw7LHb-XqI0JIAABbAM"]
...
show less
|
Hacking
Web App Attack
|
|
|
🇪🇸
el-brujo
|
|
16/Aug/2024:06:05:44.787581 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
16/Aug/2024:06:05:44.787581 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 79.137.195.86] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "178"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "812"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "elhacker.info"] [uri "/Cursos/node/1"] [unique_id "Zr7QGLOqKubxPIAJH_yzhQAAVwA"]
...
show less
|
Hacking
Web App Attack
|
|
|
🇪🇸
el-brujo
|
|
16/Aug/2024:04:27:13.434415 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
16/Aug/2024:04:27:13.434415 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 79.137.195.86] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "178"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "812"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "elhacker.info"] [uri "/Cursos/node/1"] [unique_id "Zr65AVia5FWUjnC7twH9XwABFTg"]
...
show less
|
Hacking
Web App Attack
|
|
|
Anonymous
|
|
Ports: 80,443; Direction: 0; Trigger: LF_MODSEC
|
Brute-Force
SSH
|
|
|
🇪🇸
el-brujo
|
|
16/Aug/2024:02:35:32.139934 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ...
show more
16/Aug/2024:02:35:32.139934 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 79.137.195.86] ModSecurity: Warning. Match of "rx ^0?$" against "REQUEST_HEADERS:Content-Length" required. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "178"] [id "920170"] [msg "GET or HEAD Request with Body Content"] [data "812"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/210/272"] [hostname "elhacker.info"] [uri "/Cursos/node/1"] [unique_id "Zr6e1CX4HEaQgA7WcVWjSAAAax0"]
...
show less
|
Hacking
Web App Attack
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:225170) triggered by 79.137.195.86 (cumbersome-number_n8.aeza.networ ...
show more
(mod_security) mod_security (id:225170) triggered by 79.137.195.86 (cumbersome-number_n8.aeza.network): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 15 20:19:04.594699 2024] [security2:error] [pid 32056:tid 32056] [client 79.137.195.86:56186] [client 79.137.195.86] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||phuket-boatcharter.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "phuket-boatcharter.com"] [uri "/blog/wp-json/wp/v2/users/1"] [unique_id "Zr6a-PKSL2p6UTl9JcJZ7gAAAAY"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
Anonymous
|
|
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
|
Brute-Force
SSH
|
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:234930) triggered by 79.137.195.86 (cumbersome-number_n8.aeza.networ ...
show more
(mod_security) mod_security (id:234930) triggered by 79.137.195.86 (cumbersome-number_n8.aeza.network): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Aug 15 19:55:38.173377 2024] [security2:error] [pid 4012:tid 4012] [client 79.137.195.86:58174] [client 79.137.195.86] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\/lib\\\\/php\\\\/connector\\\\.minimal\\\\.php$" at REQUEST_FILENAME. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/27_Apps_WPPlugin.conf"] [line "6778"] [id "234930"] [rev "2"] [msg "COMODO WAF: File upload vulnerability in the file manager plugin before 6.9 for WordPress (CVE-2020-25213)||www.comobarbershop.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WPPlugin"] [hostname "www.comobarbershop.com"] [uri "/uncategorized/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "Zr6VerBuaicV5tMf752j5wAAAAU"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
|
🇧🇪
cmbplf
|
|
4.258 requests to */xmlrpc.php
|
Brute-Force
Bad Web Bot
|
|