Activity: Web Bot activity scanning for exposed endpoints
Action: Blocked by firewall
Access Log E ...
show moreActivity: Web Bot activity scanning for exposed endpoints
Action: Blocked by firewall
Access Log Entries:
• [03/Jun/2025:03:26:34 +0000] "GET /actuator/health HTTP/1.1" 400 150 "-" "Mozilla/5.0 zgrab/0.x" "-"
show less
Activity: Web Bot activity detected from user agent 'Mozilla/5.0 zgrab/0.x', indicating potential we ...
show moreActivity: Web Bot activity detected from user agent 'Mozilla/5.0 zgrab/0.x', indicating potential web scraping or automated scanning.
Action: Blocked by firewall
Access Log Entries:
• [03/Jun/2025:02:34:06 +0000] "GET / HTTP/1.1" 400 150 "-" "Mozilla/5.0 zgrab/0.x" "-"
show less
Activity: Port scan attempt targeting web management interface
Action: Blocked by firewall
Access ...
show moreActivity: Port scan attempt targeting web management interface
Action: Blocked by firewall
Access Log Entries:
• [03/Jun/2025:07:01:09 +0000] "GET /squid-internal-mgr/cachemgr.cgi HTTP/1.1" 400 150 "-" "Mozilla/5.0 zgrab/0.x" "-"
show less
Activity: Normal web activity, port scan attempts, potential SQL injection, exploit attempts, and we ...
show moreActivity: Normal web activity, port scan attempts, potential SQL injection, exploit attempts, and web application attacks
Action: Blocked by firewall
Access Log Entries:
• [03/Jun/2025:23:07:24 +0000] "x16x03x01x00ux01x00x00qx03x03xDB:x96x05`xE1xE5pxB2xEBx90u7x901xAF>4wx8El~0UxA5x84" 400 150 "-" "-" "-"
• [03/Jun/2025:23:07:24 +0000] "x16x03x01x00ux01x00x00qx03x03x05vtxD11%7PkxE4xB9xD7xA0,xFCx13xD5xA5xC8Xx9Fg$xAFx0FxF2WxB7x80ZxE5xBAx00x00x1AxC0/xC0+xC0x11xC0x07xC0x13xC0x09xC0x14xC0" 400 150 "-" "-" "-"
• [03/Jun/2025:23:07:24 +0000] "GET /form.html HTTP/1.1" 400 150 "-" "curl/8.1.2" "-"
show less
Port ScanSQL InjectionExploited HostWeb App Attack
Activity: Port scan and potential exploited host activity
Action: Blocked by firewall
Access Log E ...
show moreActivity: Port scan and potential exploited host activity
Action: Blocked by firewall
Access Log Entries:
• [02/Jun/2025:12:28:10 +0000] "GET /autodiscover/autodiscover.json?@zdi/Powershell HTTP/1.1" 400 150 "-" "Mozilla/5.0 zgrab/0.x" "-"
show less
Activity: Web Bot activity attempting to access development server
Action: Blocked by firewall
Acc ...
show moreActivity: Web Bot activity attempting to access development server
Action: Blocked by firewall
Access Log Entries:
• [02/Jun/2025:05:15:41 +0000] "GET /developmentserver/metadatauploader HTTP/1.1" 400 150 "-" "Mozilla/5.0 zgrab/0.x" "-"
show less
Activity: Ping of Death
Action: Blocked by firewall
Access Log Entries:
• [02/Jun/2025:10:33:26 +0 ...
show moreActivity: Ping of Death
Action: Blocked by firewall
Access Log Entries:
• [02/Jun/2025:10:33:26 +0000] "x16x03x01x00Mx01x00x00Ix03x03%yA{@x11mxDEWxF0x96x1DxB9q/xA8xCCxEC<G !x7Fx1AxDB=x7FxF0LVxCDxBF x018!dxB5xCFxC533xEAaxEExE8xE2sxD125ZxCB+PE" 400 150 "-" "-" "-"
show less
Activity: Normal web activity and port scan attempt: It’s like Dutch IPs decided to throw a full‐blo ...
show moreActivity: Normal web activity and port scan attempt: It’s like Dutch IPs decided to throw a full‐blown circus at my reverse‑proxy—endless shenanigans and wild payloads (seriously, who sends an Outlook/SMB mash‑up over HTTP?!)
Action: Blocked by firewall
Access Log Entries:
• [02/Jun/2025:14:41:55 +0000] "238x00ll|'|'|SGFjS2VkX0Q3NUU2QUFB|'|'|WIN-QZN7FJ7D1O|'|'|Administrator|'|'|18-11-28|'|'||'|'|Win 7 Ultimate SP1 x64|'|'|No|'|'|S17|'|'|..|'|'|SW5ib3ggLSBPdXRsb29rIERhdGEgRmlsZSAtIE1pY3Jvc29mdCBPdXRsb29rAA==|'|'|" 400 150 "-" "-" "-"
• [02/Jun/2025:14:41:56 +0000] "GET / HTTP/1.1" 400 154 "http://<host_IP>/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.63 Safari/537.36" "-"
show less
Activity: Port scan attempt with potential SQL injection payload
Action: Blocked by firewall
Acces ...
show moreActivity: Port scan attempt with potential SQL injection payload
Action: Blocked by firewall
Access Log Entries:
• [02/Jun/2025:12:49:11 +0000] "POST /cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh HTTP/1.1" 400 150 "-" "-" "-"
show less
Activity: Normal browsing, port scanning attempt, potential exploit attempt
Action: Blocked by fire ...
show moreActivity: Normal browsing, port scanning attempt, potential exploit attempt
Action: Blocked by firewall
Access Log Entries:
• [02/Jun/2025:16:53:59 +0000] "x16x03x01x00ux01x00x00qx03x03xCCxF0x8Bx93xC4,xEDx0FuMxD2@xBDx00xA7xD8xF2Xx87x9660xxB0x8Ex9BaxDCxFB|?{x00x00x1AxC0/xC0+xC0x11xC0x07xC0x13xC0x09xC0x14xC0" 400 150 "-" "-" "-"
show less