IP 84.82.132.96 performed automated SQL injection against pkeywords.
Techniques used:
PostgreS ...
show moreIP 84.82.132.96 performed automated SQL injection against pkeywords.
Techniques used:
PostgreSQL-style probing (GENERATE_SERIES)
Boolean-based extraction (CASE WHEN)
Type casting to NUMERIC
RCE-pattern trigger (|| SELECT)
This indicates automated multi-database scanning.
show less
Blog SpamHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App Attack
IP 94.160.195.116 performed automated SQL injection against pfull.
Techniques used:
Boolean-ba ...
show moreIP 94.160.195.116 performed automated SQL injection against pfull.
Techniques used:
Boolean-based extraction (CASE WHEN)
Array-based SQL probing (ANY(ARRAY(SELECT...)))
Type casting (CAST(... AS INTEGER))
RCE-pattern signatures (|| SELECT)
Anomaly score reached 5–10.
show less
Fraud OrdersPhishingWeb SpamBlog SpamHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App Attack
IP 190.142.171.91 performed aggressive automated SQL injection and RCE-style testing against pshort ...
show moreIP 190.142.171.91 performed aggressive automated SQL injection and RCE-style testing against pshort and pkeywords.
Techniques used:
Boolean-based SQLi (CASE WHEN)
Error-based extraction using CAST(... AS XML)
Enumeration via INFORMATION_SCHEMA.PLUGINS
MySQL comment bypass (/*!50000*/)
Database fingerprinting attempts
RCE signature patterns (|| SELECT)
Anomaly score reached 25 (highly malicious).
show less
Fraud OrdersHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App Attack
IP 41.100.140.63 performed advanced automated attacks against pfull and subcats, including:
SQL i ...
show moreIP 41.100.140.63 performed advanced automated attacks against pfull and subcats, including:
SQL injection (boolean-based CASE WHEN, SELECT)
Error-based extraction (UPDATEXML, PROCEDURE ANALYSE)
MySQL comment bypass (/*!50000*/)
RCE-style payload patterns (|| SELECT, command injection signatures)
Goal: extract database data and test for remote command execution.
show less
Fraud OrdersDDoS AttackWeb SpamHackingSQL InjectionBad Web BotExploited HostWeb App Attack
What it tried:
IP 66.181.177.24 performed automated SQL injection against pkeywords.
It used:
B ...
show moreWhat it tried:
IP 66.181.177.24 performed automated SQL injection against pkeywords.
It used:
Boolean-based injection (IF(... ))
MySQL versioned comment bypass (/*!50000SELECT*/)
Data extraction tests using ELT(x=x,1)
Large-number overflow trick (8446744073709551610)
Goal: confirm injection and extract database data.
show less
DDoS AttackPhishingWeb SpamBlog SpamHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App Attack
What 82.18.254.156 Tried
This was an automated SQL injection attack targeting:
subcats
pnam ...
show moreWhat 82.18.254.156 Tried
This was an automated SQL injection attack targeting:
subcats
pname
Techniques used:
Boolean-based injection (IF(..., large_number, large_number))
MySQL versioned comment bypass (/*!50000AND*/)
Error-based extraction using UPDATEXML()
Data extraction via ELT(x=x,1)
Attempted XML error leakage (UPDATEXML, CONCAT)
Goal:
Force database errors to extract data or confirm injection vulnerability.
show less
DDoS AttackPhishingWeb SpamHackingSQL InjectionSpoofingBrute-ForceBad Web BotExploited HostWeb App AttackSSH
P 152.58.33.132 performed automated SQL injection attempts against search parameters (pkeywords, sea ...
show moreP 152.58.33.132 performed automated SQL injection attempts against search parameters (pkeywords, search_performed).
It used:
INFORMATION_SCHEMA enumeration
MySQL versioned comments (/*!50000SELECT*/)
Error-based extraction (PROCEDURE ANALYSE, EXTRACTVALUE)
Boolean-based testing (ELT(x=x,1))
Goal: extract database structure or data.
show less
DDoS AttackWeb SpamHackingSQL InjectionBrute-ForceBad Web BotExploited HostWeb App Attack
Subject: SQL Injection Attack from 196.92.246.7
Hello,
We detected multiple automated SQL inje ...
show moreSubject: SQL Injection Attack from 196.92.246.7
Hello,
We detected multiple automated SQL injection attempts originating from IP address 196.92.246.7 on February 28, 2026 around 06:31 UTC.
The attacker attempted database enumeration using INFORMATION_SCHEMA and MySQL inline comment obfuscation (/*!50000SELECT*/). The requests were blocked by ModSecurity (OWASP CRS), and no compromise occurred.
Please investigate this abusive activity originating from your network and take appropriate action.
Relevant log excerpts can be provided upon request.
show less
1️⃣ What The Attacker Tried
Targeted parameters:
ARGS:pname
ARGS:pcode_from_q
Those are GE ...
show more1️⃣ What The Attacker Tried
Targeted parameters:
ARGS:pname
ARGS:pcode_from_q
Those are GET/POST parameters in your CS-Cart search / product logic.
Example payload:
Y'+(SELECT 'KALWT0Xa' WHERE 5660=5660
AND JSON_KEYS((SELECT CONVERT(
(SELECT CONCAT('~',(SELECT (ELT(10063=10063,1))),'~'))
USING utf8))))
+'
What this means:
They attempted:
SELECT
CASE WHEN
ELT()
JSON_KEYS()
CAST()
inline comments /*!50000AND*/
PostgreSQL-style ::text
numeric casting
This is classic:
Boolean-based blind SQL injection testing
They are checking:
IF 1578=1578 THEN 1 ELSE 0
If your site responds differently → database is injectable.
2️⃣ Why JSON_KEYS?
Modern scanners use JSON functions to:
bypass simple filters
fingerprint MySQL version
test advanced function availability
/*!50000 ... */
means:
"Execute only if MySQL version >= 5.0.0"
That confirms:
They assume you're running MySQL/MariaDB (which CS-Cart does).
show less
serious automated SQL injection attack from Philippines (Converge ICT). What they were doing:
Attac ...
show moreserious automated SQL injection attack from Philippines (Converge ICT). What they were doing:
Attack type: Microsoft SQL Server blind SQLi using CONVERT(INT, ...) technique — trying to extract data by converting strings to integers and measuring error responses.
Examples of what they tried:
sqlY,(SELECT/**/10105/**/WHERE/**/10105=CONVERT(INT,(SELECT/**/'~'+...+'~')))#
Y,(SELECT/**/8655/**/WHERE/**/8655=CONVERT(INT,...))) AND (((6796=6796
How it works:
Injecting into the pshort search parameter
Using /**/ to bypass space filters
Random numbers to evade detection
Testing if the database returns different responses to extract data bit by bit
show less
Classic WordPress hack attempt! IP 20.151.11.236 tried to access /wp-admin/images/wp-conflg.php — no ...
show moreClassic WordPress hack attempt! IP 20.151.11.236 tried to access /wp-admin/images/wp-conflg.php — note the fake wp-conflg.php (with letter l instead of i in "config"). This is a well-known PHP webshell upload technique targeting WordPress sites.
show less
DDoS AttackPhishingWeb SpamHackingSpoofingBrute-ForceBad Web BotExploited HostWeb App Attack
Subject: SQL Injection Attack from IP 38.137.48.65
We have detected a SQL injection attack originat ...
show moreSubject: SQL Injection Attack from IP 38.137.48.65
We have detected a SQL injection attack originating from IP address 38.137.48.65 targeting our web server at domatengineering.com on February 27, 2026 at approximately 16:45 UTC.
The attacker sent a crafted Oracle SQL injection payload via an HTTP GET request attempting to exploit our search functionality:
DBMS_UTILITY.SQLID_TO_SQLHASH(CHR(126)||'~'||(SELECT/**/(CASE/**/WHEN/**/(4839=4839)/**/THEN/**/1/**/ELSE/**/0/**/END)/**/FROM/**/DUAL)
Attack type: SQL Injection + Remote Command Execution attempt
Target: /index.php?dispatch=products.search
Source IP: 38.137.48.65
Date/Time: 2026-02-27 ~16:45 UTC
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
Result: Blocked by ModSecurity (OWASP CRS rules 942100, 932115, 933160)
Please investigate and take appropriate action against this IP address.
show less
HackingSQL InjectionBrute-ForceBad Web BotExploited Host
this host is used as dropper to host prestashop installations, probabyl corrupted, reverse shell pro ...
show morethis host is used as dropper to host prestashop installations, probabyl corrupted, reverse shell probably opened to to this host
show less
DDoS AttackPort ScanHackingSQL InjectionSpoofingBad Web BotExploited HostWeb App AttackSSHIoT Targeted
this host is used as dropper to host prestashop installations, probabyl corrupted, reverse shell pro ...
show morethis host is used as dropper to host prestashop installations, probabyl corrupted, reverse shell probably opened to to this host
show less