Multiple firewall blocks events from same source.
Aug 16 08:02:41 firewall filterlog[11288]: 4,,,100 ...
show moreMultiple firewall blocks events from same source.
Aug 16 08:02:41 firewall filterlog[11288]: 4,,,1000000103,*REDACTED*,match,block,in,4,0x0,,250,37361,0,none,6,tcp,40,79.124.40.114,*REDACTED*,40508,5554,0,S,2271145782,,1024,,
show less
Multiple firewall blocks events from same source.
Aug 16 06:46:55 firewall filterlog[11288]: 4,,,100 ...
show moreMultiple firewall blocks events from same source.
Aug 16 06:46:55 firewall filterlog[11288]: 4,,,1000000103,*REDACTED*,match,block,in,4,0x0,,250,42256,0,none,6,tcp,40,79.124.40.114,*REDACTED*,40508,51335,0,S,1056311010,,1024,,
show less
Dropbear: Bad password attempt.
Aug 16 06:40:37 *REDACTED* dropbear[19849]: Bad password attempt fo ...
show moreDropbear: Bad password attempt.
Aug 16 06:40:37 *REDACTED* dropbear[19849]: Bad password attempt for 'root' from 83.248.189.195:53034
show less
Looking for json file on web server
34.44.102.146 - - [16/Aug/2026:06:37:20 +0200] "GET /sellers.jso ...
show moreLooking for json file on web server
34.44.102.146 - - [16/Aug/2026:06:37:20 +0200] "GET /sellers.json HTTP/2.0" 404 775 "https://*REDACTED*/adatkezelesi-tajekoztato" "Mozilla/5.0 (Linux; Android 8.1.0; Moto G (4)) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/151.0.0.0 Mobile Safari/537.36 PTST/260802.202201"
show less
Probing for .git:
172.68.164.94 - - [16/Aug/2026:06:24:57 +0200] "GET /.git/config HTTP/2.0" 403 548 ...
show moreProbing for .git:
172.68.164.94 - - [16/Aug/2026:06:24:57 +0200] "GET /.git/config HTTP/2.0" 403 548 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
show less
Probing for .git:
172.68.164.95 - - [16/Aug/2026:06:24:57 +0200] "GET /.git/HEAD HTTP/2.0" 403 548 " ...
show moreProbing for .git:
172.68.164.95 - - [16/Aug/2026:06:24:57 +0200] "GET /.git/HEAD HTTP/2.0" 403 548 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/125.0.0.0 Safari/537.36"
show less
Multiple firewall blocks events from same source.
Aug 16 05:40:27 firewall filterlog[11288]: 4,,,100 ...
show moreMultiple firewall blocks events from same source.
Aug 16 05:40:27 firewall filterlog[11288]: 4,,,1000000103,*REDACTED*,match,block,in,4,0x0,,250,62232,0,none,6,tcp,40,79.124.40.114,*REDACTED*,40508,52704,0,S,94786957,,1024,,
show less
Dropbear: Bad password attempt.
Aug 16 04:33:44 *REDACTED* dropbear[28301]: Bad password attempt fo ...
show moreDropbear: Bad password attempt.
Aug 16 04:33:44 *REDACTED* dropbear[28301]: Bad password attempt for 'pi' from 195.123.107.179:64026
show less
Going for WP CVE-2026-63030
104.164.243.62 - - [16/Aug/2026:04:32:43 +0200] "POST /index.php?rest_ro ...
show moreGoing for WP CVE-2026-63030
104.164.243.62 - - [16/Aug/2026:04:32:43 +0200] "POST /index.php?rest_route=/batch/v1 HTTP/1.1" 403 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:131.0) Gecko/20100101 Firefox/131.0"
show less
Suricata: Alert - ET WEB_SERVER Possible Attempt to Get SQL Server Version in URI using SELECT VERSI ...
show moreSuricata: Alert - ET WEB_SERVER Possible Attempt to Get SQL Server Version in URI using SELECT VERSION
show less
Multiple firewall blocks events from same source.
Aug 16 04:11:07 firewall filterlog[11288]: 4,,,100 ...
show moreMultiple firewall blocks events from same source.
Aug 16 04:11:07 firewall filterlog[11288]: 4,,,1000000103,*REDACTED*,match,block,in,4,0x0,,251,4466,0,none,6,tcp,40,79.124.40.114,*REDACTED*,40508,35293,0,S,183469483,,1024,,
show less
Repeated request on blocked xmlrpc.php.
148.101.154.11 - - [16/Aug/2026:03:49:09 +0200] "POST /xmlrp ...
show moreRepeated request on blocked xmlrpc.php.
148.101.154.11 - - [16/Aug/2026:03:49:09 +0200] "POST /xmlrpc.php HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.5 Safari/605.1.15"
show less