🇺🇸
192.241.220.21
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2023-01-04 15:18:42" vp_time="2023-01-04 14:18:42
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2023-01-04 15:18:42" vp_time="2023-01-04 14:18:42
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=192.241.220.21 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇦🇹
77.73.131.6
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2023-01-03 13:59:36" vp_time="2023-01-03 12:59:36
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2023-01-03 13:59:36" vp_time="2023-01-03 12:59:36
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=77.73.131.6 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇳🇱
167.71.13.19
09 Jan 2023
SSLVPN: id=sslvpn sn=18B169CD281C time="2023-01-03 10:03:16" vp_time="2023-01-03 09:03:16
UTC" fw=x ...
show more
SSLVPN: id=sslvpn sn=18B169CD281C time="2023-01-03 10:03:16" vp_time="2023-01-03 09:03:16
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=167.71.13.19 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Unauthorized Remote File Access"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/jarrewrite.sh rule-match="() { : } echo/bin/bash -c
cat/etc/passwd" AttackCat="Unauthorized Remote File Access" summ="This allows an attacker
to make an unauthorized attempt in downloading a file from a web server" sigid="9009"
category="Information Disclosure--Predictable Resource Location" agent="() { :; }; echo ;
/bin/bash -c 'cat /etc/passwd'"
show less
Hacking
🇺🇸
192.241.194.16
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2023-01-02 16:59:03" vp_time="2023-01-02 15:59:03
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2023-01-02 16:59:03" vp_time="2023-01-02 15:59:03
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=192.241.194.16 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇦🇹
77.73.131.6
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2023-01-02 12:06:36" vp_time="2023-01-02 11:06:36
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2023-01-02 12:06:36" vp_time="2023-01-02 11:06:36
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=77.73.131.6 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇺🇸
192.241.233.11
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2023-01-01 12:42:41" vp_time="2023-01-01 11:42:41
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2023-01-01 12:42:41" vp_time="2023-01-01 11:42:41
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=192.241.233.11 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇦🇹
77.73.131.6
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2023-01-01 01:43:36" vp_time="2023-01-01 00:43:36
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2023-01-01 01:43:36" vp_time="2023-01-01 00:43:36
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=77.73.131.6 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇺🇸
162.243.138.10
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-31 10:18:59" vp_time="2022-12-31 09:18:59
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-31 10:18:59" vp_time="2022-12-31 09:18:59
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=162.243.138.10 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇦🇹
77.73.131.6
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-31 04:46:50" vp_time="2022-12-31 03:46:50
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-31 04:46:50" vp_time="2022-12-31 03:46:50
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=77.73.131.6 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (Macintosh;
Intel Mac OS X 10.8; rv:21.0) Gecko/20100101 Firefox/21.0"
show less
SQL Injection
🇧🇬
185.225.73.244
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-30 13:38:47" vp_time="2022-12-30 12:38:47
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-30 13:38:47" vp_time="2022-12-30 12:38:47
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=185.225.73.244 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: SQL Injection Attack 1"
URI=xxx.xxx.xxx.xxx:443/cgi-bin/extendauthentication rule-match="' union select
usertype||'#'||sessionid||'#'||username||'#'||password||'#'||domainname from sessions
limit 0,1;" AttackCat="SQL Injection Attack 1" summ="SQL Injection is an attack technique
used to exploit web sites that construct SQL statements from user-supplied input"
sigid="9005" category="Command Execution--SQL Injection" agent="Mozilla/5.0 (iPhone; CPU
iPhone OS 14_4_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0.3
Mobile/15E148 Safari/604.1"
show less
Hacking
🇺🇸
107.170.255.21
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-30 09:18:55" vp_time="2022-12-30 08:18:55
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-30 09:18:55" vp_time="2022-12-30 08:18:55
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=107.170.255.21 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇺🇸
192.241.223.27
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-29 03:45:23" vp_time="2022-12-29 02:45:23
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-29 03:45:23" vp_time="2022-12-29 02:45:23
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=192.241.223.27 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇺🇸
162.243.140.34
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-27 01:39:32" vp_time="2022-12-27 00:39:32
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-27 01:39:32" vp_time="2022-12-27 00:39:32
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=162.243.140.34 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇺🇸
198.199.109.99
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-25 18:21:12" vp_time="2022-12-25 17:21:12
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-25 18:21:12" vp_time="2022-12-25 17:21:12
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=198.199.109.99 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇺🇸
198.199.101.132
09 Jan 2023
SSLVPN: id=sslvpn sn=18B169CD281C time="2022-12-24 15:29:51" vp_time="2022-12-24 14:29:51
UTC" fw=x ...
show more
SSLVPN: id=sslvpn sn=18B169CD281C time="2022-12-24 15:29:51" vp_time="2022-12-24 14:29:51
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=198.199.101.132 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇺🇸
192.241.210.65
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-23 12:28:20" vp_time="2022-12-23 11:28:20
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-23 12:28:20" vp_time="2022-12-23 11:28:20
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=192.241.210.65 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇺🇸
192.241.209.125
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-22 12:03:25" vp_time="2022-12-22 11:03:25
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-22 12:03:25" vp_time="2022-12-22 11:03:25
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=192.241.209.125 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇺🇸
192.241.196.4
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-21 10:12:46" vp_time="2022-12-21 09:12:46
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-21 10:12:46" vp_time="2022-12-21 09:12:46
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=192.241.196.4 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇺🇸
192.241.204.111
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-19 08:30:24" vp_time="2022-12-19 07:30:24
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-19 08:30:24" vp_time="2022-12-19 07:30:24
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=192.241.204.111 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇺🇸
192.241.204.208
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-18 04:01:51" vp_time="2022-12-18 03:01:51
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-18 04:01:51" vp_time="2022-12-18 03:01:51
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=192.241.204.208 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇺🇸
192.241.192.62
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-16 18:32:38" vp_time="2022-12-16 17:32:38
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-16 18:32:38" vp_time="2022-12-16 17:32:38
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=192.241.192.62 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇺🇸
192.241.205.59
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-15 17:42:52" vp_time="2022-12-15 16:42:52
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-15 17:42:52" vp_time="2022-12-15 16:42:52
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=192.241.205.59 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇺🇸
192.241.192.164
09 Jan 2023
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-14 13:32:35" vp_time="2022-12-14 12:32:35
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-14 13:32:35" vp_time="2022-12-14 12:32:35
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=192.241.192.164 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇺🇸
192.241.209.59
13 Dec 2022
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-12 14:28:09" vp_time="2022-12-12 13:28:09
UTC" fw=xxx.xxx ...
show more
SSLVPN: id=sslvpn sn=xxxxxx time="2022-12-12 14:28:09" vp_time="2022-12-12 13:28:09
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=192.241.209.59 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking
🇺🇸
192.241.194.97
13 Dec 2022
SSLVPN: id=sslvpn sn=18B169CD281C time="2022-12-11 11:10:19" vp_time="2022-12-11 10:10:19
UTC" fw=x ...
show more
SSLVPN: id=sslvpn sn=18B169CD281C time="2022-12-11 11:10:19" vp_time="2022-12-11 10:10:19
UTC" fw=xxx.xxx.xxx.xxx pri=2 m=34 c=402 src=192.241.194.97 dst="xxx.xxx.xxx.xxx"
user="Unknown" usr="Unknown" msg="WAF threat prevented: Microsoft Exchange Server SSRF
(CVE-2022-41040)" URI=xxx.xxx.xxx.xxx:443/autodiscover/autodiscover.json?@zdi/Powershell
rule-match="/autodiscover/autodiscover.json?@zdi/powershell" AttackCat="Microsoft Exchange
Server SSRF (CVE-2022-41040)" summ="Microsoft Exchange has a vulnerability which can allow
remote attackers to execute code" sigid="1743" category="Command Execution--OS Commanding"
agent="Mozilla/5.0 zgrab/0.x"
show less
Hacking