Untitled
Posted by NotLim on Thu 6th Mar 2014 00:28
raw | new post

www.obelon.com  190.164.141.213 390703  [05/Mar/2014:21:12:18 --0300]
Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file "/etc/httpd/modsec/00_asl_zz_strict.conf"] [line "64"] [id "390703"] [rev "5"] [msg "Atomicorp.com WAF Rules: Possible URL Encoding Abuse Attack Attempt"] [severity "NOTICE"]

 [05/Mar/2014:21:12:18 --0300] Uxe9Yr7ERdwAAzDHLQIAAACN 190.164.141.213 61721 190.196.69.220 80
 --a9dc8e3e-B--
 GET /templates/cleanlogic-for-joomla-3.x/css/colors.css.php?base_color=6b7e8f&accent_color=bbff00&text_color=f2f2f2&amp;menu_text_color=ffffff&button_text_color=ffffff&bg_style=01_alphablending&templateurl=%templates%cleanlogic-for-joomla-3.x HTTP/1.1
Host: www.obelon.com
Connection: keep-alive
Accept: text/css,*/*;q=0.1
User-Agent: Mozilla/5.0 (Windows NT 6.3; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/33.0.1750.146 Safari/537.36
Referer: http://www.obelon.com/index.php/es/
Accept-Encoding: gzip,deflate,sdch
Accept-Language: es-419,es;q=0.8
Cookie: 11377699d9b9afad60cb3eba1cdc53a4=f424bf0e2800add99246a74d6fcd0bbc; 83e5adc0111996b6b2982dc9e2a66ea9=df65fc802f302e83191408c5062510c4; jpanesliders_contact-slider=0; PHPSESSID=e723714bd32212a21ec0983590f5c948; gantry-admin-tab=4; ed76e1cc7e0b1d6df1bee966d824a353=ec7517d7a0ffa197e7de8cf35a497151; 3052de6b6bc2a092be796180920587cf=3ace78ef6a3ef31f3b847486ac681bb7; 83880a232aa0e3b6dbf9a259ba226131=4eac4b8fdf7943adeab26d4166fe337a; a1f6237a0ba9d5c2595c01b4591a67a9=7fbf44f99e6a14be7f4c37d0525847dc; jpanesliders_panel-sliders=0; configuration=server; jpanesliders_permissions-sliders=0; whostmgrsession=obelonco%3anEJfbAI5k8YlziWbfNmVV88xSTCweO4l4cfurexPmjCELCUsvNLqQR17JREzG5z8%2c4d54acbf8c860dd5ea1ba327f4368d18c523a86f012daa964ef4f55df8552ce5; whostmgrrelogin=no; webmailsession=preyes%40obelon.com%3a8B_zNlhglVhZHVZCCvPXnpJE9OUJ2GbDPhSqgFVljLzWeDO5sEgyO1zxeQ6bKgwJ%2cc3baeb70f6abee49bd25db24ab693aa08e8ac6633c4fa21d2b32ac208c791b17; webmailrelogin=no; roundcube_sessauth=S3a88331a440ef853c90a81af2d31b042d944214a; login_theme=cpanel; cpsession=obelonco%3aRgnVbTZ1j1ZhuevOFVN6w5JXn9IMv55H4Ahg1MiyAT5gp9i19cDw1Jt0rZ6nLuUO%2ced686d6a93479852a21e70ee3592ac50c1a4f47402044df40ed6105158ca37ba; langedit=; lang=; cprelogin=no; da163a13b40ec30fe5dcf8bcadab06fa=es-ES

 --a9dc8e3e-F--
 HTTP/1.1 400 Bad Request
Content-Length: 345
Connection: close
Content-Type: text/html; charset=iso-8859-1

 --a9dc8e3e-H--
Message: Access denied with code 400 (phase 2). Invalid URL Encoding: Non-hexadecimal digits used at REQUEST_URI. [file "/etc/httpd/modsec/00_asl_zz_strict.conf"] [line "64"] [id "390703"] [rev "5"] [msg "Atomicorp.com WAF Rules: Possible URL Encoding Abuse Attack Attempt"] [severity "NOTICE"]
Apache-Error: [file "core.c"] [line 3706] [level 3] File does not exist: /home/obelonco/public_html/400.shtml, referer: http://www.obelon.com/index.php/es/
Action: Intercepted (phase 2)
Stopwatch: 1394064738242226 12343 (- - -)
Stopwatch2: 1394064738242226 12343; combined=57, p1=20, p2=25, p3=0, p4=0, p5=11, sr=0, sw=1, l=0, gc=0
Producer: ModSecurity for Apache/2.7.7 (http://www.modsecurity.org/).
Server: Apache
Engine-Mode: "ENABLED"