Untitled
Posted by NotLim on Sun 16th Feb 2014 22:54
raw | new post

Time:     Thu Feb 13 01:03:11 2014 -0300
IP:       82.98.134.47 (ES/Spain/d410.dinaserver.com)
Failures: 5 (mod_security)
Interval: 3600 seconds
Blocked:  Temporary Block

Log entries:

[Thu Feb 13 01:03:07 2014] [error] [client 82.98.134.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "bot for jce" at REQUEST_HEADERS:User-Agent. [file "/etc/httpd/modsecurity.d/20_asl_useragents.conf"] [line "69"] [id "330205"] [rev "2"] [msg "Atomicorp.com WAF Rules: Joomla Exploit Bot"] [severity "CRITICAL"] [hostname "www.santanderimport.cl"] [uri "/index.php"] [unique_id "UvxD@77ERdUADSpMHkAAAAAU"]
[Thu Feb 13 01:03:07 2014] [error] [client 82.98.134.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "bot for jce" at REQUEST_HEADERS:User-Agent. [file "/etc/httpd/modsecurity.d/20_asl_useragents.conf"] [line "69"] [id "330205"] [rev "2"] [msg "Atomicorp.com WAF Rules: Joomla Exploit Bot"] [severity "CRITICAL"] [hostname "www.santanderimport.cl"] [uri "/index.php"] [unique_id "UvxD@77ERdUADQGS6KgAAAA1"]
[Thu Feb 13 01:03:08 2014] [error] [client 82.98.134.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "bot for jce" at REQUEST_HEADERS:User-Agent. [file "/etc/httpd/modsecurity.d/20_asl_useragents.conf"] [line "69"] [id "330205"] [rev "2"] [msg "Atomicorp.com WAF Rules: Joomla Exploit Bot"] [severity "CRITICAL"] [hostname "www.santanderimport.cl"] [uri "/index.php"] [unique_id "UvxD-L7ERdUADQGS6KkAAAA1"]
[Thu Feb 13 01:03:08 2014] [error] [client 82.98.134.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "bot for jce" at REQUEST_HEADERS:User-Agent. [file "/etc/httpd/modsecurity.d/20_asl_useragents.conf"] [line "69"] [id "330205"] [rev "2"] [msg "Atomicorp.com WAF Rules: Joomla Exploit Bot"] [severity "CRITICAL"] [hostname "www.santanderimport.cl"] [uri "/index.php"] [unique_id "UvxD-L7ERdUADSpMHkEAAAAU"]
[Thu Feb 13 01:03:10 2014] [error] [client 82.98.134.47] ModSecurity: Access denied with code 403 (phase 2). Pattern match "/images/stories/.+\\\\.php" at REQUEST_URI. [file "/etc/httpd/modsecurity.d/50_asl_rootkits.conf"] [line "70"] [id "318812"] [rev "1"] [msg "Atomicorp.com WAF Rules: Possible Attempt to Access unauthorized shell or exploit in Joomla images directory"] [data "/images/stories/food.php"] [severity "CRITICAL"] [hostname "www.santanderimport.cl"] [uri "/images/stories/food.php"] [unique_id "UvxD-r7ERdUADSB9AQcAAAA2"]