API tools faq
paste
danrancan

Modsec CRS4 Audit Logs (second try)

danrancan
Apr 1st, 2024
796
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 117.32 KB | None | 0 0
raw download clone embed print report
  1. ---Qa6rO5fQ---A--
  2. [01/Apr/2024:09:30:38 -0500] 171198183845.393352 108.231.125.253 54054 10.10.10.2 443
  3. ---Qa6rO5fQ---B--
  4. GET /wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp HTTP/2.0
  5. host: www.mcmo.xyz
  6. sec-fetch-dest: image
  7. sec-fetch-mode: no-cors
  8. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  9. sec-fetch-site: same-origin
  10. accept-language: en-US,en;q=0.9
  11. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  12. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  13. referer: https://www.mcmo.xyz/
  14. accept-encoding: gzip, deflate, br
  15.  
  16. ---Qa6rO5fQ---E--
  17. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  18.  
  19. ---Qa6rO5fQ---F--
  20. HTTP/2.0 403
  21. Server: nginx
  22. Date: Mon, 01 Apr 2024 14:30:38 GMT
  23. Content-Type: text/html
  24. Connection: close
  25. Content-Encoding: br
  26.  
  27. ---Qa6rO5fQ---H--
  28. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "171198183845.393352"] [ref "o0,2v741,97"]
  29. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "171198183845.393352"] [ref ""]
  30.  
  31. ---Qa6rO5fQ---J--
  32.  
  33. ---Qa6rO5fQ---K--
  34.  
  35. ---Qa6rO5fQ---Z--
  36.  
  37. ---PscekrQt---A--
  38. [01/Apr/2024:09:30:38 -0500] 171198183814.412138 108.231.125.253 54054 10.10.10.2 443
  39. ---PscekrQt---B--
  40. GET /wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp HTTP/2.0
  41. host: www.mcmo.xyz
  42. sec-fetch-dest: image
  43. sec-fetch-mode: no-cors
  44. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  45. sec-fetch-site: same-origin
  46. accept-language: en-US,en;q=0.9
  47. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  48. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  49. referer: https://www.mcmo.xyz/
  50. accept-encoding: gzip, deflate, br
  51.  
  52. ---PscekrQt---E--
  53. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  54.  
  55. ---PscekrQt---F--
  56. HTTP/2.0 403
  57. Server: nginx
  58. Date: Mon, 01 Apr 2024 14:30:38 GMT
  59. Content-Type: text/html
  60. Connection: close
  61. Content-Encoding: br
  62.  
  63. ---PscekrQt---H--
  64. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "171198183814.412138"] [ref "o0,2v774,97"]
  65. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "171198183814.412138"] [ref ""]
  66.  
  67. ---PscekrQt---J--
  68.  
  69. ---PscekrQt---K--
  70.  
  71. ---PscekrQt---Z--
  72.  
  73. ---j3mimgln---A--
  74. [01/Apr/2024:09:30:38 -0500] 171198183894.489757 108.231.125.253 54054 10.10.10.2 443
  75. ---j3mimgln---B--
  76. GET /wp-content/plugins/newsletter-manager/images/close.png HTTP/2.0
  77. host: www.mcmo.xyz
  78. sec-fetch-dest: image
  79. sec-fetch-mode: no-cors
  80. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  81. sec-fetch-site: same-origin
  82. accept-language: en-US,en;q=0.9
  83. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  84. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  85. referer: https://www.mcmo.xyz/
  86. accept-encoding: gzip, deflate, br
  87.  
  88. ---j3mimgln---E--
  89. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  90.  
  91. ---j3mimgln---F--
  92. HTTP/2.0 403
  93. Server: nginx
  94. Date: Mon, 01 Apr 2024 14:30:38 GMT
  95. Content-Type: text/html
  96. Connection: close
  97. Content-Encoding: br
  98.  
  99. ---j3mimgln---H--
  100. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/newsletter-manager/images/close.png"] [unique_id "171198183894.489757"] [ref "o0,2v728,97"]
  101. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/newsletter-manager/images/close.png"] [unique_id "171198183894.489757"] [ref ""]
  102.  
  103. ---j3mimgln---J--
  104.  
  105. ---j3mimgln---K--
  106.  
  107. ---j3mimgln---Z--
  108.  
  109. ---BXliNKtn---A--
  110. [01/Apr/2024:09:30:38 -0500] 171198183879.882769 108.231.125.253 54054 10.10.10.2 443
  111. ---BXliNKtn---B--
  112. GET /wp-content/plugins/contact-form-manager/images/arrow-refresh.png HTTP/2.0
  113. host: www.mcmo.xyz
  114. sec-fetch-dest: image
  115. sec-fetch-mode: no-cors
  116. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  117. sec-fetch-site: same-origin
  118. accept-language: en-US,en;q=0.9
  119. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  120. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  121. referer: https://www.mcmo.xyz/
  122. accept-encoding: gzip, deflate, br
  123.  
  124. ---BXliNKtn---E--
  125. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  126.  
  127. ---BXliNKtn---F--
  128. HTTP/2.0 403
  129. Server: nginx
  130. Date: Mon, 01 Apr 2024 14:30:38 GMT
  131. Content-Type: text/html
  132. Connection: close
  133. Content-Encoding: br
  134.  
  135. ---BXliNKtn---H--
  136. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/contact-form-manager/images/arrow-refresh.png"] [unique_id "171198183879.882769"] [ref "o0,2v738,97"]
  137. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/contact-form-manager/images/arrow-refresh.png"] [unique_id "171198183879.882769"] [ref ""]
  138.  
  139. ---BXliNKtn---J--
  140.  
  141. ---BXliNKtn---K--
  142.  
  143. ---BXliNKtn---Z--
  144.  
  145. ---uzcJ2HjP---A--
  146. [01/Apr/2024:09:30:38 -0500] 171198183815.515456 108.231.125.253 54054 10.10.10.2 443
  147. ---uzcJ2HjP---B--
  148. GET /wp-content/themes/h-code/assets/images/icon-zoom-white.png HTTP/2.0
  149. host: www.mcmo.xyz
  150. sec-fetch-dest: image
  151. sec-fetch-mode: no-cors
  152. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  153. sec-fetch-site: same-origin
  154. accept-language: en-US,en;q=0.9
  155. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  156. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  157. referer: https://www.mcmo.xyz/
  158. accept-encoding: gzip, deflate, br
  159.  
  160. ---uzcJ2HjP---E--
  161. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  162.  
  163. ---uzcJ2HjP---F--
  164. HTTP/2.0 403
  165. Server: nginx
  166. Date: Mon, 01 Apr 2024 14:30:38 GMT
  167. Content-Type: text/html
  168. Connection: close
  169. Content-Encoding: br
  170.  
  171. ---uzcJ2HjP---H--
  172. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/themes/h-code/assets/images/icon-zoom-white.png"] [unique_id "171198183815.515456"] [ref "o0,2v732,97"]
  173. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/themes/h-code/assets/images/icon-zoom-white.png"] [unique_id "171198183815.515456"] [ref ""]
  174.  
  175. ---uzcJ2HjP---J--
  176.  
  177. ---uzcJ2HjP---K--
  178.  
  179. ---uzcJ2HjP---Z--
  180.  
  181. ---7L4pBSiu---A--
  182. [01/Apr/2024:09:30:38 -0500] 171198183866.254892 108.231.125.253 54054 10.10.10.2 443
  183. ---7L4pBSiu---B--
  184. GET /wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp HTTP/2.0
  185. host: www.mcmo.xyz
  186. sec-fetch-dest: image
  187. sec-fetch-mode: no-cors
  188. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  189. sec-fetch-site: same-origin
  190. accept-language: en-US,en;q=0.9
  191. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  192. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  193. referer: https://www.mcmo.xyz/
  194. accept-encoding: gzip, deflate, br
  195.  
  196. ---7L4pBSiu---E--
  197. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  198.  
  199. ---7L4pBSiu---F--
  200. HTTP/2.0 403
  201. Server: nginx
  202. Date: Mon, 01 Apr 2024 14:30:38 GMT
  203. Content-Type: text/html
  204. Connection: close
  205. Content-Encoding: br
  206.  
  207. ---7L4pBSiu---H--
  208. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198183866.254892"] [ref "o0,2v738,97"]
  209. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198183866.254892"] [ref ""]
  210.  
  211. ---7L4pBSiu---J--
  212.  
  213. ---7L4pBSiu---K--
  214.  
  215. ---7L4pBSiu---Z--
  216.  
  217. ---TSaD6J0H---A--
  218. [01/Apr/2024:09:30:38 -0500] 171198183880.063040 108.231.125.253 54054 10.10.10.2 443
  219. ---TSaD6J0H---B--
  220. GET /wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp HTTP/2.0
  221. host: www.mcmo.xyz
  222. sec-fetch-dest: image
  223. sec-fetch-mode: no-cors
  224. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  225. sec-fetch-site: same-origin
  226. accept-language: en-US,en;q=0.9
  227. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  228. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  229. referer: https://www.mcmo.xyz/
  230. accept-encoding: gzip, deflate, br
  231.  
  232. ---TSaD6J0H---E--
  233. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  234.  
  235. ---TSaD6J0H---F--
  236. HTTP/2.0 403
  237. Server: nginx
  238. Date: Mon, 01 Apr 2024 14:30:38 GMT
  239. Content-Type: text/html
  240. Connection: close
  241. Content-Encoding: br
  242.  
  243. ---TSaD6J0H---H--
  244. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "171198183880.063040"] [ref "o0,2v741,97"]
  245. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "171198183880.063040"] [ref ""]
  246.  
  247. ---TSaD6J0H---J--
  248.  
  249. ---TSaD6J0H---K--
  250.  
  251. ---TSaD6J0H---Z--
  252.  
  253. ---olz96txy---A--
  254. [01/Apr/2024:09:30:39 -0500] 171198183965.096407 108.231.125.253 54054 10.10.10.2 443
  255. ---olz96txy---B--
  256. GET /wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp HTTP/2.0
  257. host: www.mcmo.xyz
  258. sec-fetch-dest: image
  259. sec-fetch-mode: no-cors
  260. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  261. sec-fetch-site: same-origin
  262. accept-language: en-US,en;q=0.9
  263. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  264. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  265. referer: https://www.mcmo.xyz/
  266. accept-encoding: gzip, deflate, br
  267.  
  268. ---olz96txy---E--
  269. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  270.  
  271. ---olz96txy---F--
  272. HTTP/2.0 403
  273. Server: nginx
  274. Date: Mon, 01 Apr 2024 14:30:39 GMT
  275. Content-Type: text/html
  276. Connection: close
  277. Content-Encoding: br
  278.  
  279. ---olz96txy---H--
  280. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198183965.096407"] [ref "o0,2v746,97"]
  281. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198183965.096407"] [ref ""]
  282.  
  283. ---olz96txy---J--
  284.  
  285. ---olz96txy---K--
  286.  
  287. ---olz96txy---Z--
  288.  
  289. ---qXHtpyIu---A--
  290. [01/Apr/2024:09:30:39 -0500] 171198183993.733166 108.231.125.253 54054 10.10.10.2 443
  291. ---qXHtpyIu---B--
  292. GET /wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp HTTP/2.0
  293. host: www.mcmo.xyz
  294. sec-fetch-dest: image
  295. sec-fetch-mode: no-cors
  296. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  297. sec-fetch-site: same-origin
  298. accept-language: en-US,en;q=0.9
  299. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  300. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  301. referer: https://www.mcmo.xyz/
  302. accept-encoding: gzip, deflate, br
  303.  
  304. ---qXHtpyIu---E--
  305. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  306.  
  307. ---qXHtpyIu---F--
  308. HTTP/2.0 403
  309. Server: nginx
  310. Date: Mon, 01 Apr 2024 14:30:39 GMT
  311. Content-Type: text/html
  312. Connection: close
  313. Content-Encoding: br
  314.  
  315. ---qXHtpyIu---H--
  316. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "171198183993.733166"] [ref "o0,2v783,97"]
  317. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "171198183993.733166"] [ref ""]
  318.  
  319. ---qXHtpyIu---J--
  320.  
  321. ---qXHtpyIu---K--
  322.  
  323. ---qXHtpyIu---Z--
  324.  
  325. ---KKkTkSLE---A--
  326. [01/Apr/2024:09:30:39 -0500] 171198183937.445822 108.231.125.253 54054 10.10.10.2 443
  327. ---KKkTkSLE---B--
  328. GET /wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp HTTP/2.0
  329. host: www.mcmo.xyz
  330. sec-fetch-dest: image
  331. sec-fetch-mode: no-cors
  332. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  333. sec-fetch-site: same-origin
  334. accept-language: en-US,en;q=0.9
  335. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  336. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  337. referer: https://www.mcmo.xyz/
  338. accept-encoding: gzip, deflate, br
  339.  
  340. ---KKkTkSLE---E--
  341. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  342.  
  343. ---KKkTkSLE---F--
  344. HTTP/2.0 403
  345. Server: nginx
  346. Date: Mon, 01 Apr 2024 14:30:39 GMT
  347. Content-Type: text/html
  348. Connection: close
  349. Content-Encoding: br
  350.  
  351. ---KKkTkSLE---H--
  352. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp"] [unique_id "171198183937.445822"] [ref "o0,2v784,97"]
  353. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp"] [unique_id "171198183937.445822"] [ref ""]
  354.  
  355. ---KKkTkSLE---J--
  356.  
  357. ---KKkTkSLE---K--
  358.  
  359. ---KKkTkSLE---Z--
  360.  
  361. ---vuRzBQH0---A--
  362. [01/Apr/2024:09:30:39 -0500] 171198183927.467682 108.231.125.253 54054 10.10.10.2 443
  363. ---vuRzBQH0---B--
  364. GET /wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp HTTP/2.0
  365. host: www.mcmo.xyz
  366. sec-fetch-dest: image
  367. sec-fetch-mode: no-cors
  368. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  369. sec-fetch-site: same-origin
  370. accept-language: en-US,en;q=0.9
  371. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  372. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  373. referer: https://www.mcmo.xyz/
  374. accept-encoding: gzip, deflate, br
  375.  
  376. ---vuRzBQH0---E--
  377. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  378.  
  379. ---vuRzBQH0---F--
  380. HTTP/2.0 403
  381. Server: nginx
  382. Date: Mon, 01 Apr 2024 14:30:39 GMT
  383. Content-Type: text/html
  384. Connection: close
  385. Content-Encoding: br
  386.  
  387. ---vuRzBQH0---H--
  388. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp"] [unique_id "171198183927.467682"] [ref "o0,2v783,97"]
  389. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp"] [unique_id "171198183927.467682"] [ref ""]
  390.  
  391. ---vuRzBQH0---J--
  392.  
  393. ---vuRzBQH0---K--
  394.  
  395. ---vuRzBQH0---Z--
  396.  
  397. ---BG9F74Cy---A--
  398. [01/Apr/2024:09:30:39 -0500] 171198183921.426360 108.231.125.253 54054 10.10.10.2 443
  399. ---BG9F74Cy---B--
  400. GET /wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp HTTP/2.0
  401. host: www.mcmo.xyz
  402. sec-fetch-dest: image
  403. sec-fetch-mode: no-cors
  404. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  405. sec-fetch-site: same-origin
  406. accept-language: en-US,en;q=0.9
  407. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  408. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  409. referer: https://www.mcmo.xyz/
  410. accept-encoding: gzip, deflate, br
  411.  
  412. ---BG9F74Cy---E--
  413. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  414.  
  415. ---BG9F74Cy---F--
  416. HTTP/2.0 403
  417. Server: nginx
  418. Date: Mon, 01 Apr 2024 14:30:39 GMT
  419. Content-Type: text/html
  420. Connection: close
  421. Content-Encoding: br
  422.  
  423. ---BG9F74Cy---H--
  424. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "171198183921.426360"] [ref "o0,2v741,97"]
  425. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "171198183921.426360"] [ref ""]
  426.  
  427. ---BG9F74Cy---J--
  428.  
  429. ---BG9F74Cy---K--
  430.  
  431. ---BG9F74Cy---Z--
  432.  
  433. ---cTpPQ5Jk---A--
  434. [01/Apr/2024:09:30:39 -0500] 171198183918.963896 108.231.125.253 54054 10.10.10.2 443
  435. ---cTpPQ5Jk---B--
  436. GET /wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp HTTP/2.0
  437. host: www.mcmo.xyz
  438. sec-fetch-dest: image
  439. sec-fetch-mode: no-cors
  440. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  441. sec-fetch-site: same-origin
  442. accept-language: en-US,en;q=0.9
  443. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  444. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  445. referer: https://www.mcmo.xyz/
  446. accept-encoding: gzip, deflate, br
  447.  
  448. ---cTpPQ5Jk---E--
  449. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  450.  
  451. ---cTpPQ5Jk---F--
  452. HTTP/2.0 403
  453. Server: nginx
  454. Date: Mon, 01 Apr 2024 14:30:39 GMT
  455. Content-Type: text/html
  456. Connection: close
  457. Content-Encoding: br
  458.  
  459. ---cTpPQ5Jk---H--
  460. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "171198183918.963896"] [ref "o0,2v774,97"]
  461. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "171198183918.963896"] [ref ""]
  462.  
  463. ---cTpPQ5Jk---J--
  464.  
  465. ---cTpPQ5Jk---K--
  466.  
  467. ---cTpPQ5Jk---Z--
  468.  
  469. ---O1B8UWMN---A--
  470. [01/Apr/2024:09:30:39 -0500] 171198183927.874291 108.231.125.253 54054 10.10.10.2 443
  471. ---O1B8UWMN---B--
  472. GET /wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp HTTP/2.0
  473. host: www.mcmo.xyz
  474. sec-fetch-dest: image
  475. sec-fetch-mode: no-cors
  476. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  477. sec-fetch-site: same-origin
  478. accept-language: en-US,en;q=0.9
  479. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  480. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  481. referer: https://www.mcmo.xyz/
  482. accept-encoding: gzip, deflate, br
  483.  
  484. ---O1B8UWMN---E--
  485. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  486.  
  487. ---O1B8UWMN---F--
  488. HTTP/2.0 403
  489. Server: nginx
  490. Date: Mon, 01 Apr 2024 14:30:39 GMT
  491. Content-Type: text/html
  492. Connection: close
  493. Content-Encoding: br
  494.  
  495. ---O1B8UWMN---H--
  496. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198183927.874291"] [ref "o0,2v738,97"]
  497. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198183927.874291"] [ref ""]
  498.  
  499. ---O1B8UWMN---J--
  500.  
  501. ---O1B8UWMN---K--
  502.  
  503. ---O1B8UWMN---Z--
  504.  
  505. ---QmKcCbaL---A--
  506. [01/Apr/2024:09:30:39 -0500] 171198183989.477521 108.231.125.253 54054 10.10.10.2 443
  507. ---QmKcCbaL---B--
  508. GET /wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp HTTP/2.0
  509. host: www.mcmo.xyz
  510. sec-fetch-dest: image
  511. sec-fetch-mode: no-cors
  512. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  513. sec-fetch-site: same-origin
  514. accept-language: en-US,en;q=0.9
  515. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  516. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  517. referer: https://www.mcmo.xyz/
  518. accept-encoding: gzip, deflate, br
  519.  
  520. ---QmKcCbaL---E--
  521. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  522.  
  523. ---QmKcCbaL---F--
  524. HTTP/2.0 403
  525. Server: nginx
  526. Date: Mon, 01 Apr 2024 14:30:39 GMT
  527. Content-Type: text/html
  528. Connection: close
  529. Content-Encoding: br
  530.  
  531. ---QmKcCbaL---H--
  532. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198183989.477521"] [ref "o0,2v746,97"]
  533. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198183989.477521"] [ref ""]
  534.  
  535. ---QmKcCbaL---J--
  536.  
  537. ---QmKcCbaL---K--
  538.  
  539. ---QmKcCbaL---Z--
  540.  
  541. ---qjbvmlrO---A--
  542. [01/Apr/2024:09:30:40 -0500] 17119818402.544401 108.231.125.253 54054 10.10.10.2 443
  543. ---qjbvmlrO---B--
  544. GET /wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp HTTP/2.0
  545. host: www.mcmo.xyz
  546. sec-fetch-dest: image
  547. sec-fetch-mode: no-cors
  548. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  549. sec-fetch-site: same-origin
  550. accept-language: en-US,en;q=0.9
  551. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  552. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  553. referer: https://www.mcmo.xyz/
  554. accept-encoding: gzip, deflate, br
  555.  
  556. ---qjbvmlrO---E--
  557. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  558.  
  559. ---qjbvmlrO---F--
  560. HTTP/2.0 403
  561. Server: nginx
  562. Date: Mon, 01 Apr 2024 14:30:40 GMT
  563. Content-Type: text/html
  564. Connection: close
  565. Content-Encoding: br
  566.  
  567. ---qjbvmlrO---H--
  568. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "17119818402.544401"] [ref "o0,2v783,97"]
  569. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "17119818402.544401"] [ref ""]
  570.  
  571. ---qjbvmlrO---J--
  572.  
  573. ---qjbvmlrO---K--
  574.  
  575. ---qjbvmlrO---Z--
  576.  
  577. ---Eglck4M8---A--
  578. [01/Apr/2024:09:30:40 -0500] 171198184064.539410 108.231.125.253 54054 10.10.10.2 443
  579. ---Eglck4M8---B--
  580. GET /wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp HTTP/2.0
  581. host: www.mcmo.xyz
  582. sec-fetch-dest: image
  583. sec-fetch-mode: no-cors
  584. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  585. sec-fetch-site: same-origin
  586. accept-language: en-US,en;q=0.9
  587. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  588. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  589. referer: https://www.mcmo.xyz/
  590. accept-encoding: gzip, deflate, br
  591.  
  592. ---Eglck4M8---E--
  593. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  594.  
  595. ---Eglck4M8---F--
  596. HTTP/2.0 403
  597. Server: nginx
  598. Date: Mon, 01 Apr 2024 14:30:40 GMT
  599. Content-Type: text/html
  600. Connection: close
  601. Content-Encoding: br
  602.  
  603. ---Eglck4M8---H--
  604. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp"] [unique_id "171198184064.539410"] [ref "o0,2v784,97"]
  605. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp"] [unique_id "171198184064.539410"] [ref ""]
  606.  
  607. ---Eglck4M8---J--
  608.  
  609. ---Eglck4M8---K--
  610.  
  611. ---Eglck4M8---Z--
  612.  
  613. ---6VGY2btQ---A--
  614. [01/Apr/2024:09:30:40 -0500] 171198184025.637527 108.231.125.253 54054 10.10.10.2 443
  615. ---6VGY2btQ---B--
  616. GET /wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp HTTP/2.0
  617. host: www.mcmo.xyz
  618. sec-fetch-dest: image
  619. sec-fetch-mode: no-cors
  620. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  621. sec-fetch-site: same-origin
  622. accept-language: en-US,en;q=0.9
  623. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  624. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  625. referer: https://www.mcmo.xyz/
  626. accept-encoding: gzip, deflate, br
  627.  
  628. ---6VGY2btQ---E--
  629. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  630.  
  631. ---6VGY2btQ---F--
  632. HTTP/2.0 403
  633. Server: nginx
  634. Date: Mon, 01 Apr 2024 14:30:40 GMT
  635. Content-Type: text/html
  636. Connection: close
  637. Content-Encoding: br
  638.  
  639. ---6VGY2btQ---H--
  640. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp"] [unique_id "171198184025.637527"] [ref "o0,2v783,97"]
  641. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp"] [unique_id "171198184025.637527"] [ref ""]
  642.  
  643. ---6VGY2btQ---J--
  644.  
  645. ---6VGY2btQ---K--
  646.  
  647. ---6VGY2btQ---Z--
  648.  
  649. ---ND0ZnYud---A--
  650. [01/Apr/2024:09:30:40 -0500] 171198184073.200713 108.231.125.253 54054 10.10.10.2 443
  651. ---ND0ZnYud---B--
  652. GET /wp-content/themes/h-code/assets/images/icon-zoom-white.png HTTP/2.0
  653. host: www.mcmo.xyz
  654. sec-fetch-dest: image
  655. sec-fetch-mode: no-cors
  656. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  657. sec-fetch-site: same-origin
  658. accept-language: en-US,en;q=0.9
  659. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  660. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  661. referer: https://www.mcmo.xyz/
  662. accept-encoding: gzip, deflate, br
  663.  
  664. ---ND0ZnYud---E--
  665. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  666.  
  667. ---ND0ZnYud---F--
  668. HTTP/2.0 403
  669. Server: nginx
  670. Date: Mon, 01 Apr 2024 14:30:40 GMT
  671. Content-Type: text/html
  672. Connection: close
  673. Content-Encoding: br
  674.  
  675. ---ND0ZnYud---H--
  676. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/themes/h-code/assets/images/icon-zoom-white.png"] [unique_id "171198184073.200713"] [ref "o0,2v732,97"]
  677. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/themes/h-code/assets/images/icon-zoom-white.png"] [unique_id "171198184073.200713"] [ref ""]
  678.  
  679. ---ND0ZnYud---J--
  680.  
  681. ---ND0ZnYud---K--
  682.  
  683. ---ND0ZnYud---Z--
  684.  
  685. ---GTY2EQQR---A--
  686. [01/Apr/2024:09:30:40 -0500] 171198184036.978040 108.231.125.253 54054 10.10.10.2 443
  687. ---GTY2EQQR---B--
  688. GET /wp-content/uploads/2023/08/img_4584-825x510.jpg HTTP/2.0
  689. host: www.mcmo.xyz
  690. sec-fetch-dest: image
  691. sec-fetch-mode: no-cors
  692. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  693. sec-fetch-site: same-origin
  694. accept-language: en-US,en;q=0.9
  695. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  696. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  697. referer: https://www.mcmo.xyz/
  698. accept-encoding: gzip, deflate, br
  699.  
  700. ---GTY2EQQR---E--
  701. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  702.  
  703. ---GTY2EQQR---F--
  704. HTTP/2.0 403
  705. Server: nginx
  706. Date: Mon, 01 Apr 2024 14:30:40 GMT
  707. Content-Type: text/html
  708. Connection: close
  709. Content-Encoding: br
  710.  
  711. ---GTY2EQQR---H--
  712. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4584-825x510.jpg"] [unique_id "171198184036.978040"] [ref "o0,2v721,97"]
  713. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4584-825x510.jpg"] [unique_id "171198184036.978040"] [ref ""]
  714.  
  715. ---GTY2EQQR---J--
  716.  
  717. ---GTY2EQQR---K--
  718.  
  719. ---GTY2EQQR---Z--
  720.  
  721. ---4B3mDOuH---A--
  722. [01/Apr/2024:09:30:40 -0500] 171198184035.175363 108.231.125.253 54054 10.10.10.2 443
  723. ---4B3mDOuH---B--
  724. GET /wp-content/uploads/2023/08/img_4626-825x510.jpg HTTP/2.0
  725. host: www.mcmo.xyz
  726. sec-fetch-dest: image
  727. sec-fetch-mode: no-cors
  728. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  729. sec-fetch-site: same-origin
  730. accept-language: en-US,en;q=0.9
  731. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  732. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  733. referer: https://www.mcmo.xyz/
  734. accept-encoding: gzip, deflate, br
  735.  
  736. ---4B3mDOuH---E--
  737. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  738.  
  739. ---4B3mDOuH---F--
  740. HTTP/2.0 403
  741. Server: nginx
  742. Date: Mon, 01 Apr 2024 14:30:40 GMT
  743. Content-Type: text/html
  744. Connection: close
  745. Content-Encoding: br
  746.  
  747. ---4B3mDOuH---H--
  748. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4626-825x510.jpg"] [unique_id "171198184035.175363"] [ref "o0,2v721,97"]
  749. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4626-825x510.jpg"] [unique_id "171198184035.175363"] [ref ""]
  750.  
  751. ---4B3mDOuH---J--
  752.  
  753. ---4B3mDOuH---K--
  754.  
  755. ---4B3mDOuH---Z--
  756.  
  757. ---t9ntkeI5---A--
  758. [01/Apr/2024:09:30:40 -0500] 171198184057.282076 108.231.125.253 54054 10.10.10.2 443
  759. ---t9ntkeI5---B--
  760. GET /wp-content/uploads/2023/08/img_4495-825x510.jpg HTTP/2.0
  761. host: www.mcmo.xyz
  762. sec-fetch-dest: image
  763. sec-fetch-mode: no-cors
  764. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  765. sec-fetch-site: same-origin
  766. accept-language: en-US,en;q=0.9
  767. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  768. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  769. referer: https://www.mcmo.xyz/
  770. accept-encoding: gzip, deflate, br
  771.  
  772. ---t9ntkeI5---E--
  773. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  774.  
  775. ---t9ntkeI5---F--
  776. HTTP/2.0 403
  777. Server: nginx
  778. Date: Mon, 01 Apr 2024 14:30:40 GMT
  779. Content-Type: text/html
  780. Connection: close
  781. Content-Encoding: br
  782.  
  783. ---t9ntkeI5---H--
  784. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4495-825x510.jpg"] [unique_id "171198184057.282076"] [ref "o0,2v721,97"]
  785. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4495-825x510.jpg"] [unique_id "171198184057.282076"] [ref ""]
  786.  
  787. ---t9ntkeI5---J--
  788.  
  789. ---t9ntkeI5---K--
  790.  
  791. ---t9ntkeI5---Z--
  792.  
  793. ---sGcfpUG5---A--
  794. [01/Apr/2024:09:30:42 -0500] 171198184250.112249 108.231.125.253 54054 10.10.10.2 443
  795. ---sGcfpUG5---B--
  796. GET /wp-content/plugins/contact-form-manager/captcha/random.php?formName=1&formId=_1 HTTP/2.0
  797. host: www.mcmo.xyz
  798. sec-fetch-dest: iframe
  799. sec-fetch-mode: navigate
  800. accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  801. sec-fetch-site: same-origin
  802. accept-language: en-US,en;q=0.9
  803. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  804. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  805. referer: https://www.mcmo.xyz/
  806. accept-encoding: gzip, deflate, br
  807.  
  808. ---sGcfpUG5---E--
  809. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  810.  
  811. ---sGcfpUG5---F--
  812. HTTP/2.0 403
  813. Server: nginx
  814. Date: Mon, 01 Apr 2024 14:30:42 GMT
  815. Content-Type: text/html
  816. X-Content-Type-Options: nosniff
  817. Connection: close
  818. X-XSS-Protection: 1; mode=block
  819. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  820. Content-Encoding: br
  821. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
  822. Referrer-Policy: no-referrer-when-downgrade
  823. x-frame-options: SAMEORIGIN
  824.  
  825. ---sGcfpUG5---H--
  826. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/contact-form-manager/captcha/random.php"] [unique_id "171198184250.112249"] [ref "o0,2v694,97"]
  827. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/contact-form-manager/captcha/random.php"] [unique_id "171198184250.112249"] [ref ""]
  828.  
  829. ---sGcfpUG5---J--
  830.  
  831. ---sGcfpUG5---K--
  832.  
  833. ---sGcfpUG5---Z--
  834.  
  835. ---ym7AAVbD---A--
  836. [01/Apr/2024:09:30:44 -0500] 171198184495.361272 108.231.125.253 54054 10.10.10.2 443
  837. ---ym7AAVbD---B--
  838. GET /wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp HTTP/2.0
  839. host: www.mcmo.xyz
  840. sec-fetch-dest: image
  841. sec-fetch-mode: no-cors
  842. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  843. sec-fetch-site: same-origin
  844. accept-language: en-US,en;q=0.9
  845. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  846. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  847. referer: https://www.mcmo.xyz/
  848. accept-encoding: gzip, deflate, br
  849.  
  850. ---ym7AAVbD---E--
  851. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  852.  
  853. ---ym7AAVbD---F--
  854. HTTP/2.0 403
  855. Server: nginx
  856. Date: Mon, 01 Apr 2024 14:30:44 GMT
  857. Content-Type: text/html
  858. Connection: close
  859. Content-Encoding: br
  860.  
  861. ---ym7AAVbD---H--
  862. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "171198184495.361272"] [ref "o0,2v741,97"]
  863. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "171198184495.361272"] [ref ""]
  864.  
  865. ---ym7AAVbD---J--
  866.  
  867. ---ym7AAVbD---K--
  868.  
  869. ---ym7AAVbD---Z--
  870.  
  871. ---edzrzu7q---A--
  872. [01/Apr/2024:09:30:44 -0500] 171198184471.820517 108.231.125.253 54054 10.10.10.2 443
  873. ---edzrzu7q---B--
  874. GET /wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp HTTP/2.0
  875. host: www.mcmo.xyz
  876. sec-fetch-dest: image
  877. sec-fetch-mode: no-cors
  878. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  879. sec-fetch-site: same-origin
  880. accept-language: en-US,en;q=0.9
  881. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  882. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  883. referer: https://www.mcmo.xyz/
  884. accept-encoding: gzip, deflate, br
  885.  
  886. ---edzrzu7q---E--
  887. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  888.  
  889. ---edzrzu7q---F--
  890. HTTP/2.0 403
  891. Server: nginx
  892. Date: Mon, 01 Apr 2024 14:30:44 GMT
  893. Content-Type: text/html
  894. Connection: close
  895. Content-Encoding: br
  896.  
  897. ---edzrzu7q---H--
  898. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "171198184471.820517"] [ref "o0,2v774,97"]
  899. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "171198184471.820517"] [ref ""]
  900.  
  901. ---edzrzu7q---J--
  902.  
  903. ---edzrzu7q---K--
  904.  
  905. ---edzrzu7q---Z--
  906.  
  907. ---1uijX0oP---A--
  908. [01/Apr/2024:09:30:44 -0500] 171198184469.990100 108.231.125.253 54054 10.10.10.2 443
  909. ---1uijX0oP---B--
  910. GET /wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp HTTP/2.0
  911. host: www.mcmo.xyz
  912. sec-fetch-dest: image
  913. sec-fetch-mode: no-cors
  914. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  915. sec-fetch-site: same-origin
  916. accept-language: en-US,en;q=0.9
  917. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  918. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  919. referer: https://www.mcmo.xyz/
  920. accept-encoding: gzip, deflate, br
  921.  
  922. ---1uijX0oP---E--
  923. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  924.  
  925. ---1uijX0oP---F--
  926. HTTP/2.0 403
  927. Server: nginx
  928. Date: Mon, 01 Apr 2024 14:30:44 GMT
  929. Content-Type: text/html
  930. Connection: close
  931. Content-Encoding: br
  932.  
  933. ---1uijX0oP---H--
  934. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198184469.990100"] [ref "o0,2v738,97"]
  935. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198184469.990100"] [ref ""]
  936.  
  937. ---1uijX0oP---J--
  938.  
  939. ---1uijX0oP---K--
  940.  
  941. ---1uijX0oP---Z--
  942.  
  943. ---EO21sG6q---A--
  944. [01/Apr/2024:09:30:44 -0500] 171198184427.848616 108.231.125.253 54054 10.10.10.2 443
  945. ---EO21sG6q---B--
  946. GET /wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp HTTP/2.0
  947. host: www.mcmo.xyz
  948. sec-fetch-dest: image
  949. sec-fetch-mode: no-cors
  950. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  951. sec-fetch-site: same-origin
  952. accept-language: en-US,en;q=0.9
  953. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  954. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  955. referer: https://www.mcmo.xyz/
  956. accept-encoding: gzip, deflate, br
  957.  
  958. ---EO21sG6q---E--
  959. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  960.  
  961. ---EO21sG6q---F--
  962. HTTP/2.0 403
  963. Server: nginx
  964. Date: Mon, 01 Apr 2024 14:30:44 GMT
  965. Content-Type: text/html
  966. Connection: close
  967. Content-Encoding: br
  968.  
  969. ---EO21sG6q---H--
  970. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198184427.848616"] [ref "o0,2v746,97"]
  971. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198184427.848616"] [ref ""]
  972.  
  973. ---EO21sG6q---J--
  974.  
  975. ---EO21sG6q---K--
  976.  
  977. ---EO21sG6q---Z--
  978.  
  979. ---2BzDgaQI---A--
  980. [01/Apr/2024:09:30:45 -0500] 171198184575.937852 108.231.125.253 54054 10.10.10.2 443
  981. ---2BzDgaQI---B--
  982. GET /wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp HTTP/2.0
  983. host: www.mcmo.xyz
  984. sec-fetch-dest: image
  985. sec-fetch-mode: no-cors
  986. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  987. sec-fetch-site: same-origin
  988. accept-language: en-US,en;q=0.9
  989. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  990. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  991. referer: https://www.mcmo.xyz/
  992. accept-encoding: gzip, deflate, br
  993.  
  994. ---2BzDgaQI---E--
  995. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  996.  
  997. ---2BzDgaQI---F--
  998. HTTP/2.0 403
  999. Server: nginx
  1000. Date: Mon, 01 Apr 2024 14:30:44 GMT
  1001. Content-Type: text/html
  1002. Connection: close
  1003. Content-Encoding: br
  1004.  
  1005. ---2BzDgaQI---H--
  1006. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "171198184575.937852"] [ref "o0,2v783,97"]
  1007. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "171198184575.937852"] [ref ""]
  1008.  
  1009. ---2BzDgaQI---J--
  1010.  
  1011. ---2BzDgaQI---K--
  1012.  
  1013. ---2BzDgaQI---Z--
  1014.  
  1015. ---BP88HFzI---A--
  1016. [01/Apr/2024:09:30:45 -0500] 171198184558.780073 108.231.125.253 54054 10.10.10.2 443
  1017. ---BP88HFzI---B--
  1018. GET /wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp HTTP/2.0
  1019. host: www.mcmo.xyz
  1020. sec-fetch-dest: image
  1021. sec-fetch-mode: no-cors
  1022. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  1023. sec-fetch-site: same-origin
  1024. accept-language: en-US,en;q=0.9
  1025. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  1026. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  1027. referer: https://www.mcmo.xyz/
  1028. accept-encoding: gzip, deflate, br
  1029.  
  1030. ---BP88HFzI---E--
  1031. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  1032.  
  1033. ---BP88HFzI---F--
  1034. HTTP/2.0 403
  1035. Server: nginx
  1036. Date: Mon, 01 Apr 2024 14:30:44 GMT
  1037. Content-Type: text/html
  1038. Connection: close
  1039. Content-Encoding: br
  1040.  
  1041. ---BP88HFzI---H--
  1042. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp"] [unique_id "171198184558.780073"] [ref "o0,2v784,97"]
  1043. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp"] [unique_id "171198184558.780073"] [ref ""]
  1044.  
  1045. ---BP88HFzI---J--
  1046.  
  1047. ---BP88HFzI---K--
  1048.  
  1049. ---BP88HFzI---Z--
  1050.  
  1051. ---7hzefn1r---A--
  1052. [01/Apr/2024:09:30:45 -0500] 171198184572.842638 108.231.125.253 54054 10.10.10.2 443
  1053. ---7hzefn1r---B--
  1054. GET /wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp HTTP/2.0
  1055. host: www.mcmo.xyz
  1056. sec-fetch-dest: image
  1057. sec-fetch-mode: no-cors
  1058. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  1059. sec-fetch-site: same-origin
  1060. accept-language: en-US,en;q=0.9
  1061. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  1062. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=6d21b19886310670.1711981838.; _pk_ses.1.b754=1
  1063. referer: https://www.mcmo.xyz/
  1064. accept-encoding: gzip, deflate, br
  1065.  
  1066. ---7hzefn1r---E--
  1067. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  1068.  
  1069. ---7hzefn1r---F--
  1070. HTTP/2.0 403
  1071. Server: nginx
  1072. Date: Mon, 01 Apr 2024 14:30:44 GMT
  1073. Content-Type: text/html
  1074. Connection: close
  1075. Content-Encoding: br
  1076.  
  1077. ---7hzefn1r---H--
  1078. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_current_add' (Value: `fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: fd found within REQUEST_COOKIES:sbjs_current_add: fd%3D2024-04-01%2014%3A30%3A37%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp"] [unique_id "171198184572.842638"] [ref "o0,2v783,97"]
  1079. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp"] [unique_id "171198184572.842638"] [ref ""]
  1080.  
  1081. ---7hzefn1r---J--
  1082.  
  1083. ---7hzefn1r---K--
  1084.  
  1085. ---7hzefn1r---Z--
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!