2020-06-29 18:58:30 95.91.xxx.xx 403 POST /index.php ajax-proxy/&t=9d173c37dcb1e7c8daa3e756c066184bcfe3d86b HTTP/2.0 https://www.andereliga.com/index.php?conversation/13-ark/&messageID=17 Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36 OPR/68.0.3618.191 12.5 K IIS access
2020-06-29 18:58:32 17221764977212261063 95.91.xxx.xx 80 127.0.0.1 80
--f16d0000-B--
POST /index.php?ajax-proxy/&t=9d173c37dcb1e7c8daa3e756c066184bcfe3d86b HTTP/1.1
Connection: close
Content-Length: 92
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Accept: /
Accept-Encoding: gzip, deflate, br
Accept-Language: de-DE,de;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: wsc_a7b82b_cookieHash_acp=ddace9e4691d9bd61109cae36b8803c203877108; wsc_a7b82b_userID=1; wsc_a7b82b_password=%242a%2408%241JXVgmCoeGGMJ7m3Ac76guJX3nmL2fclRUHKtipPF.xxxxxxx; wsc_a7b82b_cookieHash=8a5a903e727c481f5fb8eaa9c0f0c5ef848xxxxxx
Host: www.andereliga.com
Referer: https://www.andereliga.com/index.php?conversation/13-ark/&messageID=17
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.138 Safari/537.36 OPR/68.0.3618.191
x-requested-with: XMLHttpRequest
origin: https://www.andereliga.com
sec-fetch-site: same-origin
sec-fetch-mode: cors
sec-fetch-dest: empty

--f16d0000-F--
HTTP/1.1 500 Internal Server Error

--f16d0000-H--
Message: Access denied with code 403 (phase 1). Match of "rx ^%{tx.allowed_request_content_type_charset}$" against "TX:1" required. [file "C:\/Program Files (x86)/Plesk/ModSecurity/rules/modsecurity_crs-plesk/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "944"] [id "920480"] [msg "Request content type charset is not allowed by policy"] [data "utf-8"] [severity "CRITICAL"] [ver "OWASP_CRS/3.2.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL_VIOLATION/CONTENT_TYPE_CHARSET"] [tag "WASCTC/WASC-20"] [tag "OWASP_TOP_10/A1"] [tag "OWASP_AppSensor/EE2"] [tag "PCI/12.1"]
Action: Intercepted (phase 1)
Apache-Handler: IIS
Stopwatch: 1593449912316119 1002 (- - -)
Stopwatch2: 1593449912316119 1002; combined=0, p1=0, p2=0, p3=0, p4=0, p5=0, sr=0, sw=0, l=0, gc=0
Producer: ModSecurity for IIS (STABLE)/2.9.2 (http://www.modsecurity.org/); OWASP_CRS/3.2.0.
Server: ModSecurity Standalone
Engine-Mode: "ENABLED"

--f16d0000-Z--