API tools faq
paste
danrancan

modsec crs4 audit log for mcmo.xyz

danrancan
Apr 1st, 2024
558
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
Bash 137.80 KB | None | 0 0
raw download clone embed print report
  1. ---cT9nc6R6---A--
  2. [01/Apr/2024:09:18:13 -0500] 171198109317.845861 108.231.125.253 53514 10.10.10.2 443
  3. ---cT9nc6R6---B--
  4. GET /wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp HTTP/2.0
  5. host: www.mcmo.xyz
  6. sec-fetch-dest: image
  7. sec-fetch-mode: no-cors
  8. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  9. sec-fetch-site: same-origin
  10. accept-language: en-US,en;q=0.9
  11. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  12. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  13. referer: https://www.mcmo.xyz/
  14. accept-encoding: gzip, deflate, br
  15.  
  16. ---cT9nc6R6---E--
  17. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  18.  
  19. ---cT9nc6R6---F--
  20. HTTP/2.0 403
  21. Server: nginx
  22. Date: Mon, 01 Apr 2024 14:18:13 GMT
  23. Content-Type: text/html
  24. Connection: close
  25. Content-Encoding: br
  26.  
  27. ---cT9nc6R6---H--
  28. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "171198109317.845861"] [ref "o0,2v741,97o0,2v1178,51"]
  29. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "171198109317.845861"] [ref "o13,4v851,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  30. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "171198109317.845861"] [ref ""]
  31.  
  32. ---cT9nc6R6---J--
  33.  
  34. ---cT9nc6R6---K--
  35.  
  36. ---cT9nc6R6---Z--
  37.  
  38. ---BC4XHtUY---A--
  39. [01/Apr/2024:09:18:13 -0500] 17119810933.848267 108.231.125.253 53514 10.10.10.2 443
  40. ---BC4XHtUY---B--
  41. GET /wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp HTTP/2.0
  42. host: www.mcmo.xyz
  43. sec-fetch-dest: image
  44. sec-fetch-mode: no-cors
  45. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  46. sec-fetch-site: same-origin
  47. accept-language: en-US,en;q=0.9
  48. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  49. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  50. referer: https://www.mcmo.xyz/
  51. accept-encoding: gzip, deflate, br
  52.  
  53. ---BC4XHtUY---E--
  54. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  55.  
  56. ---BC4XHtUY---F--
  57. HTTP/2.0 403
  58. Server: nginx
  59. Date: Mon, 01 Apr 2024 14:18:13 GMT
  60. Content-Type: text/html
  61. Connection: close
  62. Content-Encoding: br
  63.  
  64. ---BC4XHtUY---H--
  65. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "17119810933.848267"] [ref "o0,2v774,97o0,2v1211,51"]
  66. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "17119810933.848267"] [ref "o13,4v884,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  67. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "17119810933.848267"] [ref ""]
  68.  
  69. ---BC4XHtUY---J--
  70.  
  71. ---BC4XHtUY---K--
  72.  
  73. ---BC4XHtUY---Z--
  74.  
  75. ---HVj9BKHq---A--
  76. [01/Apr/2024:09:18:13 -0500] 17119810939.439168 108.231.125.253 53514 10.10.10.2 443
  77. ---HVj9BKHq---B--
  78. GET /wp-content/plugins/newsletter-manager/images/close.png HTTP/2.0
  79. host: www.mcmo.xyz
  80. sec-fetch-dest: image
  81. sec-fetch-mode: no-cors
  82. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  83. sec-fetch-site: same-origin
  84. accept-language: en-US,en;q=0.9
  85. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  86. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  87. referer: https://www.mcmo.xyz/
  88. accept-encoding: gzip, deflate, br
  89.  
  90. ---HVj9BKHq---E--
  91. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  92.  
  93. ---HVj9BKHq---F--
  94. HTTP/2.0 403
  95. Server: nginx
  96. Date: Mon, 01 Apr 2024 14:18:13 GMT
  97. Content-Type: text/html
  98. Connection: close
  99. Content-Encoding: br
  100.  
  101. ---HVj9BKHq---H--
  102. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/newsletter-manager/images/close.png"] [unique_id "17119810939.439168"] [ref "o0,2v728,97o0,2v1165,51"]
  103. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/newsletter-manager/images/close.png"] [unique_id "17119810939.439168"] [ref "o13,4v838,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  104. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/newsletter-manager/images/close.png"] [unique_id "17119810939.439168"] [ref ""]
  105.  
  106. ---HVj9BKHq---J--
  107.  
  108. ---HVj9BKHq---K--
  109.  
  110. ---HVj9BKHq---Z--
  111.  
  112. ---eSdPvCiW---A--
  113. [01/Apr/2024:09:18:13 -0500] 171198109354.079798 108.231.125.253 53514 10.10.10.2 443
  114. ---eSdPvCiW---B--
  115. GET /wp-content/plugins/contact-form-manager/images/arrow-refresh.png HTTP/2.0
  116. host: www.mcmo.xyz
  117. sec-fetch-dest: image
  118. sec-fetch-mode: no-cors
  119. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  120. sec-fetch-site: same-origin
  121. accept-language: en-US,en;q=0.9
  122. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  123. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  124. referer: https://www.mcmo.xyz/
  125. accept-encoding: gzip, deflate, br
  126.  
  127. ---eSdPvCiW---E--
  128. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  129.  
  130. ---eSdPvCiW---F--
  131. HTTP/2.0 403
  132. Server: nginx
  133. Date: Mon, 01 Apr 2024 14:18:13 GMT
  134. Content-Type: text/html
  135. Connection: close
  136. Content-Encoding: br
  137.  
  138. ---eSdPvCiW---H--
  139. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/contact-form-manager/images/arrow-refresh.png"] [unique_id "171198109354.079798"] [ref "o0,2v738,97o0,2v1175,51"]
  140. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/contact-form-manager/images/arrow-refresh.png"] [unique_id "171198109354.079798"] [ref "o13,4v848,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  141. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/contact-form-manager/images/arrow-refresh.png"] [unique_id "171198109354.079798"] [ref ""]
  142.  
  143. ---eSdPvCiW---J--
  144.  
  145. ---eSdPvCiW---K--
  146.  
  147. ---eSdPvCiW---Z--
  148.  
  149. ---dpJGtjK5---A--
  150. [01/Apr/2024:09:18:13 -0500] 171198109340.313719 108.231.125.253 53514 10.10.10.2 443
  151. ---dpJGtjK5---B--
  152. GET /wp-content/themes/h-code/assets/images/icon-zoom-white.png HTTP/2.0
  153. host: www.mcmo.xyz
  154. sec-fetch-dest: image
  155. sec-fetch-mode: no-cors
  156. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  157. sec-fetch-site: same-origin
  158. accept-language: en-US,en;q=0.9
  159. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  160. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  161. referer: https://www.mcmo.xyz/
  162. accept-encoding: gzip, deflate, br
  163.  
  164. ---dpJGtjK5---E--
  165. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  166.  
  167. ---dpJGtjK5---F--
  168. HTTP/2.0 403
  169. Server: nginx
  170. Date: Mon, 01 Apr 2024 14:18:13 GMT
  171. Content-Type: text/html
  172. Connection: close
  173. Content-Encoding: br
  174.  
  175. ---dpJGtjK5---H--
  176. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/themes/h-code/assets/images/icon-zoom-white.png"] [unique_id "171198109340.313719"] [ref "o0,2v732,97o0,2v1169,51"]
  177. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/themes/h-code/assets/images/icon-zoom-white.png"] [unique_id "171198109340.313719"] [ref "o13,4v842,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  178. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/themes/h-code/assets/images/icon-zoom-white.png"] [unique_id "171198109340.313719"] [ref ""]
  179.  
  180. ---dpJGtjK5---J--
  181.  
  182. ---dpJGtjK5---K--
  183.  
  184. ---dpJGtjK5---Z--
  185.  
  186. ---vOaAG4gV---A--
  187. [01/Apr/2024:09:18:13 -0500] 171198109363.485168 108.231.125.253 53514 10.10.10.2 443
  188. ---vOaAG4gV---B--
  189. GET /wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp HTTP/2.0
  190. host: www.mcmo.xyz
  191. sec-fetch-dest: image
  192. sec-fetch-mode: no-cors
  193. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  194. sec-fetch-site: same-origin
  195. accept-language: en-US,en;q=0.9
  196. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  197. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  198. referer: https://www.mcmo.xyz/
  199. accept-encoding: gzip, deflate, br
  200.  
  201. ---vOaAG4gV---E--
  202. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  203.  
  204. ---vOaAG4gV---F--
  205. HTTP/2.0 403
  206. Server: nginx
  207. Date: Mon, 01 Apr 2024 14:18:13 GMT
  208. Content-Type: text/html
  209. Connection: close
  210. Content-Encoding: br
  211.  
  212. ---vOaAG4gV---H--
  213. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198109363.485168"] [ref "o0,2v738,97o0,2v1175,51"]
  214. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198109363.485168"] [ref "o13,4v848,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  215. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198109363.485168"] [ref ""]
  216.  
  217. ---vOaAG4gV---J--
  218.  
  219. ---vOaAG4gV---K--
  220.  
  221. ---vOaAG4gV---Z--
  222.  
  223. ---XPeijtXN---A--
  224. [01/Apr/2024:09:18:13 -0500] 171198109344.431967 108.231.125.253 53514 10.10.10.2 443
  225. ---XPeijtXN---B--
  226. GET /wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp HTTP/2.0
  227. host: www.mcmo.xyz
  228. sec-fetch-dest: image
  229. sec-fetch-mode: no-cors
  230. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  231. sec-fetch-site: same-origin
  232. accept-language: en-US,en;q=0.9
  233. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  234. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  235. referer: https://www.mcmo.xyz/
  236. accept-encoding: gzip, deflate, br
  237.  
  238. ---XPeijtXN---E--
  239. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  240.  
  241. ---XPeijtXN---F--
  242. HTTP/2.0 403
  243. Server: nginx
  244. Date: Mon, 01 Apr 2024 14:18:13 GMT
  245. Content-Type: text/html
  246. Connection: close
  247. Content-Encoding: br
  248.  
  249. ---XPeijtXN---H--
  250. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198109344.431967"] [ref "o0,2v746,97o0,2v1183,51"]
  251. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198109344.431967"] [ref "o13,4v856,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  252. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198109344.431967"] [ref ""]
  253.  
  254. ---XPeijtXN---J--
  255.  
  256. ---XPeijtXN---K--
  257.  
  258. ---XPeijtXN---Z--
  259.  
  260. ---MAnFKTly---A--
  261. [01/Apr/2024:09:18:13 -0500] 171198109333.745325 108.231.125.253 53514 10.10.10.2 443
  262. ---MAnFKTly---B--
  263. GET /wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp HTTP/2.0
  264. host: www.mcmo.xyz
  265. sec-fetch-dest: image
  266. sec-fetch-mode: no-cors
  267. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  268. sec-fetch-site: same-origin
  269. accept-language: en-US,en;q=0.9
  270. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  271. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  272. referer: https://www.mcmo.xyz/
  273. accept-encoding: gzip, deflate, br
  274.  
  275. ---MAnFKTly---E--
  276. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  277.  
  278. ---MAnFKTly---F--
  279. HTTP/2.0 403
  280. Server: nginx
  281. Date: Mon, 01 Apr 2024 14:18:13 GMT
  282. Content-Type: text/html
  283. Connection: close
  284. Content-Encoding: br
  285.  
  286. ---MAnFKTly---H--
  287. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "171198109333.745325"] [ref "o0,2v783,97o0,2v1220,51"]
  288. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "171198109333.745325"] [ref "o13,4v893,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  289. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "171198109333.745325"] [ref ""]
  290.  
  291. ---MAnFKTly---J--
  292.  
  293. ---MAnFKTly---K--
  294.  
  295. ---MAnFKTly---Z--
  296.  
  297. ---G3CAkWDd---A--
  298. [01/Apr/2024:09:18:13 -0500] 171198109324.025836 108.231.125.253 53514 10.10.10.2 443
  299. ---G3CAkWDd---B--
  300. GET /wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp HTTP/2.0
  301. host: www.mcmo.xyz
  302. sec-fetch-dest: image
  303. sec-fetch-mode: no-cors
  304. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  305. sec-fetch-site: same-origin
  306. accept-language: en-US,en;q=0.9
  307. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  308. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  309. referer: https://www.mcmo.xyz/
  310. accept-encoding: gzip, deflate, br
  311.  
  312. ---G3CAkWDd---E--
  313. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  314.  
  315. ---G3CAkWDd---F--
  316. HTTP/2.0 403
  317. Server: nginx
  318. Date: Mon, 01 Apr 2024 14:18:13 GMT
  319. Content-Type: text/html
  320. Connection: close
  321. Content-Encoding: br
  322.  
  323. ---G3CAkWDd---H--
  324. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp"] [unique_id "171198109324.025836"] [ref "o0,2v784,97o0,2v1221,51"]
  325. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp"] [unique_id "171198109324.025836"] [ref "o13,4v894,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  326. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp"] [unique_id "171198109324.025836"] [ref ""]
  327.  
  328. ---G3CAkWDd---J--
  329.  
  330. ---G3CAkWDd---K--
  331.  
  332. ---G3CAkWDd---Z--
  333.  
  334. ---snl6pRcK---A--
  335. [01/Apr/2024:09:18:13 -0500] 171198109317.525589 108.231.125.253 53514 10.10.10.2 443
  336. ---snl6pRcK---B--
  337. GET /wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp HTTP/2.0
  338. host: www.mcmo.xyz
  339. sec-fetch-dest: image
  340. sec-fetch-mode: no-cors
  341. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  342. sec-fetch-site: same-origin
  343. accept-language: en-US,en;q=0.9
  344. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  345. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  346. referer: https://www.mcmo.xyz/
  347. accept-encoding: gzip, deflate, br
  348.  
  349. ---snl6pRcK---E--
  350. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  351.  
  352. ---snl6pRcK---F--
  353. HTTP/2.0 403
  354. Server: nginx
  355. Date: Mon, 01 Apr 2024 14:18:13 GMT
  356. Content-Type: text/html
  357. Connection: close
  358. Content-Encoding: br
  359.  
  360. ---snl6pRcK---H--
  361. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp"] [unique_id "171198109317.525589"] [ref "o0,2v783,97o0,2v1220,51"]
  362. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp"] [unique_id "171198109317.525589"] [ref "o13,4v893,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  363. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp"] [unique_id "171198109317.525589"] [ref ""]
  364.  
  365. ---snl6pRcK---J--
  366.  
  367. ---snl6pRcK---K--
  368.  
  369. ---snl6pRcK---Z--
  370.  
  371. ---qG3Z8YuU---A--
  372. [01/Apr/2024:09:18:13 -0500] 17119810932.948357 108.231.125.253 53514 10.10.10.2 443
  373. ---qG3Z8YuU---B--
  374. GET /wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp HTTP/2.0
  375. host: www.mcmo.xyz
  376. sec-fetch-dest: image
  377. sec-fetch-mode: no-cors
  378. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  379. sec-fetch-site: same-origin
  380. accept-language: en-US,en;q=0.9
  381. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  382. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  383. referer: https://www.mcmo.xyz/
  384. accept-encoding: gzip, deflate, br
  385.  
  386. ---qG3Z8YuU---E--
  387. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  388.  
  389. ---qG3Z8YuU---F--
  390. HTTP/2.0 403
  391. Server: nginx
  392. Date: Mon, 01 Apr 2024 14:18:13 GMT
  393. Content-Type: text/html
  394. Connection: close
  395. Content-Encoding: br
  396.  
  397. ---qG3Z8YuU---H--
  398. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "17119810932.948357"] [ref "o0,2v741,97o0,2v1178,51"]
  399. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "17119810932.948357"] [ref "o13,4v851,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  400. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "17119810932.948357"] [ref ""]
  401.  
  402. ---qG3Z8YuU---J--
  403.  
  404. ---qG3Z8YuU---K--
  405.  
  406. ---qG3Z8YuU---Z--
  407.  
  408. ---ifj08TyN---A--
  409. [01/Apr/2024:09:18:14 -0500] 171198109430.038655 108.231.125.253 53514 10.10.10.2 443
  410. ---ifj08TyN---B--
  411. GET /wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp HTTP/2.0
  412. host: www.mcmo.xyz
  413. sec-fetch-dest: image
  414. sec-fetch-mode: no-cors
  415. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  416. sec-fetch-site: same-origin
  417. accept-language: en-US,en;q=0.9
  418. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  419. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  420. referer: https://www.mcmo.xyz/
  421. accept-encoding: gzip, deflate, br
  422.  
  423. ---ifj08TyN---E--
  424. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  425.  
  426. ---ifj08TyN---F--
  427. HTTP/2.0 403
  428. Server: nginx
  429. Date: Mon, 01 Apr 2024 14:18:13 GMT
  430. Content-Type: text/html
  431. Connection: close
  432. Content-Encoding: br
  433.  
  434. ---ifj08TyN---H--
  435. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "171198109430.038655"] [ref "o0,2v774,97o0,2v1211,51"]
  436. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "171198109430.038655"] [ref "o13,4v884,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  437. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "171198109430.038655"] [ref ""]
  438.  
  439. ---ifj08TyN---J--
  440.  
  441. ---ifj08TyN---K--
  442.  
  443. ---ifj08TyN---Z--
  444.  
  445. ---U8XCekpV---A--
  446. [01/Apr/2024:09:18:14 -0500] 171198109481.136445 108.231.125.253 53514 10.10.10.2 443
  447. ---U8XCekpV---B--
  448. GET /wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp HTTP/2.0
  449. host: www.mcmo.xyz
  450. sec-fetch-dest: image
  451. sec-fetch-mode: no-cors
  452. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  453. sec-fetch-site: same-origin
  454. accept-language: en-US,en;q=0.9
  455. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  456. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  457. referer: https://www.mcmo.xyz/
  458. accept-encoding: gzip, deflate, br
  459.  
  460. ---U8XCekpV---E--
  461. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  462.  
  463. ---U8XCekpV---F--
  464. HTTP/2.0 403
  465. Server: nginx
  466. Date: Mon, 01 Apr 2024 14:18:13 GMT
  467. Content-Type: text/html
  468. Connection: close
  469. Content-Encoding: br
  470.  
  471. ---U8XCekpV---H--
  472. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198109481.136445"] [ref "o0,2v738,97o0,2v1175,51"]
  473. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198109481.136445"] [ref "o13,4v848,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  474. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198109481.136445"] [ref ""]
  475.  
  476. ---U8XCekpV---J--
  477.  
  478. ---U8XCekpV---K--
  479.  
  480. ---U8XCekpV---Z--
  481.  
  482. ---VabIzDcp---A--
  483. [01/Apr/2024:09:18:14 -0500] 171198109494.145333 108.231.125.253 53514 10.10.10.2 443
  484. ---VabIzDcp---B--
  485. GET /wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp HTTP/2.0
  486. host: www.mcmo.xyz
  487. sec-fetch-dest: image
  488. sec-fetch-mode: no-cors
  489. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  490. sec-fetch-site: same-origin
  491. accept-language: en-US,en;q=0.9
  492. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  493. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  494. referer: https://www.mcmo.xyz/
  495. accept-encoding: gzip, deflate, br
  496.  
  497. ---VabIzDcp---E--
  498. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  499.  
  500. ---VabIzDcp---F--
  501. HTTP/2.0 403
  502. Server: nginx
  503. Date: Mon, 01 Apr 2024 14:18:13 GMT
  504. Content-Type: text/html
  505. Connection: close
  506. Content-Encoding: br
  507.  
  508. ---VabIzDcp---H--
  509. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198109494.145333"] [ref "o0,2v746,97o0,2v1183,51"]
  510. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198109494.145333"] [ref "o13,4v856,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  511. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198109494.145333"] [ref ""]
  512.  
  513. ---VabIzDcp---J--
  514.  
  515. ---VabIzDcp---K--
  516.  
  517. ---VabIzDcp---Z--
  518.  
  519. ---SdMaBG4r---A--
  520. [01/Apr/2024:09:18:14 -0500] 171198109447.173825 108.231.125.253 53514 10.10.10.2 443
  521. ---SdMaBG4r---B--
  522. GET /wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp HTTP/2.0
  523. host: www.mcmo.xyz
  524. sec-fetch-dest: image
  525. sec-fetch-mode: no-cors
  526. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  527. sec-fetch-site: same-origin
  528. accept-language: en-US,en;q=0.9
  529. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  530. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  531. referer: https://www.mcmo.xyz/
  532. accept-encoding: gzip, deflate, br
  533.  
  534. ---SdMaBG4r---E--
  535. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  536.  
  537. ---SdMaBG4r---F--
  538. HTTP/2.0 403
  539. Server: nginx
  540. Date: Mon, 01 Apr 2024 14:18:13 GMT
  541. Content-Type: text/html
  542. Connection: close
  543. Content-Encoding: br
  544.  
  545. ---SdMaBG4r---H--
  546. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "171198109447.173825"] [ref "o0,2v783,97o0,2v1220,51"]
  547. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "171198109447.173825"] [ref "o13,4v893,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  548. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "171198109447.173825"] [ref ""]
  549.  
  550. ---SdMaBG4r---J--
  551.  
  552. ---SdMaBG4r---K--
  553.  
  554. ---SdMaBG4r---Z--
  555.  
  556. ---wls2CoPe---A--
  557. [01/Apr/2024:09:18:15 -0500] 171198109533.225357 108.231.125.253 53514 10.10.10.2 443
  558. ---wls2CoPe---B--
  559. GET /wp-content/themes/h-code/assets/images/icon-zoom-white.png HTTP/2.0
  560. host: www.mcmo.xyz
  561. sec-fetch-dest: image
  562. sec-fetch-mode: no-cors
  563. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  564. sec-fetch-site: same-origin
  565. accept-language: en-US,en;q=0.9
  566. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  567. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  568. referer: https://www.mcmo.xyz/
  569. accept-encoding: gzip, deflate, br
  570.  
  571. ---wls2CoPe---E--
  572. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  573.  
  574. ---wls2CoPe---F--
  575. HTTP/2.0 403
  576. Server: nginx
  577. Date: Mon, 01 Apr 2024 14:18:15 GMT
  578. Content-Type: text/html
  579. Connection: close
  580. Content-Encoding: br
  581.  
  582. ---wls2CoPe---H--
  583. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/themes/h-code/assets/images/icon-zoom-white.png"] [unique_id "171198109533.225357"] [ref "o0,2v732,97o0,2v1169,51"]
  584. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/themes/h-code/assets/images/icon-zoom-white.png"] [unique_id "171198109533.225357"] [ref "o13,4v842,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  585. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/themes/h-code/assets/images/icon-zoom-white.png"] [unique_id "171198109533.225357"] [ref ""]
  586.  
  587. ---wls2CoPe---J--
  588.  
  589. ---wls2CoPe---K--
  590.  
  591. ---wls2CoPe---Z--
  592.  
  593. ---xuqZed47---A--
  594. [01/Apr/2024:09:18:16 -0500] 171198109660.052163 108.231.125.253 53514 10.10.10.2 443
  595. ---xuqZed47---B--
  596. GET /wp-content/uploads/2023/08/img_4584-825x510.jpg HTTP/2.0
  597. host: www.mcmo.xyz
  598. sec-fetch-dest: image
  599. sec-fetch-mode: no-cors
  600. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  601. sec-fetch-site: same-origin
  602. accept-language: en-US,en;q=0.9
  603. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  604. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  605. referer: https://www.mcmo.xyz/
  606. accept-encoding: gzip, deflate, br
  607.  
  608. ---xuqZed47---E--
  609. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  610.  
  611. ---xuqZed47---F--
  612. HTTP/2.0 403
  613. Server: nginx
  614. Date: Mon, 01 Apr 2024 14:18:16 GMT
  615. Content-Type: text/html
  616. Connection: close
  617. Content-Encoding: br
  618.  
  619. ---xuqZed47---H--
  620. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4584-825x510.jpg"] [unique_id "171198109660.052163"] [ref "o0,2v721,97o0,2v1158,51"]
  621. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4584-825x510.jpg"] [unique_id "171198109660.052163"] [ref "o13,4v831,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  622. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4584-825x510.jpg"] [unique_id "171198109660.052163"] [ref ""]
  623.  
  624. ---xuqZed47---J--
  625.  
  626. ---xuqZed47---K--
  627.  
  628. ---xuqZed47---Z--
  629.  
  630. ---BgNAr0zJ---A--
  631. [01/Apr/2024:09:18:16 -0500] 171198109669.680396 108.231.125.253 53514 10.10.10.2 443
  632. ---BgNAr0zJ---B--
  633. GET /wp-content/uploads/2023/08/img_4626-825x510.jpg HTTP/2.0
  634. host: www.mcmo.xyz
  635. sec-fetch-dest: image
  636. sec-fetch-mode: no-cors
  637. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  638. sec-fetch-site: same-origin
  639. accept-language: en-US,en;q=0.9
  640. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  641. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  642. referer: https://www.mcmo.xyz/
  643. accept-encoding: gzip, deflate, br
  644.  
  645. ---BgNAr0zJ---E--
  646. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  647.  
  648. ---BgNAr0zJ---F--
  649. HTTP/2.0 403
  650. Server: nginx
  651. Date: Mon, 01 Apr 2024 14:18:16 GMT
  652. Content-Type: text/html
  653. Connection: close
  654. Content-Encoding: br
  655.  
  656. ---BgNAr0zJ---H--
  657. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4626-825x510.jpg"] [unique_id "171198109669.680396"] [ref "o0,2v721,97o0,2v1158,51"]
  658. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4626-825x510.jpg"] [unique_id "171198109669.680396"] [ref "o13,4v831,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  659. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4626-825x510.jpg"] [unique_id "171198109669.680396"] [ref ""]
  660.  
  661. ---BgNAr0zJ---J--
  662.  
  663. ---BgNAr0zJ---K--
  664.  
  665. ---BgNAr0zJ---Z--
  666.  
  667. ---bLtnaveU---A--
  668. [01/Apr/2024:09:18:16 -0500] 171198109647.257418 108.231.125.253 53514 10.10.10.2 443
  669. ---bLtnaveU---B--
  670. GET /wp-content/uploads/2023/08/img_4495-825x510.jpg HTTP/2.0
  671. host: www.mcmo.xyz
  672. sec-fetch-dest: image
  673. sec-fetch-mode: no-cors
  674. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  675. sec-fetch-site: same-origin
  676. accept-language: en-US,en;q=0.9
  677. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  678. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  679. referer: https://www.mcmo.xyz/
  680. accept-encoding: gzip, deflate, br
  681.  
  682. ---bLtnaveU---E--
  683. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  684.  
  685. ---bLtnaveU---F--
  686. HTTP/2.0 403
  687. Server: nginx
  688. Date: Mon, 01 Apr 2024 14:18:16 GMT
  689. Content-Type: text/html
  690. Connection: close
  691. Content-Encoding: br
  692.  
  693. ---bLtnaveU---H--
  694. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4495-825x510.jpg"] [unique_id "171198109647.257418"] [ref "o0,2v721,97o0,2v1158,51"]
  695. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4495-825x510.jpg"] [unique_id "171198109647.257418"] [ref "o13,4v831,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  696. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/08/img_4495-825x510.jpg"] [unique_id "171198109647.257418"] [ref ""]
  697.  
  698. ---bLtnaveU---J--
  699.  
  700. ---bLtnaveU---K--
  701.  
  702. ---bLtnaveU---Z--
  703.  
  704. ---hUWrJuWE---A--
  705. [01/Apr/2024:09:18:16 -0500] 171198109695.156262 108.231.125.253 53514 10.10.10.2 443
  706. ---hUWrJuWE---B--
  707. GET /wp-content/themes/h-code/assets/images/icon-zoom-white.png HTTP/2.0
  708. host: www.mcmo.xyz
  709. sec-fetch-dest: image
  710. sec-fetch-mode: no-cors
  711. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  712. sec-fetch-site: same-origin
  713. accept-language: en-US,en;q=0.9
  714. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  715. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  716. referer: https://www.mcmo.xyz/
  717. accept-encoding: gzip, deflate, br
  718.  
  719. ---hUWrJuWE---E--
  720. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  721.  
  722. ---hUWrJuWE---F--
  723. HTTP/2.0 403
  724. Server: nginx
  725. Date: Mon, 01 Apr 2024 14:18:16 GMT
  726. Content-Type: text/html
  727. Connection: close
  728. Content-Encoding: br
  729.  
  730. ---hUWrJuWE---H--
  731. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/themes/h-code/assets/images/icon-zoom-white.png"] [unique_id "171198109695.156262"] [ref "o0,2v732,97o0,2v1169,51"]
  732. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/themes/h-code/assets/images/icon-zoom-white.png"] [unique_id "171198109695.156262"] [ref "o13,4v842,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  733. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/themes/h-code/assets/images/icon-zoom-white.png"] [unique_id "171198109695.156262"] [ref ""]
  734.  
  735. ---hUWrJuWE---J--
  736.  
  737. ---hUWrJuWE---K--
  738.  
  739. ---hUWrJuWE---Z--
  740.  
  741. ---oKnRyqW9---A--
  742. [01/Apr/2024:09:18:19 -0500] 171198109980.154441 108.231.125.253 53514 10.10.10.2 443
  743. ---oKnRyqW9---B--
  744. GET /wp-content/plugins/contact-form-manager/captcha/random.php?formName=1&formId=_1 HTTP/2.0
  745. host: www.mcmo.xyz
  746. sec-fetch-dest: iframe
  747. sec-fetch-mode: navigate
  748. accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
  749. sec-fetch-site: same-origin
  750. accept-language: en-US,en;q=0.9
  751. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  752. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  753. referer: https://www.mcmo.xyz/
  754. accept-encoding: gzip, deflate, br
  755.  
  756. ---oKnRyqW9---E--
  757. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  758.  
  759. ---oKnRyqW9---F--
  760. HTTP/2.0 403
  761. Server: nginx
  762. Date: Mon, 01 Apr 2024 14:18:19 GMT
  763. Content-Type: text/html
  764. X-Content-Type-Options: nosniff
  765. Connection: close
  766. X-XSS-Protection: 1; mode=block
  767. Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
  768. Content-Encoding: br
  769. Content-Security-Policy: default-src * data: 'unsafe-eval' 'unsafe-inline'
  770. Referrer-Policy: no-referrer-when-downgrade
  771. x-frame-options: SAMEORIGIN
  772.  
  773. ---oKnRyqW9---H--
  774. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/contact-form-manager/captcha/random.php"] [unique_id "171198109980.154441"] [ref "o0,2v694,97o0,2v1131,51"]
  775. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/contact-form-manager/captcha/random.php"] [unique_id "171198109980.154441"] [ref "o13,4v804,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  776. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/plugins/contact-form-manager/captcha/random.php"] [unique_id "171198109980.154441"] [ref ""]
  777.  
  778. ---oKnRyqW9---J--
  779.  
  780. ---oKnRyqW9---K--
  781.  
  782. ---oKnRyqW9---Z--
  783.  
  784. ---WuKNuHfV---A--
  785. [01/Apr/2024:09:18:20 -0500] 171198110016.911398 108.231.125.253 53514 10.10.10.2 443
  786. ---WuKNuHfV---B--
  787. GET /wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp HTTP/2.0
  788. host: www.mcmo.xyz
  789. sec-fetch-dest: image
  790. sec-fetch-mode: no-cors
  791. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  792. sec-fetch-site: same-origin
  793. accept-language: en-US,en;q=0.9
  794. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  795. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  796. referer: https://www.mcmo.xyz/
  797. accept-encoding: gzip, deflate, br
  798.  
  799. ---WuKNuHfV---E--
  800. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  801.  
  802. ---WuKNuHfV---F--
  803. HTTP/2.0 403
  804. Server: nginx
  805. Date: Mon, 01 Apr 2024 14:18:20 GMT
  806. Content-Type: text/html
  807. Connection: close
  808. Content-Encoding: br
  809.  
  810. ---WuKNuHfV---H--
  811. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "171198110016.911398"] [ref "o0,2v741,97o0,2v1178,51"]
  812. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "171198110016.911398"] [ref "o13,4v851,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  813. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Tryclops-1-scaled-768x1012.webp"] [unique_id "171198110016.911398"] [ref ""]
  814.  
  815. ---WuKNuHfV---J--
  816.  
  817. ---WuKNuHfV---K--
  818.  
  819. ---WuKNuHfV---Z--
  820.  
  821. ---bYGBUtf9---A--
  822. [01/Apr/2024:09:18:20 -0500] 171198110016.769517 108.231.125.253 53514 10.10.10.2 443
  823. ---bYGBUtf9---B--
  824. GET /wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp HTTP/2.0
  825. host: www.mcmo.xyz
  826. sec-fetch-dest: image
  827. sec-fetch-mode: no-cors
  828. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  829. sec-fetch-site: same-origin
  830. accept-language: en-US,en;q=0.9
  831. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  832. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  833. referer: https://www.mcmo.xyz/
  834. accept-encoding: gzip, deflate, br
  835.  
  836. ---bYGBUtf9---E--
  837. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  838.  
  839. ---bYGBUtf9---F--
  840. HTTP/2.0 403
  841. Server: nginx
  842. Date: Mon, 01 Apr 2024 14:18:20 GMT
  843. Content-Type: text/html
  844. Connection: close
  845. Content-Encoding: br
  846.  
  847. ---bYGBUtf9---H--
  848. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "171198110016.769517"] [ref "o0,2v774,97o0,2v1211,51"]
  849. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "171198110016.769517"] [ref "o13,4v884,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  850. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Shape-of-Things-The-Shape-of-Things-Exhibit-1-4-768x400.webp"] [unique_id "171198110016.769517"] [ref ""]
  851.  
  852. ---bYGBUtf9---J--
  853.  
  854. ---bYGBUtf9---K--
  855.  
  856. ---bYGBUtf9---Z--
  857.  
  858. ---N9ye3Uqq---A--
  859. [01/Apr/2024:09:18:20 -0500] 171198110042.230080 108.231.125.253 53514 10.10.10.2 443
  860. ---N9ye3Uqq---B--
  861. GET /wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp HTTP/2.0
  862. host: www.mcmo.xyz
  863. sec-fetch-dest: image
  864. sec-fetch-mode: no-cors
  865. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  866. sec-fetch-site: same-origin
  867. accept-language: en-US,en;q=0.9
  868. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  869. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  870. referer: https://www.mcmo.xyz/
  871. accept-encoding: gzip, deflate, br
  872.  
  873. ---N9ye3Uqq---E--
  874. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  875.  
  876. ---N9ye3Uqq---F--
  877. HTTP/2.0 403
  878. Server: nginx
  879. Date: Mon, 01 Apr 2024 14:18:20 GMT
  880. Content-Type: text/html
  881. Connection: close
  882. Content-Encoding: br
  883.  
  884. ---N9ye3Uqq---H--
  885. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198110042.230080"] [ref "o0,2v738,97o0,2v1175,51"]
  886. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198110042.230080"] [ref "o13,4v848,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  887. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-Stoned-Totem-2-768x1010.webp"] [unique_id "171198110042.230080"] [ref ""]
  888.  
  889. ---N9ye3Uqq---J--
  890.  
  891. ---N9ye3Uqq---K--
  892.  
  893. ---N9ye3Uqq---Z--
  894.  
  895. ---ncHlSnsy---A--
  896. [01/Apr/2024:09:18:20 -0500] 171198110075.322682 108.231.125.253 53514 10.10.10.2 443
  897. ---ncHlSnsy---B--
  898. GET /wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp HTTP/2.0
  899. host: www.mcmo.xyz
  900. sec-fetch-dest: image
  901. sec-fetch-mode: no-cors
  902. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  903. sec-fetch-site: same-origin
  904. accept-language: en-US,en;q=0.9
  905. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  906. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  907. referer: https://www.mcmo.xyz/
  908. accept-encoding: gzip, deflate, br
  909.  
  910. ---ncHlSnsy---E--
  911. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  912.  
  913. ---ncHlSnsy---F--
  914. HTTP/2.0 403
  915. Server: nginx
  916. Date: Mon, 01 Apr 2024 14:18:20 GMT
  917. Content-Type: text/html
  918. Connection: close
  919. Content-Encoding: br
  920.  
  921. ---ncHlSnsy---H--
  922. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198110075.322682"] [ref "o0,2v746,97o0,2v1183,51"]
  923. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198110075.322682"] [ref "o13,4v856,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  924. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2022/05/McMo-Art-The-Beautiful-People-2-768x1010.webp"] [unique_id "171198110075.322682"] [ref ""]
  925.  
  926. ---ncHlSnsy---J--
  927.  
  928. ---ncHlSnsy---K--
  929.  
  930. ---ncHlSnsy---Z--
  931.  
  932. ---fAJZSy33---A--
  933. [01/Apr/2024:09:18:20 -0500] 171198110071.593070 108.231.125.253 53514 10.10.10.2 443
  934. ---fAJZSy33---B--
  935. GET /wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp HTTP/2.0
  936. host: www.mcmo.xyz
  937. sec-fetch-dest: image
  938. sec-fetch-mode: no-cors
  939. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  940. sec-fetch-site: same-origin
  941. accept-language: en-US,en;q=0.9
  942. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  943. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  944. referer: https://www.mcmo.xyz/
  945. accept-encoding: gzip, deflate, br
  946.  
  947. ---fAJZSy33---E--
  948. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  949.  
  950. ---fAJZSy33---F--
  951. HTTP/2.0 403
  952. Server: nginx
  953. Date: Mon, 01 Apr 2024 14:18:20 GMT
  954. Content-Type: text/html
  955. Connection: close
  956. Content-Encoding: br
  957.  
  958. ---fAJZSy33---H--
  959. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "171198110071.593070"] [ref "o0,2v783,97o0,2v1220,51"]
  960. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "171198110071.593070"] [ref "o13,4v893,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  961. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2023/06/McMo-Earthworks-Art-Products-Red-Touches-Yellow-Cropped-17-600px-X-500px-WebP.webp"] [unique_id "171198110071.593070"] [ref ""]
  962.  
  963. ---fAJZSy33---J--
  964.  
  965. ---fAJZSy33---K--
  966.  
  967. ---fAJZSy33---Z--
  968.  
  969. ---VJCzAp6W---A--
  970. [01/Apr/2024:09:18:21 -0500] 171198110198.973715 108.231.125.253 53514 10.10.10.2 443
  971. ---VJCzAp6W---B--
  972. GET /wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp HTTP/2.0
  973. host: www.mcmo.xyz
  974. sec-fetch-dest: image
  975. sec-fetch-mode: no-cors
  976. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  977. sec-fetch-site: same-origin
  978. accept-language: en-US,en;q=0.9
  979. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  980. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  981. referer: https://www.mcmo.xyz/
  982. accept-encoding: gzip, deflate, br
  983.  
  984. ---VJCzAp6W---E--
  985. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  986.  
  987. ---VJCzAp6W---F--
  988. HTTP/2.0 403
  989. Server: nginx
  990. Date: Mon, 01 Apr 2024 14:18:20 GMT
  991. Content-Type: text/html
  992. Connection: close
  993. Content-Encoding: br
  994.  
  995. ---VJCzAp6W---H--
  996. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp"] [unique_id "171198110198.973715"] [ref "o0,2v784,97o0,2v1221,51"]
  997. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp"] [unique_id "171198110198.973715"] [ref "o13,4v894,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  998. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/02/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Neolithic-Family-8-768x1013.webp"] [unique_id "171198110198.973715"] [ref ""]
  999.  
  1000. ---VJCzAp6W---J--
  1001.  
  1002. ---VJCzAp6W---K--
  1003.  
  1004. ---VJCzAp6W---Z--
  1005.  
  1006. ---y480XzoK---A--
  1007. [01/Apr/2024:09:18:21 -0500] 171198110131.698567 108.231.125.253 53514 10.10.10.2 443
  1008. ---y480XzoK---B--
  1009. GET /wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp HTTP/2.0
  1010. host: www.mcmo.xyz
  1011. sec-fetch-dest: image
  1012. sec-fetch-mode: no-cors
  1013. accept: image/webp,image/avif,image/jxl,image/heic,image/heic-sequence,video/*;q=0.8,image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5
  1014. sec-fetch-site: same-origin
  1015. accept-language: en-US,en;q=0.9
  1016. user-agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.4.1 Safari/605.1.15
  1017. cookie: sbjs_current=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_current_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_first=typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccnt%3D%28none%29%7C%7C%7Ctrm%3D%28none%29%7C%7C%7Cid%3D%28none%29; sbjs_first_add=fd%3D2024-04-01%2014%3A18%3A12%7C%7C%7Cep%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F%7C%7C%7Crf%3D%28none%29; sbjs_migrations=1418474375998%3D1; sbjs_session=pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F; sbjs_udata=vst%3D1%7C%7C%7Cuip%3D%28none%29%7C%7C%7Cuag%3DMozilla%2F5.0%20%28Macintosh%3B%20Intel%20Mac%20OS%20X%2010_15_7%29%20AppleWebKit%2F605.1.15%20%28KHTML%2C%20like%20Gecko%29%20Version%2F17.4.1%20Safari%2F605.1.15; _pk_id.1.b754=de6c8ce9846b1c9f.1711981092.; _pk_ses.1.b754=1
  1018. referer: https://www.mcmo.xyz/
  1019. accept-encoding: gzip, deflate, br
  1020.  
  1021. ---y480XzoK---E--
  1022. \xa1\x88\x04\x00 :\xb7\xceF\xe8\x84\x06\x0c\xf2\xa3)X\xc4\x82\x1bI=Y\xc8\x99]2\x92L\x0a\x0aZ\xa37|\xdc\xbe5I\xe4bPIXo\xd5\x05mi!\xeb\xcdn\xd3!\x14&\xcb$\x98d!\xd8Q\x19\xc5\x95\xca\xc5\xaar\x8c\x1bY\xd6\x80\xf0\xfa\xdc\xfe\xb8kD\xd3l\x00
  1023.  
  1024. ---y480XzoK---F--
  1025. HTTP/2.0 403
  1026. Server: nginx
  1027. Date: Mon, 01 Apr 2024 14:18:20 GMT
  1028. Content-Type: text/html
  1029. Connection: close
  1030. Content-Encoding: br
  1031.  
  1032. ---y480XzoK---H--
  1033. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)(?:^|b[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?u[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\$[!#\(\*\-0-9\?-@_a-\{]*)?\x5c?s[\"'\)\[-\x5c]*(?:(?:(?:\|\||&&)[\s\v]*)?\ (8043 characters omitted)' against variable `REQUEST_COOKIES:sbjs_session' (Value: `pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf"] [line "1348"] [id "932236"] [rev ""] [msg "Remote Command Execution: Unix Command Injection (command without evasion)"] [data "Matched Data: pg found within REQUEST_COOKIES:sbjs_session: pgs%3D1%7C%7C%7Ccpg%3Dhttps%3A%2F%2Fwww.mcmo.xyz%2F"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-shell"] [tag "platform-unix"] [tag "attack-rce"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "capec/1000/152/248/88"] [tag "PCI/6.5.2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp"] [unique_id "171198110131.698567"] [ref "o0,2v783,97o0,2v1220,51"]
  1034. ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i)\b(?:s(?:tyle|rc)|href)\b[\s\S]*?=' against variable `REQUEST_COOKIES:sbjs_first' (Value: `typ%3Dtypein%7C%7C%7Csrc%3D%28direct%29%7C%7C%7Cmdm%3D%28none%29%7C%7C%7Ccmp%3D%28none%29%7C%7C%7Ccn (63 characters omitted)' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf"] [line "832"] [id "941150"] [rev ""] [msg "XSS Filter - Category 5: Disallowed HTML Attributes"] [data "Matched Data: src= found within REQUEST_COOKIES:sbjs_first: typ=typein|||src=(direct)|||mdm=(none)|||cmp=(none)|||cnt=(none)|||trm=(none)|||id=(none)"] [severity "2"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-xss"] [tag "xss-perf-disable"] [tag "OWASP_CRS"] [tag "capec/1000/152/242"] [tag "paranoia-level/2"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp"] [unique_id "171198110131.698567"] [ref "o13,4v893,163t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls"]
  1035. ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `15' ) [file "/etc/nginx/modsec/crs4.0/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "176"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 15)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.0.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [hostname "10.10.10.2"] [uri "/wp-content/uploads/2024/03/McMo-is-Art-On-Lincoln-Memorial-Drive-in-Milwaukee-Athenas-Necklace-3-768x488.webp"] [unique_id "171198110131.698567"] [ref ""]
  1036.  
  1037. ---y480XzoK---J--
  1038.  
  1039. ---y480XzoK---K--
  1040.  
  1041. ---y480XzoK---Z--
Advertisement
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!