{"transaction":{"client_ip":"10.100.0.4","time_stamp":"Thu May 28 01:23:25 2026","server_id":"58b7ef43d23c6bee4e73267fe6ca89b3e7907335","client_port":61938,"host_ip":"10.116.4.114","host_port":8080,"unique_id":"177993140536.078682","is_interrupted":false,"request":{"method":"HEAD","http_version":"1.1","hostname":"138.197.228.148","uri":"/","headers":{"Host":"138.197.228.148","User-Agent":"curl/8.7.1","Accept":"*/*"}},"response":{"body":"","http_code":404,"headers":{"Strict-Transport-Security":"max-age=31536000; includeSubDomains; preload","Cache-Control":"no-store, no-cache, must-revalidate","X-Frame-Options":"DENY","vary":"Origin","X-XSS-Protection":"1; mode=block","Access-Control-Allow-Headers":"*","Access-Control-Allow-Credentials":"true","Server":"nginx\u0000","Connection":"keep-alive","X-Content-Type-Options":"nosniff","X-Kong-Response-Latency":"0","Content-Type":"application/json; charset=utf-8","Content-Length":"103","Date":"Thu, 28 May 2026 01:23:25 GMT","Referrer-Policy":"strict-origin-when-cross-origin","Permissions-Policy":"camera=(), microphone=(), geolocation=()","X-Kong-Request-Id":"0f63616e6beba4584eeff3707d2f8c3f"}},"producer":{"modsecurity":"ModSecurity v3.0.15 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/4.25.0\""]},"messages":[{"message":"Host header is a numeric IP address","details":{"match":"Matched \"Operator `Rx' with parameter `(?:^([\\d.]+|\\[[\\da-f:]+\\]|[\\da-f:]+)(:[\\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `138.197.228.148' )","reference":"o0,15o0,15v22,15","ruleId":"920350","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf","lineNumber":"757","data":"138.197.228.148","severity":"4","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-protocol","paranoia-level/1","OWASP_CRS","OWASP_CRS/PROTOCOL-ENFORCEMENT","capec/1000/210/272"],"maturity":"0","accuracy":"0"}}]}}
{"transaction":{"client_ip":"10.100.0.5","time_stamp":"Thu May 28 01:23:45 2026","server_id":"58b7ef43d23c6bee4e73267fe6ca89b3e7907335","client_port":61952,"host_ip":"10.116.4.114","host_port":8080,"unique_id":"177993142515.451482","is_interrupted":true,"request":{"method":"GET","http_version":"1.1","hostname":"138.197.228.148","uri":"/?id=1%20OR%201=1--%20","headers":{"Host":"138.197.228.148","User-Agent":"curl/8.7.1","Accept":"*/*"}},"response":{"body":"<html>\r\n<head><title>403 Forbidden</title></head>\r\n<body>\r\n<center><h1>403 Forbidden</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n","http_code":403,"headers":{"Server":"nginx\u0000","Date":"Thu, 28 May 2026 01:23:45 GMT","Content-Length":"146","Content-Type":"text/html","Access-Control-Allow-Origin":"*","Connection":"keep-alive","Access-Control-Max-Age":"3600","Access-Control-Allow-Methods":"GET, POST, PUT, DELETE, OPTIONS","Access-Control-Allow-Headers":"*"}},"producer":{"modsecurity":"ModSecurity v3.0.15 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/4.25.0\""]},"messages":[{"message":"Host header is a numeric IP address","details":{"match":"Matched \"Operator `Rx' with parameter `(?:^([\\d.]+|\\[[\\da-f:]+\\]|[\\da-f:]+)(:[\\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `138.197.228.148' )","reference":"o0,15o0,15v42,15","ruleId":"920350","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf","lineNumber":"757","data":"138.197.228.148","severity":"4","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-protocol","paranoia-level/1","OWASP_CRS","OWASP_CRS/PROTOCOL-ENFORCEMENT","capec/1000/210/272"],"maturity":"0","accuracy":"0"}},{"message":"SQL Injection Attack Detected via libinjection","details":{"match":"detected SQLi using libinjection.","reference":"v9,11","ruleId":"942100","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf","lineNumber":"46","data":"Matched Data: 1&1c found within ARGS:id: 1 OR 1=1-- ","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["application-multi","language-multi","platform-multi","attack-sqli","paranoia-level/1","OWASP_CRS","OWASP_CRS/ATTACK-SQLI","capec/1000/152/248/66"],"maturity":"0","accuracy":"0"}},{"message":"SQL Injection Attack: SQL Boolean-based attack detected","details":{"match":"Matched \"Operator `StrEq' with parameter `' against variable `TX:1' (Value: `1' )","reference":"o4,4o5,1o7,1v9,11t:urlDecodeUni,t:replaceComments","ruleId":"942130","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf","lineNumber":"699","data":"Matched Data:  1=1 found within ARGS:id: 1","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","modsecurity","application-multi","language-multi","platform-multi","attack-sqli","paranoia-level/2","OWASP_CRS","OWASP_CRS/ATTACK-SQLI","capec/1000/152/248/66"],"maturity":"0","accuracy":"0"}},{"message":"SQL Injection Attack","details":{"match":"Matched \"Operator `Rx' with parameter `(?i)\\b(?:or\\b(?:[\\s\\x0b]?(?:[0-9]{1,10}|[\\\"'][^=]{1,10}[\\\"'])[\\s\\x0b]?[<->]+|[\\s\\x0b]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[\\s\\x0b]*?[<->])?)|xor\\b[\\s\\x0b]+(?:[0-9]{1,10}|'[^=]{1,10}')(?:[\\s\\x0b]*?[<->])?)| (40 characters omitted)' against variable `ARGS:id' (Value: `1 OR 1=1-- ' )","reference":"o2,5v9,11t:urlDecodeUni","ruleId":"942390","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf","lineNumber":"1153","data":"Matched Data: OR 1= found within ARGS:id: 1 OR 1=1-- ","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-sqli","paranoia-level/2","OWASP_CRS","OWASP_CRS/ATTACK-SQLI","capec/1000/152/248/66"],"maturity":"0","accuracy":"0"}},{"message":"SQL Comment Sequence Detected","details":{"match":"Matched \"Operator `Rx' with parameter `^(?:ey[\\-0-9A-Z_a-z]+\\.ey[\\-0-9A-Z_a-z]+\\.)?[\\-0-9A-Z_a-z]+$' against variable `MATCHED_VARS:ARGS:id' (Value: `1 OR 1=1-- ' )","reference":"o8,3v9,11t:urlDecodeUniv93,11","ruleId":"942440","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf","lineNumber":"1373","data":"Matched Data: --  found within MATCHED_VARS:ARGS:id: 1 OR 1=1-- ","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","modsecurity","application-multi","language-multi","platform-multi","attack-sqli","paranoia-level/2","OWASP_CRS","OWASP_CRS/ATTACK-SQLI","capec/1000/152/248/66"],"maturity":"0","accuracy":"0"}},{"message":"Inbound Anomaly Score Exceeded (Total Score: 23)","details":{"match":"Matched \"Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `23' )","reference":"","ruleId":"949110","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf","lineNumber":"222","data":"","severity":"0","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","anomaly-evaluation","OWASP_CRS"],"maturity":"0","accuracy":"0"}}]}}
{"transaction":{"client_ip":"10.100.0.16","time_stamp":"Thu May 28 01:23:46 2026","server_id":"58b7ef43d23c6bee4e73267fe6ca89b3e7907335","client_port":61953,"host_ip":"10.116.4.114","host_port":8080,"unique_id":"177993142611.144665","is_interrupted":true,"request":{"method":"GET","http_version":"1.1","hostname":"138.197.228.148","uri":"/?q=UNION%20SELECT%20username%20FROM%20users","headers":{"Host":"138.197.228.148","User-Agent":"curl/8.7.1","Accept":"*/*"}},"response":{"body":"<html>\r\n<head><title>403 Forbidden</title></head>\r\n<body>\r\n<center><h1>403 Forbidden</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n","http_code":403,"headers":{"Server":"nginx\u0000","Date":"Thu, 28 May 2026 01:23:46 GMT","Content-Length":"146","Content-Type":"text/html","Access-Control-Allow-Origin":"*","Connection":"keep-alive","Access-Control-Max-Age":"3600","Access-Control-Allow-Methods":"GET, POST, PUT, DELETE, OPTIONS","Access-Control-Allow-Headers":"*"}},"producer":{"modsecurity":"ModSecurity v3.0.15 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/4.25.0\""]},"messages":[{"message":"Host header is a numeric IP address","details":{"match":"Matched \"Operator `Rx' with parameter `(?:^([\\d.]+|\\[[\\da-f:]+\\]|[\\da-f:]+)(:[\\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `138.197.228.148' )","reference":"o0,15o0,15v64,15","ruleId":"920350","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf","lineNumber":"757","data":"138.197.228.148","severity":"4","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-protocol","paranoia-level/1","OWASP_CRS","OWASP_CRS/PROTOCOL-ENFORCEMENT","capec/1000/210/272"],"maturity":"0","accuracy":"0"}},{"message":"SQL Injection Attack Detected via libinjection","details":{"match":"detected SQLi using libinjection.","reference":"v8,32","ruleId":"942100","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf","lineNumber":"46","data":"Matched Data: UEnkn found within ARGS:q: UNION SELECT username FROM users","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["application-multi","language-multi","platform-multi","attack-sqli","paranoia-level/1","OWASP_CRS","OWASP_CRS/ATTACK-SQLI","capec/1000/152/248/66"],"maturity":"0","accuracy":"0"}},{"message":"Detects MSSQL code execution and information gathering attempts","details":{"match":"Matched \"Operator `Rx' with parameter `(?i)[\\\"'`](?:[\\s\\x0b]*![\\s\\x0b]*[\\\"'0-9A-Z_-z]|;?[\\s\\x0b]*(?:having|select|union\\b[\\s\\x0b]*(?:all|(?:distin|sele)ct))\\b[\\s\\x0b]*[^\\s\\x0b])|\\b(?:(?:(?:c(?:onnection_id|urrent_user)|database|schema|user (311 characters omitted)' against variable `ARGS:q' (Value: `UNION SELECT username FROM users' )","reference":"o0,12v8,32t:urlDecodeUni,t:removeCommentsChar","ruleId":"942190","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf","lineNumber":"206","data":"Matched Data: UNION SELECT found within ARGS:q: UNION SELECT username FROM users","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-sqli","paranoia-level/1","OWASP_CRS","OWASP_CRS/ATTACK-SQLI","capec/1000/152/248/66"],"maturity":"0","accuracy":"0"}},{"message":"Looking for basic sql injection. Common attack string for mysql, oracle and others","details":{"match":"Matched \"Operator `Rx' with parameter `(?i)union.*?select.*?from' against variable `ARGS:q' (Value: `UNION SELECT username FROM users' )","reference":"o0,26v8,32t:urlDecodeUni","ruleId":"942270","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf","lineNumber":"334","data":"Matched Data: UNION SELECT username FROM found within ARGS:q: UNION SELECT username FROM users","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-sqli","paranoia-level/1","OWASP_CRS","OWASP_CRS/ATTACK-SQLI","capec/1000/152/248/66"],"maturity":"0","accuracy":"0"}},{"message":"Detects MySQL comment-/space-obfuscated injections and backtick termination","details":{"match":"Matched \"Operator `Rx' with parameter `(?i)(?:,[^\\)]*?(?:[0-9a-f]+|\\([0-9a-f]+\\))|\\([^,]+(?:,[\\s\\x0b]*[0-9a-f]+)+\\))(?:$|[\\\"'`](?:$|[^\\\"'`]+[\\\"'`])|(?:\\r?\\n)?\\z)|,[^\\)]*?[\\\"'`][^\\\"'`]+[\\\"'`]|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alte (116 characters omitted)' against variable `ARGS:q' (Value: `UNION SELECT username FROM users' )","reference":"o5,21v8,32t:urlDecodeUni","ruleId":"942200","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf","lineNumber":"844","data":"Matched Data:  SELECT username FROM found within ARGS:q: UNION SELECT username FROM users","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-sqli","paranoia-level/2","OWASP_CRS","OWASP_CRS/ATTACK-SQLI","capec/1000/152/248/66"],"maturity":"0","accuracy":"0"}},{"message":"Detects basic SQL authentication bypass attempts 2/3","details":{"match":"Matched \"Operator `Rx' with parameter `(?i)[\\\"'`][\\s\\x0b]*?(?:(?:and|n(?:and|ot)|(?:xx?)?or|div|like|between|\\|\\||&&)[\\s\\x0b]+[\\s\\x0b0-9A-Z_a-z]+=[\\s\\x0b]*?[0-9A-Z_a-z]+[\\s\\x0b]*?having[\\s\\x0b]+|like[^0-9A-Z_a-z]*?[\\\"'0-9`])|[0-9A-Z_a-z][\\ (109 characters omitted)' against variable `ARGS:q' (Value: `UNION SELECT username FROM users' )","reference":"o6,21v8,32t:urlDecodeUni","ruleId":"942260","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf","lineNumber":"899","data":"Matched Data: SELECT username FROM  found within ARGS:q: UNION SELECT username FROM users","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-sqli","paranoia-level/2","OWASP_CRS","OWASP_CRS/ATTACK-SQLI","capec/1000/152/248/66"],"maturity":"0","accuracy":"0"}},{"message":"SQL Injection Attack","details":{"match":"Matched \"Operator `Rx' with parameter `(?i)\\b(?:(?:d(?:bms_[0-9A-Z_a-z]+\\.|elete\\b[^0-9A-Z_a-z]*?\\bfrom)|(?:group\\b.*?\\bby\\b.{1,100}?\\bhav|overlay\\b[^0-9A-Z_a-z]*?\\(.*?\\b[^0-9A-Z_a-z]*?plac)ing|in(?:ner\\b[^0-9A-Z_a-z]*?\\bjoin|sert\\b[^0-9A- (448 characters omitted)' against variable `ARGS:q' (Value: `UNION SELECT username FROM users' )","reference":"o0,12v8,32t:urlDecodeUni","ruleId":"942480","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf","lineNumber":"1268","data":"Matched Data: UNION SELECT found within ARGS:q: UNION SELECT username FROM users","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-sqli","paranoia-level/2","OWASP_CRS","OWASP_CRS/ATTACK-SQLI","capec/1000/152/248/66"],"maturity":"0","accuracy":"0"}},{"message":"Inbound Anomaly Score Exceeded (Total Score: 33)","details":{"match":"Matched \"Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `33' )","reference":"","ruleId":"949110","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf","lineNumber":"222","data":"","severity":"0","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","anomaly-evaluation","OWASP_CRS"],"maturity":"0","accuracy":"0"}}]}}
{"transaction":{"client_ip":"186.30.7.141","time_stamp":"Thu May 28 01:23:46 2026","server_id":"58b7ef43d23c6bee4e73267fe6ca89b3e7907335","client_port":61954,"host_ip":"10.116.4.114","host_port":8080,"unique_id":"177993142638.042863","is_interrupted":true,"request":{"method":"GET","http_version":"1.1","hostname":"138.197.228.148","uri":"/?x=%3Cscript%3Ealert(1)%3C/script%3E","headers":{"Host":"138.197.228.148","User-Agent":"curl/8.7.1","Accept":"*/*"}},"response":{"body":"<html>\r\n<head><title>403 Forbidden</title></head>\r\n<body>\r\n<center><h1>403 Forbidden</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n","http_code":403,"headers":{"Server":"nginx\u0000","Date":"Thu, 28 May 2026 01:23:46 GMT","Content-Length":"146","Content-Type":"text/html","Access-Control-Allow-Origin":"*","Connection":"keep-alive","Access-Control-Max-Age":"3600","Access-Control-Allow-Methods":"GET, POST, PUT, DELETE, OPTIONS","Access-Control-Allow-Headers":"*"}},"producer":{"modsecurity":"ModSecurity v3.0.15 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/4.25.0\""]},"messages":[{"message":"Host header is a numeric IP address","details":{"match":"Matched \"Operator `Rx' with parameter `(?:^([\\d.]+|\\[[\\da-f:]+\\]|[\\da-f:]+)(:[\\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `138.197.228.148' )","reference":"o0,15o0,15v57,15","ruleId":"920350","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf","lineNumber":"757","data":"138.197.228.148","severity":"4","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-protocol","paranoia-level/1","OWASP_CRS","OWASP_CRS/PROTOCOL-ENFORCEMENT","capec/1000/210/272"],"maturity":"0","accuracy":"0"}},{"message":"XSS Attack Detected via libinjection","details":{"match":"detected XSS using libinjection.","reference":"v8,25t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941100","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"83","data":"Matched Data: XSS data found within ARGS:x: <script>alert(1)</script>","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-xss","xss-perf-disable","paranoia-level/1","OWASP_CRS","OWASP_CRS/ATTACK-XSS","capec/1000/152/242"],"maturity":"0","accuracy":"0"}},{"message":"XSS Filter - Category 1: Script Tag Vector","details":{"match":"Matched \"Operator `Rx' with parameter `(?i)<script[^>]*>[\\s\\S]*?' against variable `ARGS:x' (Value: `<script>alert(1)</script>' )","reference":"o0,8v8,25t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941110","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"110","data":"Matched Data: <script> found within ARGS:x: <script>alert(1)</script>","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-xss","xss-perf-disable","paranoia-level/1","OWASP_CRS","OWASP_CRS/ATTACK-XSS","capec/1000/152/242"],"maturity":"0","accuracy":"0"}},{"message":"NoScript XSS InjectionChecker: HTML Injection","details":{"match":"Matched \"Operator `Rx' with parameter `(?i)<[^0-9<>A-Z_a-z]*(?:[^\\s\\x0b\\\"'<>]*:)?[^0-9<>A-Z_a-z]*[^0-9A-Z_a-z]*?(?:s[^0-9A-Z_a-z]*?(?:c[^0-9A-Z_a-z]*?r[^0-9A-Z_a-z]*?i[^0-9A-Z_a-z]*?p[^0-9A-Z_a-z]*?t|t[^0-9A-Z_a-z]*?y[^0-9A-Z_a-z]*?l[^0-9A (4396 characters omitted)' against variable `ARGS:x' (Value: `<script>alert(1)</script>' )","reference":"o0,7v8,25t:utf8toUnicode,t:urlDecodeUni,t:htmlEntityDecode,t:jsDecode,t:cssDecode,t:removeNulls","ruleId":"941160","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"248","data":"Matched Data: <script found within ARGS:x: <script>alert(1)</script>","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-xss","xss-perf-disable","paranoia-level/1","OWASP_CRS","OWASP_CRS/ATTACK-XSS","capec/1000/152/242"],"maturity":"0","accuracy":"0"}},{"message":"Javascript method detected","details":{"match":"Matched \"Operator `Rx' with parameter `(?i)\\b(?:eval|set(?:timeout|interval)|new[\\s\\x0b]+Function|a(?:lert|tob)|btoa|(?:promp|impor)t|con(?:firm|sole\\.(?:log|dir))|fetch)[\\s\\x0b]*[\\(\\{]' against variable `ARGS:x' (Value: `<script>alert(1)</script>' )","reference":"o8,6v8,25t:htmlEntityDecode,t:jsDecode","ruleId":"941390","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"816","data":"Matched Data: alert( found within ARGS:x: <script>alert(1)</script>","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-nodejs","attack-xss","xss-perf-disable","paranoia-level/1","OWASP_CRS","OWASP_CRS/ATTACK-XSS","capec/1000/152/242"],"maturity":"0","accuracy":"0"}},{"message":"Possible XSS Attack Detected - HTML Tag Handler","details":{"match":"Matched \"Operator `Rx' with parameter `<(?:a(?:bbr|cronym|ddress|pplet|rea|udioscope)?|b(?:ase(?:front)?|do|gsound|ig|l(?:(?:ackfac|ockquot)e|ink)|ody|[qr]|utton)?|c(?:aption|enter|ite|o(?:de|l(?:group)?|mment))|d(?:[dt]|e?l|fn|i[rv])|em(? (489 characters omitted)' against variable `ARGS:x' (Value: `<script>alert(1)</script>' )","reference":"o0,8v8,25t:jsDecode,t:lowercase","ruleId":"941320","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-941-APPLICATION-ATTACK-XSS.conf","lineNumber":"1033","data":"Matched Data: <script> found within ARGS:x: <script>alert(1)</script>","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-xss","xss-perf-disable","paranoia-level/2","OWASP_CRS","OWASP_CRS/ATTACK-XSS","capec/1000/152/242/63"],"maturity":"0","accuracy":"0"}},{"message":"SQL Injection Attack: SQL Boolean-based attack detected","details":{"match":"Matched \"Operator `Rx' with parameter `(?i)[\\s\\x0b\\\"'-\\)`]*?\\b([0-9A-Z_a-z]+)\\b[\\s\\x0b\\\"'-\\)`]*?(?:![<->]|<[=>]?|>=?|\\^|is[\\s\\x0b]+not|not[\\s\\x0b]+(?:like|r(?:like|egexp)))[\\s\\x0b\\\"'-\\)`]*?\\b([0-9A-Z_a-z]+)\\b' against variable `ARGS:x' (Value: `<script>alert(1)</script>' )","reference":"o1,12o1,6o8,5v8,25","ruleId":"942131","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf","lineNumber":"735","data":"Matched Data: script>alert found within ARGS:x: <script>alert(1)</script>","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["application-multi","language-multi","platform-multi","attack-sqli","paranoia-level/2","OWASP_CRS","OWASP_CRS/ATTACK-SQLI","capec/1000/152/248/66"],"maturity":"0","accuracy":"0"}},{"message":"Inbound Anomaly Score Exceeded (Total Score: 33)","details":{"match":"Matched \"Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `33' )","reference":"","ruleId":"949110","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf","lineNumber":"222","data":"","severity":"0","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","anomaly-evaluation","OWASP_CRS"],"maturity":"0","accuracy":"0"}}]}}
{"transaction":{"client_ip":"186.30.7.141","time_stamp":"Thu May 28 01:23:46 2026","server_id":"58b7ef43d23c6bee4e73267fe6ca89b3e7907335","client_port":61955,"host_ip":"10.116.4.114","host_port":8080,"unique_id":"177993142662.117846","is_interrupted":false,"request":{"method":"GET","http_version":"1.1","hostname":"138.197.228.148","uri":"/etc/passwd","headers":{"Host":"138.197.228.148","User-Agent":"curl/8.7.1","Accept":"*/*"}},"response":{"body":"","http_code":404,"headers":{"Strict-Transport-Security":"max-age=31536000; includeSubDomains; preload","Cache-Control":"no-store, no-cache, must-revalidate","X-Frame-Options":"DENY","vary":"Origin","X-XSS-Protection":"1; mode=block","Access-Control-Allow-Headers":"*","Access-Control-Allow-Credentials":"true","Server":"nginx\u0000","Connection":"keep-alive","X-Content-Type-Options":"nosniff","X-Kong-Response-Latency":"0","Content-Type":"application/json; charset=utf-8","Content-Length":"103","Date":"Thu, 28 May 2026 01:23:46 GMT","Referrer-Policy":"strict-origin-when-cross-origin","Permissions-Policy":"camera=(), microphone=(), geolocation=()","X-Kong-Request-Id":"53254d791672192ed376bb6341436458"}},"producer":{"modsecurity":"ModSecurity v3.0.15 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/4.25.0\""]},"messages":[{"message":"Host header is a numeric IP address","details":{"match":"Matched \"Operator `Rx' with parameter `(?:^([\\d.]+|\\[[\\da-f:]+\\]|[\\da-f:]+)(:[\\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `138.197.228.148' )","reference":"o0,15o0,15v31,15","ruleId":"920350","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf","lineNumber":"757","data":"138.197.228.148","severity":"4","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-protocol","paranoia-level/1","OWASP_CRS","OWASP_CRS/PROTOCOL-ENFORCEMENT","capec/1000/210/272"],"maturity":"0","accuracy":"0"}}]}}
{"transaction":{"client_ip":"186.30.7.141","time_stamp":"Thu May 28 01:23:46 2026","server_id":"58b7ef43d23c6bee4e73267fe6ca89b3e7907335","client_port":61956,"host_ip":"10.116.4.114","host_port":8080,"unique_id":"177993142622.527472","is_interrupted":true,"request":{"method":"GET","http_version":"1.1","hostname":"138.197.228.148","uri":"/?cmd=;cat%20/etc/passwd","headers":{"Host":"138.197.228.148","User-Agent":"curl/8.7.1","Accept":"*/*"}},"response":{"body":"<html>\r\n<head><title>403 Forbidden</title></head>\r\n<body>\r\n<center><h1>403 Forbidden</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n","http_code":403,"headers":{"Server":"nginx\u0000","Date":"Thu, 28 May 2026 01:23:46 GMT","Content-Length":"146","Content-Type":"text/html","Access-Control-Allow-Origin":"*","Connection":"keep-alive","Access-Control-Max-Age":"3600","Access-Control-Allow-Methods":"GET, POST, PUT, DELETE, OPTIONS","Access-Control-Allow-Headers":"*"}},"producer":{"modsecurity":"ModSecurity v3.0.15 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/4.25.0\""]},"messages":[{"message":"Host header is a numeric IP address","details":{"match":"Matched \"Operator `Rx' with parameter `(?:^([\\d.]+|\\[[\\da-f:]+\\]|[\\da-f:]+)(:[\\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `138.197.228.148' )","reference":"o0,15o0,15v44,15","ruleId":"920350","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf","lineNumber":"757","data":"138.197.228.148","severity":"4","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-protocol","paranoia-level/1","OWASP_CRS","OWASP_CRS/PROTOCOL-ENFORCEMENT","capec/1000/210/272"],"maturity":"0","accuracy":"0"}},{"message":"OS File Access Attempt","details":{"match":"Matched \"Operator `PmFromFile' with parameter `lfi-os-files.data' against variable `ARGS:cmd' (Value: `;cat /etc/passwd' )","reference":"o6,10v10,16t:utf8toUnicode,t:urlDecodeUni,t:normalizePathWin","ruleId":"930120","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf","lineNumber":"104","data":"Matched Data: etc/passwd found within ARGS:cmd: ;cat /etc/passwd","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-lfi","paranoia-level/1","OWASP_CRS","OWASP_CRS/ATTACK-LFI","capec/1000/255/153/126"],"maturity":"0","accuracy":"0"}},{"message":"Remote Command Execution: Unix Shell Code Found","details":{"match":"Matched \"Operator `PmFromFile' with parameter `unix-shell.data' against variable `ARGS:cmd' (Value: `;cat /etc/passwd' )","reference":"o5,10v10,16t:cmdLine,t:normalizePath","ruleId":"932160","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf","lineNumber":"706","data":"Matched Data: etc/passwd found within ARGS:cmd:  cat/etc/passwd","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-shell","platform-unix","attack-rce","paranoia-level/1","OWASP_CRS","OWASP_CRS/ATTACK-RCE","capec/1000/152/248/88"],"maturity":"0","accuracy":"0"}},{"message":"Remote Command Execution: Unix Command Injection (command without evasion)","details":{"match":"Matched \"Operator `Rx' with parameter `(?i)(?:^|b[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?u[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)?\\$[!#\\(\\*\\-0-9\\?@_a-\\{]*)?\\x5c?s[\\\"'\\)\\[\\x5c]*(?:(?:(?:\\|\\||&&)[\\s\\x0b]*)? (9767 characters omitted)' against variable `ARGS:cmd' (Value: `;cat /etc/passwd' )","reference":"o0,5v10,16","ruleId":"932236","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-932-APPLICATION-ATTACK-RCE.conf","lineNumber":"1679","data":"Matched Data: ;cat  found within ARGS:cmd: ;cat /etc/passwd","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-shell","platform-unix","attack-rce","paranoia-level/2","OWASP_CRS","OWASP_CRS/ATTACK-RCE","capec/1000/152/248/88"],"maturity":"0","accuracy":"0"}},{"message":"Inbound Anomaly Score Exceeded (Total Score: 18)","details":{"match":"Matched \"Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `18' )","reference":"","ruleId":"949110","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf","lineNumber":"222","data":"","severity":"0","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","anomaly-evaluation","OWASP_CRS"],"maturity":"0","accuracy":"0"}}]}}
{"transaction":{"client_ip":"186.30.7.141","time_stamp":"Thu May 28 01:23:46 2026","server_id":"58b7ef43d23c6bee4e73267fe6ca89b3e7907335","client_port":61957,"host_ip":"10.116.4.114","host_port":8080,"unique_id":"17799314261.408187","is_interrupted":true,"request":{"method":"GET","http_version":"1.1","hostname":"138.197.228.148","uri":"/","headers":{"Host":"138.197.228.148","Accept":"*/*","User-Agent":"sqlmap/1.0"}},"response":{"body":"<html>\r\n<head><title>403 Forbidden</title></head>\r\n<body>\r\n<center><h1>403 Forbidden</h1></center>\r\n<hr><center>nginx</center>\r\n</body>\r\n</html>\r\n","http_code":403,"headers":{"Server":"nginx\u0000","Date":"Thu, 28 May 2026 01:23:46 GMT","Content-Length":"146","Content-Type":"text/html","Access-Control-Allow-Origin":"*","Connection":"keep-alive","Access-Control-Max-Age":"3600","Access-Control-Allow-Methods":"GET, POST, PUT, DELETE, OPTIONS","Access-Control-Allow-Headers":"*"}},"producer":{"modsecurity":"ModSecurity v3.0.15 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/4.25.0\""]},"messages":[{"message":"Found User-Agent associated with security scanner","details":{"match":"Matched \"Operator `PmFromFile' with parameter `scanners-user-agents.data' against variable `REQUEST_HEADERS:User-Agent' (Value: `sqlmap/1.0' )","reference":"o0,6v61,10","ruleId":"913100","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-913-SCANNER-DETECTION.conf","lineNumber":"38","data":"Matched Data: sqlmap found within REQUEST_HEADERS:User-Agent: sqlmap/1.0","severity":"2","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-reputation-scanner","paranoia-level/1","OWASP_CRS","OWASP_CRS/SCANNER-DETECTION","capec/1000/118/224/541/310"],"maturity":"0","accuracy":"0"}},{"message":"Host header is a numeric IP address","details":{"match":"Matched \"Operator `Rx' with parameter `(?:^([\\d.]+|\\[[\\da-f:]+\\]|[\\da-f:]+)(:[\\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `138.197.228.148' )","reference":"o0,15o0,15v21,15","ruleId":"920350","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf","lineNumber":"757","data":"138.197.228.148","severity":"4","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-protocol","paranoia-level/1","OWASP_CRS","OWASP_CRS/PROTOCOL-ENFORCEMENT","capec/1000/210/272"],"maturity":"0","accuracy":"0"}},{"message":"Inbound Anomaly Score Exceeded (Total Score: 8)","details":{"match":"Matched \"Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `8' )","reference":"","ruleId":"949110","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf","lineNumber":"222","data":"","severity":"0","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","anomaly-evaluation","OWASP_CRS"],"maturity":"0","accuracy":"0"}}]}}
{"transaction":{"client_ip":"10.100.0.5","time_stamp":"Thu May 28 01:23:47 2026","server_id":"58b7ef43d23c6bee4e73267fe6ca89b3e7907335","client_port":61958,"host_ip":"10.116.4.114","host_port":8080,"unique_id":"177993142777.658287","is_interrupted":false,"request":{"method":"GET","http_version":"1.1","hostname":"138.197.228.148","uri":"/api/v1/health","headers":{"Host":"138.197.228.148","User-Agent":"curl/8.7.1","Accept":"*/*"}},"response":{"body":"","http_code":404,"headers":{"Strict-Transport-Security":"max-age=31536000; includeSubDomains; preload","Cache-Control":"no-store, no-cache, must-revalidate","X-Frame-Options":"DENY","vary":"Origin","X-XSS-Protection":"1; mode=block","Access-Control-Allow-Headers":"*","Access-Control-Allow-Credentials":"true","Server":"nginx\u0000","Connection":"keep-alive","X-Content-Type-Options":"nosniff","X-Kong-Response-Latency":"1","Content-Type":"application/json; charset=utf-8","Content-Length":"103","Date":"Thu, 28 May 2026 01:23:47 GMT","Referrer-Policy":"strict-origin-when-cross-origin","Permissions-Policy":"camera=(), microphone=(), geolocation=()","X-Kong-Request-Id":"c8f1a81d947f3a26d1a4e74bcdb32902"}},"producer":{"modsecurity":"ModSecurity v3.0.15 (Linux)","connector":"ModSecurity-nginx v1.0.4","secrules_engine":"Enabled","components":["OWASP_CRS/4.25.0\""]},"messages":[{"message":"Host header is a numeric IP address","details":{"match":"Matched \"Operator `Rx' with parameter `(?:^([\\d.]+|\\[[\\da-f:]+\\]|[\\da-f:]+)(:[\\d]+)?$)' against variable `REQUEST_HEADERS:Host' (Value: `138.197.228.148' )","reference":"o0,15o0,15v34,15","ruleId":"920350","file":"/etc/modsecurity.d/owasp-crs/rules/REQUEST-920-PROTOCOL-ENFORCEMENT.conf","lineNumber":"757","data":"138.197.228.148","severity":"4","ver":"OWASP_CRS/4.25.0","rev":"","tags":["modsecurity","application-multi","language-multi","platform-multi","attack-protocol","paranoia-level/1","OWASP_CRS","OWASP_CRS/PROTOCOL-ENFORCEMENT","capec/1000/210/272"],"maturity":"0","accuracy":"0"}}]}}
