fuzzylogic
- Total activity 235
- Last activity
- Member since
- Following 0 users
- Followed by 0 users
- Votes 0
- Subscriptions 81
Comments
Recent activity by fuzzylogic-
As a matter of interest, if you research the owners of IPs behaving badly I would be interested in the numbers/percentages you find that are in fact listed public proxies or owned by telcos (possib...
-
I think you are misunderstanding LF_PERMBLOCK. It is a way to add a repeat temporary block offender to the csf.deny file. If LF_PERMBLOCK_COUNT temp blocks in LF_PERMBLOCK_INTERVAL period then add ...
-
1). Definitely not a bad idea. These IPs are revealing to us they most likely hacked sites/servers (also likely part of a group of compromised servers with a centralized control) An IP running...
-
Your regex is not right. You are using * which does not work as you intend. Use .* to do that. Here is a working version of what you tried to write... failregex = [[]client :.*[]] File does not exi...
-
I tested this on a domain on a cPanel server with "COMODO ModSecurity Apache Rule Set" as the only rule set enabled. For the first test I appended /?q="> to the https domain name (to avoid .htacce...
-
To troubleshoot your issues I need to be able to duplicate the problem. Could you please confirm the exact name of the ruleset you are using (copy it and paste it to your reply) Copy it from the Ve...
-
Hello @Waqass To diagnose the problem I would need to see... Which (of the 3 posted here) lfd custom regex rules you are using. Sample log lines from one of the access_log files you are monitorin...
-
Hello subtopic, OWASP CRS 3.2 has 29 WordPress exclusion rules in a single .conf file. You can view/get them at this url SpiderLabs/owasp-modsecurity-crs If you choose to use one or more of them I...
-
The apache access_log lines you posted are evidence that the ip address in your original post requested the whm login page. It is not evidence that they successfully logged in. See the attached scr...
-
That error message is confusing. The response from... /usr/local/cpanel/scripts/modsec_vendor list indicates that "OWASP ModSecurity Core Rule Set V3.0" is already added but not enabled, so to the...