| Entity | Type | Event time | Action taken | Ai reason | Ai confidence score | Ai details |
|---|---|---|---|---|---|---|
| UNKNOWN | tls | 2025-07-17 13:39:09 | block | Comprehensive and aggressive attack patterns including sensitive file probing, WordPress exploit attempts, web shell probing, LFI, and triggering multiple critical IP blocking and reputation rules. | 1.0 | severity: Severity.critical |
| 157.180.49.118 | ip | 2025-07-17 13:39:08 | watchlist | High request volume flagged by WAF, consistent with aggressive crawling or reconnaissance. | 0.6000000238418579 | severity: Severity.low |
| 123.6.49.50 | ip | 2025-07-17 13:39:08 | watchlist | All requests flagged by WAF including highly obfuscated paths. | 0.800000011920929 | severity: Severity.medium |
| 101.55.81.36 | ip | 2025-07-17 13:39:08 | block | High volume of requests targeting sensitive application files, configuration files, and known web shell paths, indicating an active reconnaissance and exploitation attempt. | 1.0 | severity: Severity.critical |
| 185.177.72.104 | ip | 2025-07-17 13:39:08 | block | Aggressive scanning for .env files, phpinfo, and .git configurations, directly hit IP blocking reputation rules. | 1.0 | severity: Severity.critical |
| 178.33.134.25 | ip | 2025-07-17 13:39:08 | block | 100% of requests flagged, actively scanning for common website directories and old/backup sites, coupled with browser impersonation. | 0.8999999761581421 | severity: Severity.critical |
| 185.177.72.12 | ip | 2025-07-17 13:39:08 | block | Extensive reconnaissance for sensitive application configurations and credentials, coupled with LFI attempts and multiple IP blocking rules. | 1.0 | severity: Severity.critical |
| 185.177.72.11 | ip | 2025-07-17 13:39:08 | block | Targeting highly sensitive credentials, environment files, and server info pages, directly hit IP reputation deny rules. | 1.0 | severity: Severity.critical |
| 185.177.72.204 | ip | 2025-07-17 13:39:08 | block | Targeted scanning for configuration files and source code repositories, triggering IP reputation deny rules. | 1.0 | severity: Severity.critical |