HMWP ID Alert

[berkoz912]

Could someone please explain what this is.I’ve recieved it via email 2 days in a row. Is it something I should worry about?

The following potential attack has been detected by HMWP IDS

. If it’s done by you please Exclude it from Intrusions Log page or increase Notify Threshold from IDS settings.

IP: 142.54.172.210
User ID: 0
Date: 2015-06-17T19:17:16+00:00
Total Impact: 50
Affected tags: xss csrf sqli id lfi

Affected parameters: REQUEST.excerpt=%3Ca+href%3D%5C%22http%3A%2F%2Fplant.opat.ac.th%2Fmac-cleanup-off-60-pwt2n-435%2F8657%2F%5C%22%3Emac+cleanup+off+60%25+PWT2N+435++%3Ca+href%3D%5C%22http%3A%2F%2Fdogtraining-blog.com%2F6741%2Fmac-woodwinked-eyeshadow-tlpqe-658%2F%5C%22%3Emac+woodwinked+eyeshadow+See+How+Low+We+can+Go+TLPQE+658++%3Ca+href%3D%5C%22http%3A%2F%2Flexington-properties.com%2Fmac-studio-fix-concealer-with-discount-w7sun-566%2F%5C%22%3Emac+studio+fix+concealer+With+Discount+W7SUN+566%3C%2Fa%3E+%3Ca+href%3D%5C%22http%3A%2F%2Fwww.vitacrown.biz%2Fwholesale-mac-glitter-lipstick-r41rn1pxwy.html%5C%22%3Ewholesale+mac+glitter+lipstick-R41Rn1PxWy++%3Ca+href%3D%5C%22http%3A%2F%2Fwww.skalanes.com%2F2015%2F06%2F12%2Fnordstrom-mac-makeup-r1xpsyxwgc%2F%5C%22%3ESk%E8%B0%A9lanes+%E7%A6%84+nordstrom+mac+makeup-R1xPsYxwGC%3C%2Fa%3E+%3Ca+href%3D%5C%22http%3A%2F%2Fmidwestrail.org%2F2015%2F06%2Fwholesale-mac-cosmetics-nederland-enqihfcls1%2F%5C%22%3Ewholesale+mac+cosmetics+nederland-ENQiHFcLs1, POST.excerpt=%3Ca+href%3D%5C%22http%3A%2F%2Fplant.opat.ac.th%2Fmac-cleanup-off-60-pwt2n-435%2F8657%2F%5C%22%3Emac+cleanup+off+60%25+PWT2N+435++%3Ca+href%3D%5C%22http%3A%2F%2Fdogtraining-blog.com%2F6741%2Fmac-woodwinked-eyeshadow-tlpqe-658%2F%5C%22%3Emac+woodwinked+eyeshadow+See+How+Low+We+can+Go+TLPQE+658++%3Ca+href%3D%5C%22http%3A%2F%2Flexington-properties.com%2Fmac-studio-fix-concealer-with-discount-w7sun-566%2F%5C%22%3Emac+studio+fix+concealer+With+Discount+W7SUN+566%3C%2Fa%3E+%3Ca+href%3D%5C%22http%3A%2F%2Fwww.vitacrown.biz%2Fwholesale-mac-glitter-lipstick-r41rn1pxwy.html%5C%22%3Ewholesale+mac+glitter+lipstick-R41Rn1PxWy++%3Ca+href%3D%5C%22http%3A%2F%2Fwww.skalanes.com%2F2015%2F06%2F12%2Fnordstrom-mac-makeup-r1xpsyxwgc%2F%5C%22%3ESk%E8%B0%A9lanes+%E7%A6%84+nordstrom+mac+makeup-R1xPsYxwGC%3C%2Fa%3E+%3Ca+href%3D%5C%22http%3A%2F%2Fmidwestrail.org%2F2015%2F06%2Fwholesale-mac-cosmetics-nederland-enqihfcls1%2F%5C%22%3Ewholesale+mac+cosmetics+nederland-ENQiHFcLs1,

Request URI: /long-island/trackback/
Origin: 184.154.234.85

[Suman M.]

Hi, these seem to be malicious requests (possible hack attempts). But you need not worry as HMWP PHP IDS will take care of this and will block such malicious requests if Impact level is more than 20 (default value specified in HMWP PHP IDS). You can stop receiving emails regarding this by setting “Notification Threshold” option to 0 in PHP IDS tab.

[Author]

Posts