---hNXNazwk---A--
[01/Mar/2026:20:41:55 -0500] 177241571537.088552 66.249.68.130 0 unix:/var/run/nginx/nginx.sock 0
---hNXNazwk---B--
GET /forum/viewtopic.php?t=5635 HTTP/1.1
Host: example.com
From: googlebot(at)googlebot.com
User-Agent: Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/144.0.7559.132 Mobile Safari/537.36 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)
Accept: text/html,application/xhtml+xml,application/signed-exchange;v=b3,application/xml;q=0.9,*/*;q=0.8
Accept-Encoding: gzip, deflate, br
Amp-Cache-Transform: google;v="1..8"
X-Anubis-Rule: bot/googlebot
X-Anubis-Action: ALLOW
X-Http-Fingerprint-Ja4h: ge11nn080000_3718453403af_000000000000_000000000000
X-Forwarded-For: 127.0.0.1
X-Http-Version: HTTP/1.1
X-Real-Ip: 66.249.68.130

---hNXNazwk---D--

---hNXNazwk---F--
HTTP/1.1 403
Server: nginx/1.28.2
Date: Mon, 02 Mar 2026 01:41:55 GMT
Content-Length: 555
Content-Type: text/html
Connection: keep-alive

---hNXNazwk---H--
ModSecurity: Warning. Matched "Operator `Rx' with parameter `(?i),.*?(?:[\)0-9a-f](?:$|[\"'`](?:$|[^\"'`]+[\"'`])|(?:\r?\n)?\z)|[\"'`][^\"'`]+[\"'`])|[^0-9A-Z_a-z]select.+[^0-9A-Z_a-z]*?from|(?:alter|(?:(?:cre|trunc|upd)at|renam)e|d(?:e(?:lete|sc)|rop)|(?:inser (53 characters omitted)' against variable `REQUEST_HEADERS:User-Agent' (Value: `Mozilla/5.0 (Linux; Android 6.0.1; Nexus 5X Build/MMB29P) AppleWebKit/537.36 (KHTML, like Gecko) Chr (100 characters omitted)' ) [file "/usr/local/etc/modsecurity/owasp-modsecurity-crs/rules/REQUEST-942-APPLICATION-ATTACK-SQLI.conf"] [line "834"] [id "942200"] [rev ""] [msg "Detects MySQL comment-/space-obfuscated injections and backtick termination"] [data "Matched Data: , like Gecko) Chrome/144.0.7559.132 Mobile Safari/537.36 (compatible; Googlebot/2.1;  http://www.google.com/bot.html) found within REQUEST_HEADERS:User-Agent: Mozilla/5.0 (Linux; Android (173 characters omitted)"] [severity "2"] [ver "OWASP_CRS/4.24.0"] [maturity "0"] [accuracy "0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-sqli"] [tag "paranoia-level/2"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-SQLI"] [tag "capec/1000/152/248/66"] [hostname "unix:/var/run/nginx/nginx.sock"] [uri "/forum/viewtopic.php"] [unique_id "177241571537.088552"] [ref "o83,117v68,200t:urlDecodeUni"]
ModSecurity: Access denied with code 403 (phase 2). Matched "Operator `Ge' with parameter `5' against variable `TX:BLOCKING_INBOUND_ANOMALY_SCORE' (Value: `5' ) [file "/usr/local/etc/modsecurity/owasp-modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "222"] [id "949110"] [rev ""] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [data ""] [severity "0"] [ver "OWASP_CRS/4.24.0"] [maturity "0"] [accuracy "0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "unix:/var/run/nginx/nginx.sock"] [uri "/forum/viewtopic.php"] [unique_id "177241571537.088552"] [ref ""]