We’re currently running Magento Open Source 2.3.2-p2, CloudFlare w/ web application firewall, and Google Captcha enabled.
Recently, we experienced what we believe was an attempt to probe or attack our Payment Service via the Guest Cart checkout, we became aware after we got alerted of suspicious transactions by our payment gateway service provider, Authorize.Net.
After reviewing the access-logs, here is a summary of what we think took place:
– Following what seems to be a normal checkout flow initially from one IP
– There was a 5 minute delay
– Then our store got hit with a bunch of POSTs to the guest cart payment-information (replicated URIs), coming rapidly with changing IPs but with the same Cart ID; all within a span of less than 3 minutes. We suspect that a script was probably used to post to the payment-information service with different values (a snippet from the access-logs associated with the attack is enclosed below).
We’re wondering if anyone else has experienced a similar issue and can share on what was done to mitigate or secure what seems to be a vulnerability.
Regards,
Immanuel
========== snippet from the access-logs ===========
Normal checkout flow initially from one IP:
185.33.34.174 – – [23/Apr/2020:10:32:11 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/totals-information HTTP/1.1” 200 1529 “https://example.com/checkout/cart/” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.113 Safari/537.36”
185.33.34.174 – – [23/Apr/2020:10:32:11 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/totals-information HTTP/1.1” 200 1529 “https://example.com/checkout/cart/” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.113 Safari/537.36”
185.33.34.174 – – [23/Apr/2020:10:32:12 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/totals-information HTTP/1.1” 200 1529 “https://example.com/checkout/cart/” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.113 Safari/537.36”
185.33.34.174 – – [23/Apr/2020:10:32:20 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/estimate-shipping-methods HTTP/1.1” 200 319 “https://example.com/checkout/” “Mozilla/5.0…”
185.33.34.174 – – [23/Apr/2020:10:32:21 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/totals-information HTTP/1.1” 200 1529 “https://example.com/checkout/” “Mozilla/5.0…”
185.33.34.174 – – [23/Apr/2020:10:32:30 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/estimate-shipping-methods HTTP/1.1” 200 1325 “https://example.com/checkout/” “Mozilla/5.0…”
185.33.34.174 – – [23/Apr/2020:10:32:30 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/totals-information HTTP/1.1” 200 1529 “https://example.com/checkout/” “Mozilla/5.0…”
185.33.34.174 – – [23/Apr/2020:10:32:35 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/totals-information HTTP/1.1” 200 1446 “https://example.com/checkout/” “Mozilla/5.0…”
185.33.34.174 – – [23/Apr/2020:10:32:44 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/shipping-information HTTP/1.1” 200 2069 “https://example.com/checkout/” “Mozilla/5.0…”
185.33.34.174 – – [23/Apr/2020:10:32:44 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/totals-information HTTP/1.1” 200 1446 “https://example.com/checkout/” “Mozilla/5.0…”
185.33.34.174 – – [23/Apr/2020:10:32:55 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/totals-information HTTP/1.1” 200 1446 “https://example.com/checkout/” “Mozilla/5.0…”
185.33.34.174 – – [23/Apr/2020:10:33:11 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
185.33.34.174 – – [23/Apr/2020:10:33:39 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 41 “https://example.com/checkout/” “Mozilla/5.0…”
5 Minutes delay
Then the POST’s start coming rapidly with changing IPs, but with the same Guest Cart ID of “JwixEwZt6FK”.
A script was probably written to post to the payment information service with different values:
178.171.22.149 – – [23/Apr/2020:10:38:23 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36”
173.211.105.41 – – [23/Apr/2020:10:38:24 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36”
178.171.59.43 – – [23/Apr/2020:10:38:34 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.163 Safari/537.36”
185.33.34.174 – – [23/Apr/2020:10:38:39 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
216.74.104.28 – – [23/Apr/2020:10:38:52 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
45.13.28.153 – – [23/Apr/2020:10:39:21 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
185.33.34.174 – – [23/Apr/2020:10:39:39 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 96 “https://example.com/checkout/” “Mozilla/5.0 …”
178.171.102.55 – – [23/Apr/2020:10:40:17 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
45.73.171.122 – – [23/Apr/2020:10:40:17 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.47.245 – – [23/Apr/2020:10:40:18 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.45.247 – – [23/Apr/2020:10:40:20 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
216.158.214.205 – – [23/Apr/2020:10:40:19 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
172.85.104.153 – – [23/Apr/2020:10:40:24 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
185.88.37.190 – – [23/Apr/2020:10:40:25 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
88.214.0.169 – – [23/Apr/2020:10:40:19 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.22.148 – – [23/Apr/2020:10:40:30 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
193.31.75.78 – – [23/Apr/2020:10:40:32 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
156.0.109.131 – – [23/Apr/2020:10:40:27 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
92.240.205.174 – – [23/Apr/2020:10:40:36 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.42.169 – – [23/Apr/2020:10:40:38 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
216.74.108.121 – – [23/Apr/2020:10:40:35 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
212.80.200.59 – – [23/Apr/2020:10:40:40 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
213.182.202.168 – – [23/Apr/2020:10:40:44 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.92.45 – – [23/Apr/2020:10:40:41 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
88.214.0.129 – – [23/Apr/2020:10:40:46 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
158.46.187.25 – – [23/Apr/2020:10:40:55 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
104.227.135.156 – – [23/Apr/2020:10:41:10 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
89.185.78.54 – – [23/Apr/2020:10:41:26 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.1.245 – – [23/Apr/2020:10:41:29 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
91.195.111.137 – – [23/Apr/2020:10:41:28 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.23.31 – – [23/Apr/2020:10:41:35 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.117.56 – – [23/Apr/2020:10:41:36 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
212.80.200.229 – – [23/Apr/2020:10:41:40 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
181.215.79.162 – – [23/Apr/2020:10:41:39 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
173.211.87.2 – – [23/Apr/2020:10:41:40 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.45.128 – – [23/Apr/2020:10:41:41 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
158.46.183.16 – – [23/Apr/2020:10:41:47 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
185.201.130.13 – – [23/Apr/2020:10:41:48 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
181.215.0.252 – – [23/Apr/2020:10:41:49 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.42.255 – – [23/Apr/2020:10:41:50 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.91.180 – – [23/Apr/2020:10:41:46 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
158.46.219.92 – – [23/Apr/2020:10:41:51 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.102.35 – – [23/Apr/2020:10:41:51 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
173.211.104.76 – – [23/Apr/2020:10:41:51 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 926 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.60.169 – – [23/Apr/2020:10:41:47 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
158.46.183.129 – – [23/Apr/2020:10:41:54 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.42.85 – – [23/Apr/2020:10:41:53 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
213.182.197.219 – – [23/Apr/2020:10:41:55 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 926 “https://example.com/checkout/” “Mozilla/5.0…”
158.46.185.191 – – [23/Apr/2020:10:41:56 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 926 “https://example.com/checkout/” “Mozilla/5.0…”
38.131.154.179 – – [23/Apr/2020:10:41:52 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
216.74.106.238 – – [23/Apr/2020:10:41:53 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 926 “https://example.com/checkout/” “Mozilla/5.0…”
88.214.0.68 – – [23/Apr/2020:10:41:53 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 926 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.23.33 – – [23/Apr/2020:10:41:57 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.108.143 – – [23/Apr/2020:10:41:57 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.67.229 – – [23/Apr/2020:10:41:57 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.58.89 – – [23/Apr/2020:10:41:45 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.109.108 – – [23/Apr/2020:10:41:59 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.59.106 – – [23/Apr/2020:10:41:59 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 926 “https://example.com/checkout/” “Mozilla/5.0…”
173.211.125.133 – – [23/Apr/2020:10:41:59 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 926 “https://example.com/checkout/” “Mozilla/5.0…”
5.182.124.165 – – [23/Apr/2020:10:41:59 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 926 “https://example.com/checkout/” “Mozilla/5.0…”
158.46.186.153 – – [23/Apr/2020:10:41:59 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.109.231 – – [23/Apr/2020:10:42:02 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
193.160.79.117 – – [23/Apr/2020:10:41:51 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.43.60 – – [23/Apr/2020:10:42:02 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
181.214.26.219 – – [23/Apr/2020:10:42:05 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 926 “https://example.com/checkout/” “Mozilla/5.0…”
158.46.187.19 – – [23/Apr/2020:10:42:05 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
158.46.187.10 – – [23/Apr/2020:10:42:05 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.64.52 – – [23/Apr/2020:10:42:04 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
181.214.26.180 – – [23/Apr/2020:10:42:05 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 926 “https://example.com/checkout/” “Mozilla/5.0…”
158.46.181.74 – – [23/Apr/2020:10:42:04 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.44.170 – – [23/Apr/2020:10:41:48 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
216.74.77.28 – – [23/Apr/2020:10:41:56 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
158.46.187.254 – – [23/Apr/2020:10:42:11 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
92.240.204.39 – – [23/Apr/2020:10:42:10 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 926 “https://example.com/checkout/” “Mozilla/5.0…”
185.15.177.215 – – [23/Apr/2020:10:42:12 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 926 “https://example.com/checkout/” “Mozilla/5.0…”
176.105.249.141 – – [23/Apr/2020:10:42:10 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
181.214.248.137 – – [23/Apr/2020:10:42:10 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.46.203 – – [23/Apr/2020:10:42:14 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.38.53 – – [23/Apr/2020:10:42:12 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 926 “https://example.com/checkout/” “Mozilla/5.0…”
158.46.183.43 – – [23/Apr/2020:10:42:06 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
181.214.44.172 – – [23/Apr/2020:10:42:15 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 503 925 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.43.33 – – [23/Apr/2020:10:42:15 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
216.158.206.90 – – [23/Apr/2020:10:41:45 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
191.96.82.205 – – [23/Apr/2020:10:42:16 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
191.101.146.46 – – [23/Apr/2020:10:42:13 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.125.210 – – [23/Apr/2020:10:42:18 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.44.179 – – [23/Apr/2020:10:42:14 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
193.31.73.91 – – [23/Apr/2020:10:42:40 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
92.240.204.245 – – [23/Apr/2020:10:42:59 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
185.201.130.32 – – [23/Apr/2020:10:42:59 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
178.171.43.75 – – [23/Apr/2020:10:43:03 -0500] “POST /rest/default/V1/guest-carts/JwixEwZt6FK/payment-information HTTP/1.1” 400 83 “https://example.com/checkout/” “Mozilla/5.0…”
