BYB Security Cases

Real attacks. Documented protection decisions.

  1. Home
  2. BYB Security Cases

Security incidents from real-world use

These reports illustrate how BYB responds to suspicious traffic based on documented security logs. The cases are anonymized and do not represent a guarantee that every attack can be stopped.

Security Case #003 · 21.10.2026

Eight SQL injection attempts blocked across five IP addresses

The Exploit Detection log documents eight SQL injection attempts from five distinct IP addresses on 21 October 2026. All eight recorded attempts were blocked with HTTP 403. Critical events also recorded permanent IP bans, and a three-event correlation threshold was reached for one source.

Recorded requests8
Blocked requests8
HTTP responseHTTP 403

Documented timeline

  1. 11:59:27 Two critical injection attempts stopped

    Two SQL injection requests targeting a category URL were classified as critical and blocked with HTTP 403. The module log records permanent IP bans.

  2. 18:02:42–18:03:05 Four high-severity probes blocked

    Four additional requests targeting a tag URL carried UNION-based SQL injection syntax. All received HTTP 403. Their individual IP-management actions were recorded as below the automatic-ban severity threshold.

  3. 18:03:25 Critical probes and correlation threshold

    Two critical EXTRACTVALUE-based attempts received HTTP 403. For the same source, the log reports correlation values of 2/3 and 3/3 within ten minutes, as well as a permanent IP ban.

Security Case #002 · 22.10.2026

Automated SQL injection scan: 84 of 85 requests blocked

Within approximately 79 seconds, one source sent 85 documented requests with changing SQL injection patterns and browser identifiers. BYB blocked 84 requests with HTTP 403. One suspicious ORDER BY probe received HTTP 200, highlighting a detection gap subsequently addressed in the Exploit Detection module.

Recorded requests85
Blocked requests84
HTTP response403 / 200

Documented timeline

  1. 07:15:29 SQL injection detected and blocked

    Exploit Detection classified a UNION-based SQL injection pattern as critical. The final decision was HTTP 403.

  2. 07:15:29 One suspicious probe allowed

    A separate ORDER BY column-count probe was not detected by Exploit Detection and received HTTP 200. The response alone does not prove that an injection succeeded.

  3. 07:15:34 Permanent IP block observed

    Subsequent log entries show IP Management returning HTTP 403 under a permanent IP block. Behavior Analysis also blocked multiple requests at its risk threshold.

  4. 07:16:29 Obfuscated injection blocked

    A heavily encoded UNION-based request was allowed by the individual behavior check but blocked by the final IP Management decision (HTTP 403).

  5. 07:16:48 Further requests still denied

    The latest recorded attempts received HTTP 403 while the permanent IP block remained active.

Security Case #001 · 20.10.2026

88 suspicious requests blocked

A client repeatedly sent requests containing SQL injection patterns. BYB recorded 88 blocked requests and enforced a permanent IP block on subsequent attempts.

Recorded requests88
Blocked requests88
HTTP responseHTTP 403

Documented timeline

  1. 08:54:57 Initial request blocked

    Referrer and Cookie Guard blocked a request without referrer or cookies. The request contained no confirmed SQL injection payload.

  2. 08:55:07 SQL injection pattern detected

    A request containing an EXTRACTVALUE() expression was classified as critical. A permanent IP block was recorded.

  3. 08:56:34 Further injection attempt blocked

    A subsequent request used obfuscated SQL syntax. IP Management returned HTTP 403.

  4. 08:57:00 UNION-based attempt blocked

    Another request contained UNION ALL SELECT and used a different browser user agent. IP Management again returned HTTP 403.

For privacy and security reasons, IP addresses, request identifiers and raw payloads are not published. The original logs are retained separately by the site operator.