🇺🇸
TPI-Abuse
2026-07-15 17:05:06
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 13:04:56.362456 2026] [security2:error] [pid 19521:tid 19521] [client 103.117.92.139:53272] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ironsightsarmory.com"] [uri "/sftp-config.json"] [unique_id "ale9uNJ9Hu-oBVnpJTaRuQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-15 16:46:00
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 12:45:47.398385 2026] [security2:error] [pid 28727:tid 28727] [client 103.117.92.139:21630] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.enriquelaw.com"] [uri "/sftp-config.json"] [unique_id "ale5O9naHC3xnK_nrlOk6AAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-15 15:32:17
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 11:32:07.176704 2026] [security2:error] [pid 32415:tid 32415] [client 103.117.92.139:44264] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "irises.batw.net"] [uri "/sftp-config.json"] [unique_id "alen9-udo532KtMtGuDKCwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-15 04:22:45
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 15 00:22:41.671814 2026] [security2:error] [pid 17380:tid 17380] [client 103.117.92.139:37616] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "intothebigempty.com"] [uri "/sftp-config.json"] [unique_id "alcLEYzvdMowS2jdQ82Z7gAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-15 01:19:02
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 21:18:55.772692 2026] [security2:error] [pid 23323:tid 23323] [client 103.117.92.139:27344] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.beckersystems.com"] [uri "/partners/businesstobusinessassociation.com/ilc/sftp-config.json"] [unique_id "albf_5PmpQa064227ZeB8QAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-15 00:07:28
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 20:07:21.602554 2026] [security2:error] [pid 1600663:tid 1600663] [client 103.117.92.139:6126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "intergeovial.com"] [uri "/sftp-config.json"] [unique_id "albPOWXKYtzn9_u5DBx5zAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-14 23:46:20
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 19:46:13.315629 2026] [security2:error] [pid 14739:tid 14739] [client 103.117.92.139:4714] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "intercotrading.com"] [uri "/sftp-config.json"] [unique_id "albKRRBgcOF4yosG1ExEQQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-14 22:10:45
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 18:10:38.468610 2026] [security2:error] [pid 3765:tid 3765] [client 103.117.92.139:36558] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "intellectualcapitalmanagementsystems.com"] [uri "/sftp-config.json"] [unique_id "alaz3ly6IMd-rIt-ySzfNAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
pipeline.es
2026-07-09 15:21:00
(2 weeks ago)
Web scanning / probing for vulnerable paths | URL: /sftp-config.json | Evidence: havanaprivatesuite. ...
show more
Web scanning / probing for vulnerable paths | URL: /sftp-config.json | Evidence: havanaprivatesuite.com 103.117.92.139 - - [09/Jul/2026:17:18:04 +0200] \"GET /sftp-config.json HTTP/1.1\" 404 27748 \"-\" \"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36\" GEOIP_COUNTRY_CODE=IN | ASN: HostRoyale Technologies Pvt Ltd | Country: IN
show less
Port Scan
Web App Attack
🇺🇸
mnsf
2026-07-09 12:05:10
(2 weeks ago)
Too many Status 40X (13)
Brute-Force
Web App Attack
2026-07-09 07:00:04
(2 weeks ago)
| [Dangerous/Nepal] Aggressive IP 103.117.92.139 (~30 hits). Type: DoS Defender- Web server 400 erro ...
show more
| [Dangerous/Nepal] Aggressive IP 103.117.92.139 (~30 hits). Type: DoS Defender- Web server 400 error code
show less
Web App Attack
Hacking
SQL Injection
🇧🇪
cmbplf
2026-07-08 03:43:18
(2 weeks ago)
225 requests with url.path *config.json
Brute-Force
Bad Web Bot
🇫🇷
masterguru
2026-07-08 01:12:31
(2 weeks ago)
Restricted File Access Attempt. Matched phrase "config.json" at REQUEST_FILENAME. (930130-195)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-07-07 22:12:27
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 103.117.92.139 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 07 18:12:20.335726 2026] [security2:error] [pid 9939:tid 9939] [client 103.117.92.139:4370] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "xirin.org"] [uri "/sftp-config.json"] [unique_id "ak15xJyxSLsItqMDnI6g0QAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-07-07 20:13:28
(2 weeks ago)
(caddyscan) Scanner path probe from 103.117.92.139 (IN/India/-): 5 in the last 3600 secs; Ports: *; ...
show more
(caddyscan) Scanner path probe from 103.117.92.139 (IN/India/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 103.117.92.139 - - [07/Jul/2026:20:13:25 +0000] "GET /.vscode/sftp.json HTTP/1.1"
[REDACTED] 200 2627 103.117.92.139 - - [07/Jul/2026:20:13:25 +0000] "GET /.vscode/sftp.json HTTP/1.1"
[REDACTED] 404 219 103.117.92.139 - - [07/Jul/2026:20:13:25 +0000] "GET /.vscode/sftp.json HTTP/1.1"
[REDACTED] 200 2627 103.117.92.139 - - [07/Jul/2026:20:13:25 +0000] "GET /.vscode/sftp.json HTTP/1.1"
[REDACTED] 200 2627 103.117.92.139 - - [07/Jul/2026:20:13:25 +0000] "GET /.vscode/sftp.json HTTP/1.1"
show less
Port Scan