🇺🇸
TPI-Abuse
2026-11-12 20:31:58
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:31:51.099715 2026] [security2:error] [pid 5726:tid 5726] [client 104.164.243.237:3450] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:31:51.099715 2026] [security2:error] [pid 5726:tid 5726] [client 104.164.243.237:3450] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wendyesser.com"] [uri "/sftp-config.json"] [unique_id "avYiNyTCetnyhGGmTw_rWAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-09 16:16:53
UTC ·
(5 days ago)
(web_sensitive_file) srv201 Sensitive file probe (.env/.git/backup) 104.164.243.237 (IT/Italy/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 10:32:43
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:32:38.557112 2026] [security2:error] [pid 3414:tid 3414] [client 104.164.243.237:32908] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:32:38.557112 2026] [security2:error] [pid 3414:tid 3414] [client 104.164.243.237:32908] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "edscontracting.com"] [uri "/sftp-config.json"] [unique_id "au2sxsOwVitpj3pSO9qdnAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 09:36:58
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 04:35:48.643442 2026] [security2:error] [pid 23612:tid 23612] [client 104.164.243.237:1425 ...
show more
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 04:35:48.643442 2026] [security2:error] [pid 23612:tid 23612] [client 104.164.243.237:14254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "okeetokee.org"] [uri "/sftp-config.json"] [unique_id "auxN9OUOhLzT3zVyYudk1QAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 11:19:45
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:19:32.864095 2026] [security2:error] [pid 4802:tid 4802] [client 104.164.243.237:35288] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:19:32.864095 2026] [security2:error] [pid 4802:tid 4802] [client 104.164.243.237:35288] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.mitchellamazing.com"] [uri "/sftp-config.json"] [unique_id "auhxxHMb1g015pjz52gJ2wAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 17:51:18
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 13:50:22.603909 2026] [security2:error] [pid 21926:tid 21926] [client 104.164.243.237:6487 ...
show more
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 13:50:22.603909 2026] [security2:error] [pid 21926:tid 21926] [client 104.164.243.237:64872] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brupharm.net"] [uri "/sftp-config.json"] [unique_id "auYqXioVa3yPS9UywD8jMwAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 09:41:50
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 05:41:42.490906 2026] [security2:error] [pid 2802:tid 2802] [client 104.164.243.237:59430] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 05:41:42.490906 2026] [security2:error] [pid 2802:tid 2802] [client 104.164.243.237:59430] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "clowaterart.com"] [uri "/sftp-config.json"] [unique_id "auW31lqtaZ1e9iQhlFR4rwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 05:08:05
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 01:06:05.159375 2026] [security2:error] [pid 16478:tid 16478] [client 104.164.243.237:5461 ...
show more
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 01:06:05.159375 2026] [security2:error] [pid 16478:tid 16478] [client 104.164.243.237:54618] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "backyardtossers.com"] [uri "/sftp-config.json"] [unique_id "auAxPe_tTyNNp7gY3w5RZQAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 01:56:38
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 21:56:32.342127 2026] [security2:error] [pid 17618:tid 17635] [client 104.164.243.237:1756 ...
show more
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 21:56:32.342127 2026] [security2:error] [pid 17618:tid 17635] [client 104.164.243.237:17566] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thebgs.net"] [uri "/sftp-config.json"] [unique_id "auAE0PEHV96PrROisGcFAAAAAI8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-10-20 11:49:57
UTC ·
(3 weeks ago)
Try to access /.vscode/sftp.json
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 21:45:18
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 17:44:53.472945 2026] [security2:error] [pid 21450:tid 21450] [client 104.164.243.237:9292 ...
show more
(mod_security) mod_security (id:210492) triggered by 104.164.243.237 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 17:44:53.472945 2026] [security2:error] [pid 21450:tid 21450] [client 104.164.243.237:9292] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "todosconlaura.com"] [uri "/sftp-config.json"] [unique_id "atKa1V19gmCTvqamzj3y_gAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇹
gamabe
2026-10-08 00:00:00
UTC ·
(1 month ago)
Automated account enumeration: unauthenticated email-existence lookups against a mobile app API with a spoofed iOS app user agent. This IP belongs to a rotating proxy pool of ~2,000 IPs that sent up to ~39,000 lookups per day since September 2026.
Bad Web Bot
Web App Attack
