2026-06-02 09:59:10
(1 day ago)
[ns31.kdns.gr] httpd-xmlrpc-post: sites=dimitrisanousis.com; logs=/var/log/httpd/domains/dimitrisano ...
show more
[ns31.kdns.gr] httpd-xmlrpc-post: sites=dimitrisanousis.com; logs=/var/log/httpd/domains/dimitrisanousis.com.log; samples=/xmlrpc.php
show less
Brute-Force
Web App Attack
🇧🇴
rvalenzuela
2026-06-01 13:04:00
(2 days ago)
Attack ID: 1002017553 Module: "Known Exploits" Check Type: "Generic Exploit" Desc: "This signature p ...
show more
Attack ID: 1002017553 Module: "Known Exploits" Check Type: "Generic Exploit" Desc: "This signature prevents attacker from gaining control of susceptible systems(CVE-2025-55182,CVE-2025-66478)."
show less
Web App Attack
Hacking
2026-06-01 07:40:40
(2 days ago)
"GET /sftp-config.json HTTP/1.1"
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 04:40:59
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 104.28.157.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.157.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 00:40:54.861075 2026] [security2:error] [pid 11113:tid 11113] [client 104.28.157.199:46193] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "warnock.ws"] [uri "/sftp-config.json"] [unique_id "ah0NVm0dlAjpRV7HEaUG_gAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
el-brujo
2026-06-01 04:39:29
(2 days ago)
Cloudflare WAF: Request Path: /sftp-config.json Request Query: Host: warzone.elhacker.net userAgent ...
show more
Cloudflare WAF: Request Path: /sftp-config.json Request Query: Host: warzone.elhacker.net userAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 Action: block Source: firewallManaged ASN Description: Cloudflare, Inc. Country: HK Method: GET Timestamp: 2026-06-01T04:39:29Z ruleId: c2a2f414a67c409f90cccb6c5bba0215. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB).
show less
Hacking
SQL Injection
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 04:01:01
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 104.28.157.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.157.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jun 01 00:00:54.471458 2026] [security2:error] [pid 12350:tid 12350] [client 104.28.157.199:46694] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "web99.dnchosting.com"] [uri "/sftp-config.json"] [unique_id "ah0D9pQJl5yY2IG_-OKBEwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-06-01 01:14:17
(3 days ago)
SIEM ALERT AUTO REPORT
Email Spam
🇺🇸
TPI-Abuse
2026-06-01 01:03:03
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 104.28.157.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.157.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 21:02:58.204733 2026] [security2:error] [pid 27656:tid 27656] [client 104.28.157.199:45699] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "web.cruisingforsex.com"] [uri "/sftp-config.json"] [unique_id "ahzaQgBcM6_OLXvQuP0QaAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-06-01 00:32:05
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 104.28.157.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.157.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 31 20:32:01.346221 2026] [security2:error] [pid 25670:tid 25670] [client 104.28.157.199:47367] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "twccsolutions.com"] [uri "/sftp-config.json"] [unique_id "ahzTAdygLeKZc8Zpn_6t_gAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-06-01 00:28:01
(3 days ago)
Web vulnerability probing: /sftp-config.json
Web App Attack
🇺🇸
TPI-Abuse
2026-05-28 07:16:13
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 104.28.157.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.157.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 28 03:16:09.931692 2026] [security2:error] [pid 26882:tid 26882] [client 104.28.157.199:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "archive.yggdrasil.org"] [uri "/sftp-config.json"] [unique_id "ahfruQhTVLzVOMg9MnmAzAAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-05-27 20:04:12
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
2026-05-27 18:12:21
(1 week ago)
Ports: *; Direction: 0; Trigger: CT_LIMIT
Brute-Force
SSH
🇺🇸
i553041
2026-05-27 14:59:38
(1 week ago)
104.28.157.199 - - [27/May/2026:14:59:34 +0000] "GET /favicon.ico HTTP/2.0" 401 0 "-" "Mozilla/5.0 ( ...
show more
104.28.157.199 - - [27/May/2026:14:59:34 +0000] "GET /favicon.ico HTTP/2.0" 401 0 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"
104.28.157.199 - - [27/May/2026:14:59:34 +0000] "GET /xui/ HTTP/2.0" 307 71 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"
104.28.157.199 - - [27/May/2026:14:59:34 +0000] "GET /xui/panel/inbounds HTTP/2.0" 200 727 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"
104.28.157.199 - - [27/May/2026:14:59:34 +0000] "GET /xui/panel/ HTTP/2.0" 200 666 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/148.0.0.0 Safari/537.36"
104.28.157.199 - - [27/May/2026:14:59:34 +0000] "GET /xui/assets/inbound-PW017ljZ.js HTTP/2.0" 200 13194 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/53
...
show less
Brute-Force
SSH
🇺🇸
TPI-Abuse
2026-05-27 12:08:49
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.28.157.199 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.28.157.199 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 27 08:08:42.896710 2026] [security2:error] [pid 11272:tid 11272] [client 104.28.157.199:48763] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chelseafootballprogrammes.com"] [uri "/sftp-config.json"] [unique_id "ahbeynAZe3P7QICXJoH_AgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack