🇫🇷
thilo
2026-11-06 21:27:35
UTC ·
(16 hours ago)
Probe for vulnerabilities. Path attempted: /sftp-config
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 21:31:11
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 16:31:06.505616 2026] [security2:error] [pid 30652:tid 30652] [client 13.143.126.82:42132] M ...
show more
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 16:31:06.505616 2026] [security2:error] [pid 30652:tid 30652] [client 13.143.126.82:42132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stortfordmedical.com"] [uri "/sftp-config.json"] [unique_id "auz1mu3K9m5h5NwyLedyPQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-11-05 12:05:08
UTC ·
(2 days ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 15:31:45
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 10:31:38.246280 2026] [security2:error] [pid 2367:tid 2423] [client 13.143.126.82:30376] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 10:31:38.246280 2026] [security2:error] [pid 2367:tid 2423] [client 13.143.126.82:30376] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "m3sxa.com"] [uri "/sftp-config.json"] [unique_id "auis2hEYoJg4WdnLqbgtLAAAAUg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 11:53:46
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:53:16.978294 2026] [security2:error] [pid 3464:tid 3464] [client 13.143.126.82:58096] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:53:16.978294 2026] [security2:error] [pid 3464:tid 3464] [client 13.143.126.82:58096] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.voodooshop.com"] [uri "/voodoofest.html/sftp-config.json"] [unique_id "auh5rGEAxLClGo53K5fxuQAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 05:32:00
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 00:31:24.153425 2026] [security2:error] [pid 30165:tid 30165] [client 13.143.126.82:24492] M ...
show more
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 00:31:24.153425 2026] [security2:error] [pid 30165:tid 30165] [client 13.143.126.82:24492] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "lexie.org"] [uri "/sftp-config.json"] [unique_id "auggLB9qO4UGHXvvLeQthQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Carsten
2026-11-01 04:58:35
UTC ·
(6 days ago)
GET [.vscode/sftp.json]
Port Scan
🇨🇭
4server
2026-10-31 12:46:19
UTC ·
(1 week ago)
[SatOct3113:46:05.2470492026][security2:error][pid1359730:tid1359825][client13.143.126.82:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\\\\\\\\.vscode/\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][ ...
show more
[SatOct3113:46:05.2470492026][security2:error][pid1359730:tid1359825][client13.143.126.82:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\\\\\\\\.vscode/\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"1189\"][id\"350593\"][rev\"1\"][msg\"Atomicorp.comWAFRules:AttackBlocked-Dataleakage-attempttoaccessstoredvscodepasswords\"][severity\"CRITICAL\"][hostname\"4spv.net\"][uri\"/.vscode/sftp.json\"][unique_id\"auXjDcV_hdbCBJRo--sPlQAAAI8\"]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 20:37:22
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 16:37:18.235151 2026] [security2:error] [pid 409:tid 409] [client 13.143.126.82:44736] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 16:37:18.235151 2026] [security2:error] [pid 409:tid 409] [client 13.143.126.82:44736] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "themarshalls.tv"] [uri "/sftp-config.json"] [unique_id "at-5_mjumGxQkLYDipvC7wAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 15:26:22
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 11:26:16.448392 2026] [security2:error] [pid 17717:tid 17717] [client 13.143.126.82:26832] M ...
show more
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 11:26:16.448392 2026] [security2:error] [pid 17717:tid 17717] [client 13.143.126.82:26832] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cbcfargo.com"] [uri "/sftp-config.json"] [unique_id "at4fmDJCm6PlV-UNoZr4aQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 09:51:44
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 05:51:38.693325 2026] [security2:error] [pid 5691:tid 5691] [client 13.143.126.82:24162] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 05:51:38.693325 2026] [security2:error] [pid 5691:tid 5691] [client 13.143.126.82:24162] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.casabella-khaolak.com"] [uri "/sftp-config.json"] [unique_id "at3RKgbFKmoWF6qLM28MQwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 19:14:07
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 15:14:03.440270 2026] [security2:error] [pid 5282:tid 5282] [client 13.143.126.82:3732] ModS ...
show more
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 15:14:03.440270 2026] [security2:error] [pid 5282:tid 5282] [client 13.143.126.82:3732] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "milliondollarbelt.com"] [uri "/sftp-config.json"] [unique_id "atux-6in3anGG-3sc8Wj9AAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 08:16:47
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 04:16:42.163071 2026] [security2:error] [pid 13849:tid 13849] [client 13.143.126.82:38194] M ...
show more
(mod_security) mod_security (id:210492) triggered by 13.143.126.82 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 04:16:42.163071 2026] [security2:error] [pid 13849:tid 13849] [client 13.143.126.82:38194] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gazeboweddinginvitations.com"] [uri "/sftp-config.json"] [unique_id "ath06qyachHVCIbj2BFggQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-10-20 08:55:17
UTC ·
(2 weeks ago)
(web_sensitive_file) srv102 Sensitive file probe (.env/.git/backup) 13.143.126.82 (FR/France/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇩🇪
Lino Project
2026-10-19 18:52:36
UTC ·
(2 weeks ago)
13.143.126.82 - - [19/Oct/2026:20:52:35 +0200] "GET /sftp-config.json HTTP/1.1" 403 195 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
...
Brute-Force
Bad Web Bot
Web App Attack
