🇦🇺
A.i.D.A.N.N
2026-09-21 16:45:22
(1 week ago)
A.i.D.A.N.N: Anomaly Detected - Signature match Web Service - Web application attack detected
Web App Attack
🇩🇪
LRob
2026-09-21 16:17:48
(1 week ago)
This address is looking for secret files on our sites: .git directories, .env files, credential and ...
show more
This address is looking for secret files on our sites: .git directories, .env files, credential and configuration files, database dumps, backups. This is a targeted search for credentials to break into the sites, blocked at the first request. Please check the machine behind it for an attack tool or malware. | method: GET | path: /sftp-config.json | 2026-09-21 16:17 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 16:13:37
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 139.162.31.17 (139-162-31-17.ip.linodeuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 139.162.31.17 (139-162-31-17.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 12:13:33.194629 2026] [security2:error] [pid 26498:tid 26498] [client 139.162.31.17:59657] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "suffolksystems.com"] [uri "/sftp-config.json"] [unique_id "arFXrSH9uCHwOzSboJNfjwAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 15:18:00
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 139.162.31.17 (139-162-31-17.ip.linodeuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 139.162.31.17 (139-162-31-17.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 11:17:54.354723 2026] [security2:error] [pid 13516:tid 13516] [client 139.162.31.17:58883] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sundancepei.com"] [uri "/sftp-config.json"] [unique_id "arFKojfh7D7JZaGvi5pxdwAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 13:33:39
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 139.162.31.17 (139-162-31-17.ip.linodeuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 139.162.31.17 (139-162-31-17.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 09:33:35.399289 2026] [security2:error] [pid 22075:tid 22075] [client 139.162.31.17:54427] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sweetsixteennapkins.com"] [uri "/sftp-config.json"] [unique_id "arEyL1J6XedTFKU1n94NugAAACo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 11:26:40
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 139.162.31.17 (139-162-31-17.ip.linodeuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 139.162.31.17 (139-162-31-17.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 07:26:34.315572 2026] [security2:error] [pid 16391:tid 16391] [client 139.162.31.17:58117] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "syconline.com"] [uri "/sftp-config.json"] [unique_id "arEUagUPCxzvJ1ZtBXXx2wAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
mnsf
2026-09-21 11:05:07
(1 week ago)
Too many Status 40X (19)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-21 08:59:59
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 139.162.31.17 (139-162-31-17.ip.linodeuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 139.162.31.17 (139-162-31-17.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 04:59:55.220370 2026] [security2:error] [pid 28915:tid 28915] [client 139.162.31.17:60906] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "superiorhandyman.net"] [uri "/sftp-config.json"] [unique_id "arDyCzoU6hLq3rjsvSPengAAAC0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-09-21 07:56:35
(1 week ago)
Restricted File Access Attempt. Matched phrase "config.json" at REQUEST_FILENAME. (930130-201)
Hacking
Web App Attack
🇫🇷
masterguru
2026-09-21 04:26:08
(1 week ago)
Restricted File Access Attempt. Matched phrase "config.json" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇬🇧
consul.to
2026-09-20 21:19:27
(1 week ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
nyt
2026-09-20 19:35:59
(1 week ago)
Deploy Config Probe
Web App Attack
🇺🇸
TPI-Abuse
2026-09-20 19:17:18
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 139.162.31.17 (139-162-31-17.ip.linodeuserconte ...
show more
(mod_security) mod_security (id:210492) triggered by 139.162.31.17 (139-162-31-17.ip.linodeusercontent.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 20 15:17:12.622789 2026] [security2:error] [pid 17041:tid 17041] [client 139.162.31.17:54661] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "taekwondoit.com"] [uri "/sftp-config.json"] [unique_id "arAxOICYFf488aFuyYJQ3wAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇿
Tripwire
2026-09-20 17:54:07
(1 week ago)
Scanning for exploits - /.vscode/sftp.json
Web App Attack
🇩🇪
Viveronese
2026-09-20 17:46:33
(1 week ago)
HTTP vulnerability scanning
Web App Attack
