🇬🇧
neo101
2026-10-28 13:46:52
(9 hours ago)
Secret Hunting & Credential Harvesting: Automated scanner (Nuclei (Secret Hunter)) probed decoy secrets path '/sftp-config.json'. Served AI System Override decoy payload as counter-measure.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 13:41:27
(9 hours ago)
(mod_security) mod_security (id:210492) triggered by 143.244.156.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 09:41:19.913165 2026] [security2:error] [pid 15641:tid 15641] [client 143.244.156.96:0] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 143.244.156.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 09:41:19.913165 2026] [security2:error] [pid 15641:tid 15641] [client 143.244.156.96:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "barryherbach.com"] [uri "/sftp-config.json"] [unique_id "auH7f3b1olnh6gR7zs05iAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-10-28 12:46:58
(10 hours ago)
[WedOct2813:46:56.0333132026][security2:error][pid1182898:tid1183032][client143.244.156.96:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949- ...
show more
[WedOct2813:46:56.0333132026][security2:error][pid1182898:tid1183032][client143.244.156.96:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"gmint.ch\"][uri\"/sftp-config.json\"][unique_id\"auHuwPa7GbHFMv6NGfnH3wAAAg4\"]
show less
Port Scan
Brute-Force
Web App Attack
🇨🇿
akac
2026-10-28 11:01:56
(12 hours ago)
Web vulnerability scanning: HTTP/1.1 GET /sftp-config.json
Hacking
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
Aetherweb Ark
2026-10-28 10:37:54
(12 hours ago)
(mod_security) mod_security (id:949110) triggered by 143.244.156.96 (US/United States/-): N in the last X secs
Web App Attack
🇫🇮
as211431.net
2026-10-28 10:26:26
(13 hours ago)
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /.vscode/sftp.json
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
This report was generated by:
...
show more
Triggered Cloudflare WAF (firewallCustom) from US.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /.vscode/sftp.json
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇵🇱
Budyn
2026-10-28 09:27:55
(14 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.store | URI: /sftp-config.json | UA: ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.store | URI: /sftp-config.json | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"US","Cf-Connecting-Ip":"143.244.156.96","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a518e847bc105e87-EWR","Connection":"Keep-Alive","Accept-Encoding":"gzip, br","Accept":"*\/*","X-Forwarded-For":"143.244.156.96","X-Waf-Trigger":"1"}
show less
Hacking
Web App Attack
🇬🇧
Mendip_Defender
2026-10-28 09:24:45
(14 hours ago)
143.244.156.96 - - [28/Oct/2026:09:24:43 +0000] "GET /.vscode/sftp.json HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
143.244.156.96 - - [28/Oct/2026:09:24:44 +0000] "GET /.vscode/sftp.json ...
show more
143.244.156.96 - - [28/Oct/2026:09:24:43 +0000] "GET /.vscode/sftp.json HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
143.244.156.96 - - [28/Oct/2026:09:24:44 +0000] "GET /.vscode/sftp.json HTTP/1.1" 301 5681 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
143.244.156.96 - - [28/Oct/2026:09:24:45 +0000] "GET /.vscode/sftp.json HTTP/1.1" 404 53854 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
...
show less
Hacking
Web App Attack
🇭🇺
kranem
2026-10-28 09:00:07
(14 hours ago)
Triggered Cloudflare WAF from US.
Action taken: BLOCK
ASN: 14061 (DigitalOcean, LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: /
Timestamp: 2026-10-28T08:22:53Z
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox ...
show more
Triggered Cloudflare WAF from US.
Action taken: BLOCK
ASN: 14061 (DigitalOcean, LLC)
Protocol: HTTP/1.1 (GET method)
Endpoint: /
Timestamp: 2026-10-28T08:22:53Z
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
show less
Bad Web Bot
🇫🇷
cityhunter_rhone
2026-10-28 08:05:03
(15 hours ago)
Mercurius trap auto report | source=APACHE_DENIED_AGGREGATE | last_seen=2026-10-28 09:01:02 | hits_403=2 | hits_404=0 | ip=143.244.156.96 | sample_uri=/.vscode/sftp.json
Port Scan
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 06:03:21
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 143.244.156.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 02:03:17.304894 2026] [security2:error] [pid 8954:tid 8954] [client 143.244.156.96:0] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 143.244.156.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 02:03:17.304894 2026] [security2:error] [pid 8954:tid 8954] [client 143.244.156.96:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "shubil.com"] [uri "/sftp-config.json"] [unique_id "auGQJeYOplN3hAERhluW8wAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
tutaim.com
2026-10-27 23:00:11
(1 day ago)
⛔ [28/10/26] This IP has been detected performing multiple attacks on websites (3 attempts blocked). Potential malicious activity.
Brute-Force
SSH
Web App Attack
FTP Brute-Force
🇺🇸
TPI-Abuse
2026-10-27 21:47:54
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 143.244.156.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 17:47:50.904254 2026] [security2:error] [pid 12800:tid 12800] [client 143.244.156.96:0] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 143.244.156.96 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 17:47:50.904254 2026] [security2:error] [pid 12800:tid 12800] [client 143.244.156.96:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "uwsvita.org"] [uri "/sftp-config.json"] [unique_id "auEcBmEmfzd-qHKoulbCLAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-27 21:07:03
(1 day ago)
Automated web scanner. Requested suspicious paths: /sftp-config.json. UTC: 2026-10-27 21:03:53.
Web App Attack
🇵🇱
Budyn
2026-10-27 19:54:00
(1 day ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.online | URI: /sftp-config.json | UA: ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.online | URI: /sftp-config.json | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"US","Cf-Connecting-Ip":"143.244.156.96","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a5144003ef500866-EWR","Connection":"Keep-Alive","Accept-Encoding":"gzip, br","Accept":"*\/*","X-Forwarded-For":"143.244.156.96","X-Waf-Trigger":"1"}
show less
Hacking
Web App Attack
