🇩🇪
www.Examensfragen.de
2025-12-09 22:54:02
(6 months ago)
Web Spam
Bad Web Bot
🇵🇱
sefinek.net
2025-12-03 07:05:51
(6 months ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET metho ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /sftp-config.json
UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇺🇸
TPI-Abuse
2025-12-03 06:48:03
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 146.190.80.105 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 146.190.80.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 03 01:47:58.430952 2025] [security2:error] [pid 6049:tid 6049] [client 146.190.80.105:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "shubil.com"] [uri "/sftp-config.json"] [unique_id "aS_dHgq3C2tRHM2PpuXxkwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-02 10:36:04
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 146.190.80.105 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 146.190.80.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Dec 02 05:36:00.551703 2025] [security2:error] [pid 11786:tid 11786] [client 146.190.80.105:63904] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.development-dynamics.com"] [uri "/sftp-config.json"] [unique_id "aS7BEAdd3ow-ewymZrOeYgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
Burayot
2025-11-30 19:00:14
(7 months ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 146.190.80.105 (SG/Singapore/-): 1 i ...
show more
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 146.190.80.105 (SG/Singapore/-): 1 in the last 3600 secs
show less
Web App Attack
🇧🇪
cmbplf
2025-11-30 06:23:20
(7 months ago)
303 requests with url.path *config.json
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2025-11-29 17:10:21
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 146.190.80.105 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 146.190.80.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 29 12:10:16.050397 2025] [security2:error] [pid 844214:tid 844214] [client 146.190.80.105:49595] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kln.ne.jp"] [uri "/jehovah/sftp-config.json"] [unique_id "aSso-A0Rnb0cF74OftvN3gAAABY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
openstrike.co.uk
2025-11-28 06:13:33
(7 months ago)
5 attacks on password grabbing URLs:
GET /.vscode/sftp.json HTTP/1.1
Hacking
🇺🇸
TPI-Abuse
2025-11-27 18:24:47
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 146.190.80.105 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 146.190.80.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 13:24:43.755696 2025] [security2:error] [pid 32278:tid 32278] [client 146.190.80.105:54878] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "flybits.co.uk"] [uri "/sftp-config.json"] [unique_id "aSiXa10-yJUwLsj7lOoy9AAAACk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-27 18:02:57
(7 months ago)
(mod_security) mod_security (id:210492) triggered by 146.190.80.105 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 146.190.80.105 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 27 13:02:51.218122 2025] [security2:error] [pid 25215:tid 25232] [client 146.190.80.105:53344] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "furball.co.uk"] [uri "/sftp-config.json"] [unique_id "aSiSS65lE2MN9Uc0uRQDkwAAAE4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
CrystalMaker
2025-11-27 17:53:48
(7 months ago)
Vulnerability scan - GET /sftp-config.json; GET /.vscode/sftp.json
Hacking
🇮🇩
Burayot
2025-11-27 17:40:03
(7 months ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 146.190.80.105 (SG/Singapore/-): 1 i ...
show more
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 146.190.80.105 (SG/Singapore/-): 1 in the last 3600 secs
show less
Web App Attack