🇺🇸
TPI-Abuse
2026-07-08 16:11:21
(4 minutes ago)
(mod_security) mod_security (id:210492) triggered by 158.115.252.50 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.115.252.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 12:11:15.117719 2026] [security2:error] [pid 9519:tid 9519] [client 158.115.252.50:32092] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "backstore.com"] [uri "/backstore/Index_Products.htm/sftp-config.json"] [unique_id "ak52o2pVVssEgWVdBskhKAAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-08 15:55:44
(19 minutes ago)
(mod_security) mod_security (id:210492) triggered by 158.115.252.50 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.115.252.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 11:55:37.404109 2026] [security2:error] [pid 23125:tid 23125] [client 158.115.252.50:41768] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gh057.io"] [uri "/sftp-config.json"] [unique_id "ak5y-WBcvXS-ic2dpH4m7gAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-08 15:39:19
(36 minutes ago)
(mod_security) mod_security (id:210492) triggered by 158.115.252.50 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.115.252.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 11:39:13.332755 2026] [security2:error] [pid 25454:tid 25454] [client 158.115.252.50:45780] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.stoneageartifacts.com"] [uri "/sftp-config.json"] [unique_id "ak5vIZf9RjeqPMPhI0KBqQAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-08 15:22:43
(52 minutes ago)
(mod_security) mod_security (id:210492) triggered by 158.115.252.50 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.115.252.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 08 11:22:37.145693 2026] [security2:error] [pid 3696:tid 3696] [client 158.115.252.50:4868] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "americaskitchencoach.com"] [uri "/deidre100.html/sftp-config.json"] [unique_id "ak5rPcx0ejUfB_vn7itX-gAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
ELYAZ
2026-07-07 16:07:13
(1 day ago)
(y4) Failed scan -byebye- from 158.115.252.50 (-): (CF_ENABLE)
Hacking
2026-07-06 18:52:10
(1 day ago)
158.115.252.50 - - [06/Jul/2026:20:51:53 +0200] "GET /sftp-config.json HTTP/1.1" 404 434 "-" "Mozill ...
show more
158.115.252.50 - - [06/Jul/2026:20:51:53 +0200] "GET /sftp-config.json HTTP/1.1" 404 434 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36"
158.115.252.50 - - [06/Jul/2026:20:51:53 +0200] "GET /sftp-config.json HTTP/1.1" 404 242 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36"
158.115.252.50 - - [06/Jul/2026:20:51:53 +0200] "GET /sftp-config.json HTTP/1.1" 403 12583 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
158.115.252.50 - - [06/Jul/2026:20:51:53 +0200] "GET /sftp-config.json HTTP/1.1" 403 183 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
158.115.252.50 - - [06/Jul/2026:20:51:53 +0200] "GET /sftp-config.json HTTP/1.1" 404 241 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/11
...
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-06 16:38:47
(1 day ago)
(mod_security) mod_security (id:949110) triggered by 158.115.252.50 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:949110) triggered by 158.115.252.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 06 12:38:41.012571 2026] [security2:error] [pid 8841:tid 8841] [client 158.115.252.50:42692] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "21oaksfarm.com"] [uri "/sftp-config.json"] [unique_id "akvaEQolOGBqUpi0nX8dmQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-07-06 11:03:50
(2 days ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 1247
Exploited Host
Web App Attack
🇩🇪
4server
2026-07-06 04:26:15
(2 days ago)
[MonJul0606:26:08.0161322026][security2:error][pid3713300:tid3713350][client158.115.252.50:0]ModSecu ...
show more
[MonJul0606:26:08.0161322026][security2:error][pid3713300:tid3713350][client158.115.252.50:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\\\\\\\\.vscode/\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"1189\"][id\"350593\"][rev\"1\"][msg\"Atomicorp.comWAFRules:AttackBlocked-Dataleakage-attempttoaccessstoredvscodepasswords\"][severity\"CRITICAL\"][hostname\"akastudio.ch\"][uri\"/.vscode/sftp.json\"][unique_id\"aksuYFJ5GzFsQiiYKYJwRAAAAEw\"]
show less
Port Scan
Brute-Force
Web App Attack
🇧🇪
cmbplf
2026-07-06 03:27:16
(2 days ago)
321 requests with url.path *sftp.json
162 requests with url.path *config.json
Brute-Force
Bad Web Bot
🇬🇧
consul.to
2026-07-05 20:13:23
(2 days ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-07-04 01:05:04
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 158.115.252.50 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 158.115.252.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 21:04:56.389713 2026] [security2:error] [pid 4585:tid 4585] [client 158.115.252.50:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "caspina.com"] [uri "/sftp-config.json"] [unique_id "akhcOIfnS8WlpK95UzXO1QAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack