🇧🇪
cmbplf
2026-10-24 11:47:25
(9 hours ago)
210 requests with url.path *sftp.json
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-24 10:40:02
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 163.52.135.254 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 163.52.135.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 06:39:54.740075 2026] [security2:error] [pid 4810:tid 4810] [client 163.52.135.254:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "barryherbach.com"] [uri "/sftp-config.json"] [unique_id "atyK-uMJtZJCx0-7CtJnrQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
akac
2026-10-24 10:02:58
(11 hours ago)
Web vulnerability scanning: HTTP/1.1 GET /sftp-config.json
Hacking
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nyt
2026-10-24 09:16:30
(11 hours ago)
Deploy Config Probe
Web App Attack
🇫🇷
Baking333
2026-10-24 09:05:09
(12 hours ago)
[redacted] 163.52.135.254 - - [24/Oct/2026:10:05:04 +0100] "GET /[redacted] HTTP/1.1" 302 1538 0/149 ...
show more
[redacted] 163.52.135.254 - - [24/Oct/2026:10:05:04 +0100] "GET /[redacted] HTTP/1.1" 302 1538 0/149204 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" 80 [redacted] 163.52.135.254 - - [24/Oct/2026:10:05:07 +0100] "GET /.vscode/[redacted] HTTP/1.1" 302 1537 0/64837 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" 80
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 08:56:56
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 163.52.135.254 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 163.52.135.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 04:56:48.527716 2026] [security2:error] [pid 19048:tid 19048] [client 163.52.135.254:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yggdrasil.org"] [uri "/sftp-config.json"] [unique_id "atxy0PZlD6WnLVWTv1iDkAAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-24 08:29:21
(12 hours ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: astropot.space | URI: /sftp-config.json | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"ID","Cf-Connecting-Ip":"163.52.135.254","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a4f79cfa2881f57a-HKG","Connection":"Keep-Alive","Accept-Encoding":"gzip, br","Accept":"*\/*","X-Forwarded-For":"163.52.135.254","X-Waf-Trigger":"1"}
show less
Hacking
Web App Attack
🇳🇱
e.fierstra
2026-10-24 07:45:04
(13 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇮🇩
sockominfo
2026-10-23 22:00:09
(23 hours ago)
Active Response: IP 163.52.135.254 Blocked via Firewall Drop. Threat Score: 0/10 (INFORMATIONAL). Re ...
show more
Active Response: IP 163.52.135.254 Blocked via Firewall Drop. Threat Score: 0/10 (INFORMATIONAL). Reported by TangerangKota-CSIRT
show less
Hacking
Web App Attack
🇵🇱
Budyn
2026-10-23 12:26:04
(1 day ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: budyn.xyz | URI: /sftp-config.json | UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0 | BODY: [Empty / GET Request] | HEADERS: {"X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"ID","Cf-Connecting-Ip":"163.52.135.254","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a4f0ba5f4f7848f0-LAX","Connection":"Keep-Alive","Accept-Encoding":"gzip, br","Accept":"*\/*","X-Forwarded-For":"163.52.135.254","X-Waf-Trigger":"1"}
show less
Hacking
Web App Attack
🇺🇸
WizardsToolkit
2026-10-23 12:24:07
(1 day ago)
tried to access server backup files
Web App Attack
🇳🇱
Mangelot Hosting
2026-10-23 11:24:18
(1 day ago)
(web_sensitive_file) srv101 Sensitive file probe (.env/.git/backup) 163.52.135.254 (ID/Indonesia/-): ...
show more
(web_sensitive_file) srv101 Sensitive file probe (.env/.git/backup) 163.52.135.254 (ID/Indonesia/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 10:43:45
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 163.52.135.254 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 163.52.135.254 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 06:43:39.491660 2026] [security2:error] [pid 987:tid 987] [client 163.52.135.254:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "pixacast.com"] [uri "/sftp-config.json"] [unique_id "ats6W-PeTQGU4YHttjb7_wAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TIScore
2026-10-23 10:34:07
(1 day ago)
Automated web attack / probing. Signals: Unexpected path; Secret / VCS probing. Last path: /.vscode/ ...
show more
Automated web attack / probing. Signals: Unexpected path; Secret / VCS probing. Last path: /.vscode/sftp.json
show less
Web App Attack
🇺🇸
Starburst SysOp Team
2026-10-23 10:18:41
(1 day ago)
Restricted File Access Attempt. Matched phrase "config.json" at REQUEST_FILENAME. (930130-mnz6-7)
Hacking
Web App Attack
