🇩🇪
LRob
2026-11-13 22:40:17
UTC ·
(20 hours ago)
Secret file probe | method: GET | path: /.vscode/sftp.json | ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Hacking
Web App Attack
🇳🇱
BlueWire Hosting
2026-11-13 05:58:40
UTC ·
(1 day ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇺🇸
TPI-Abuse
2026-11-12 12:06:37
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 07:06:34.112101 2026] [security2:error] [pid 29313:tid 29313] [client 172.84.184.166:51390] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 07:06:34.112101 2026] [security2:error] [pid 29313:tid 29313] [client 172.84.184.166:51390] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wildpete.com"] [uri "/sftp-config.json"] [unique_id "avWrytFWkIU6km345GYOFAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 12:49:05
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 07:48:57.711101 2026] [security2:error] [pid 7022:tid 7022] [client 172.84.184.166:27794] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 07:48:57.711101 2026] [security2:error] [pid 7022:tid 7022] [client 172.84.184.166:27794] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "vittariahealth.com"] [uri "/sftp-config.json"] [unique_id "avRkORqdd5COP3iz013T6gAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇯🇵
warudora
2026-11-09 02:57:10
UTC ·
(5 days ago)
Automated Honeypot Trap: Attempted to access sensitive path '/sftp-config.json' on a Flask server.
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 04:14:26
UTC ·
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 23:14:21.755766 2026] [security2:error] [pid 19238:tid 19238] [client 172.84.184.166:26364] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 23:14:21.755766 2026] [security2:error] [pid 19238:tid 19238] [client 172.84.184.166:26364] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "deniz-bilgisayar.com"] [uri "/sftp-config.json"] [unique_id "au_3HcsluZbasLo3wF_vFwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 10:34:32
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:32:50.240850 2026] [security2:error] [pid 24266:tid 24266] [client 172.84.184.166:37242] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:32:50.240850 2026] [security2:error] [pid 24266:tid 24266] [client 172.84.184.166:37242] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "forgottenvictims.com"] [uri "/sftp-config.json"] [unique_id "au2s0h09bLF7yQY6yWXcPAAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 03:36:08
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:36:05.524190 2026] [security2:error] [pid 30992:tid 30992] [client 172.84.184.166:54858] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:36:05.524190 2026] [security2:error] [pid 30992:tid 30992] [client 172.84.184.166:54858] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "smallbizreorg.com"] [uri "/sftp-config.json"] [unique_id "au1LJYLSWoQlhlYimx5OQgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 03:09:33
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:09:30.555265 2026] [security2:error] [pid 17341:tid 17341] [client 172.84.184.166:12084] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:09:30.555265 2026] [security2:error] [pid 17341:tid 17341] [client 172.84.184.166:12084] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fourminutedecision.com"] [uri "/sftp-config.json"] [unique_id "au1E6qAZIIinOl7-xLZjfwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 15:24:40
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 11:24:36.661592 2026] [security2:error] [pid 32279:tid 32279] [client 172.84.184.166:54506] ...
show more
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 11:24:36.661592 2026] [security2:error] [pid 32279:tid 32279] [client 172.84.184.166:54506] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "3pl.com"] [uri "/sftp-config.json"] [unique_id "auS2tLordrwz_asm759QJAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
francelink.fr
2026-10-20 13:34:25
UTC ·
(3 weeks ago)
Azure WAF blocked a request. Rule: 949110. Observed at: 2026-10-20T11:41:45.000Z.
Web App Attack
🇩🇪
big-cloud.nl
2026-10-19 20:31:31
UTC ·
(3 weeks ago)
Try to access /.vscode/sftp.json
Web App Attack
🇳🇱
BlueWire Hosting
2026-10-19 20:08:17
UTC ·
(3 weeks ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 18:15:32
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 14:15:26.111560 2026] [security2:error] [pid 5817:tid 5817] [client 172.84.184.166:23624] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.84.184.166 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 14:15:26.111560 2026] [security2:error] [pid 5817:tid 5817] [client 172.84.184.166:23624] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "somewierdness.com"] [uri "/sftp-config.json"] [unique_id "atUMvtaiIj9D7Q9qlIuNnAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
