🇩🇪
BlueWire Hosting
2026-11-13 16:34:13
UTC ·
(21 hours ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇩🇪
LRob
2026-11-09 08:40:06
UTC ·
(5 days ago)
Secret file probe | method: GET | path: /sftp-config.json | ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 06:39:11
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.84.185.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 01:39:05.325368 2026] [security2:error] [pid 3170:tid 3170] [client 172.84.185.29:47314] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 172.84.185.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 01:39:05.325368 2026] [security2:error] [pid 3170:tid 3170] [client 172.84.185.29:47314] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "stat-alliance.com"] [uri "/sftp-config.json"] [unique_id "au12CfoWnmT6FUrFbq1KtAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 03:32:58
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.84.185.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:32:55.492123 2026] [security2:error] [pid 5069:tid 5069] [client 172.84.185.29:3110] ModS ...
show more
(mod_security) mod_security (id:210492) triggered by 172.84.185.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:32:55.492123 2026] [security2:error] [pid 5069:tid 5069] [client 172.84.185.29:3110] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "psychicangelreader.com"] [uri "/sftp-config.json"] [unique_id "au1KZ2Ym4O37SGLZ6XW5XAAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 06:57:39
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 172.84.185.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:57:34.236501 2026] [security2:error] [pid 10694:tid 10715] [client 172.84.185.29:14262] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.84.185.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:57:34.236501 2026] [security2:error] [pid 10694:tid 10715] [client 172.84.185.29:14262] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "giorgiogranozio.com"] [uri "/sftp-config.json"] [unique_id "auwo3nwxEcUq7bdm60edBAAAARM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-10-27 02:49:00
UTC ·
(2 weeks ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 21:45:25
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 172.84.185.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 17:44:58.321158 2026] [security2:error] [pid 23308:tid 23308] [client 172.84.185.29:26464] M ...
show more
(mod_security) mod_security (id:210492) triggered by 172.84.185.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 17:44:58.321158 2026] [security2:error] [pid 23308:tid 23308] [client 172.84.185.29:26464] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eefinchco.com"] [uri "/sftp-config.json"] [unique_id "atKa2o8F9M7RnajL0xexXQAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-04 22:44:46
UTC ·
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 172.84.185.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 17:44:39.409194 2026] [security2:error] [pid 17158:tid 17158] [client 172.84.185.29:59622] M ...
show more
(mod_security) mod_security (id:225170) triggered by 172.84.185.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 17:44:39.409194 2026] [security2:error] [pid 17158:tid 17158] [client 172.84.185.29:59622] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||fitzmail.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "fitzmail.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aVrtVzSS4g3occBcCm5gZgAAABU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-04 20:14:54
UTC ·
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 172.84.185.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 15:14:50.783865 2026] [security2:error] [pid 1376:tid 1376] [client 172.84.185.29:36442] Mod ...
show more
(mod_security) mod_security (id:225170) triggered by 172.84.185.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jan 04 15:14:50.783865 2026] [security2:error] [pid 1376:tid 1376] [client 172.84.185.29:36442] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||purebinary.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "purebinary.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aVrKOiWHHkHNUHLJX8vX9gAAABU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-31 23:46:51
UTC ·
(10 months ago)
(mod_security) mod_security (id:225170) triggered by 172.84.185.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 31 18:46:44.345810 2025] [security2:error] [pid 32068:tid 32111] [client 172.84.185.29:25106] M ...
show more
(mod_security) mod_security (id:225170) triggered by 172.84.185.29 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Dec 31 18:46:44.345810 2025] [security2:error] [pid 32068:tid 32111] [client 172.84.185.29:25106] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||newleafpro.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "newleafpro.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aVW15LEZwA02isz3B7xA-AAAAcw"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
