🇳🇱
Mangelot Hosting
2026-11-15 03:14:28
UTC ·
(38 minutes ago)
(web_sensitive_file) srv104 Sensitive file probe (.env/.git/backup) 173.211.7.46 (US/United States/173.211.7.46.rdns.colocationamerica.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇩🇪
FeG Deutschland
2026-11-14 13:29:25
UTC ·
(14 hours ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 14
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 09:59:49
UTC ·
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:59:42.296417 2026] [security2:error] [pid 3970:tid 3 ...
show more
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:59:42.296417 2026] [security2:error] [pid 3970:tid 3970] [client 173.211.7.46:20522] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blackcanyonguides.com"] [uri "/sftp-config.json"] [unique_id "avgxDlYkG1nVd1Nlt7CAiQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 01:35:55
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 20:35:49.726682 2026] [security2:error] [pid 12513:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 20:35:49.726682 2026] [security2:error] [pid 12513:tid 12513] [client 173.211.7.46:53870] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jimwilsongallery.com"] [uri "/sftp-config.json"] [unique_id "ave69VQ6w_RwgKLkg_b8MwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 00:08:35
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 19:08:31.980493 2026] [security2:error] [pid 15002:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 19:08:31.980493 2026] [security2:error] [pid 15002:tid 15002] [client 173.211.7.46:9348] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.decroos.org"] [uri "/sftp-config.json"] [unique_id "au-9fxTtmnwnsiny2ZWdywAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 14:57:29
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 09:57:22.420553 2026] [security2:error] [pid 25767:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 09:57:22.420553 2026] [security2:error] [pid 25767:tid 25767] [client 173.211.7.46:17272] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.naturephotographyadventures.com"] [uri "/sftp-config.json"] [unique_id "au3q0ouULuYHpfD6YRbgSAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 09:35:52
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 04:35:38.301469 2026] [security2:error] [pid 19521:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 04:35:38.301469 2026] [security2:error] [pid 19521:tid 19521] [client 173.211.7.46:4182] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "2massociatesllc.com"] [uri "/sftp-config.json"] [unique_id "auxN6tnhJsSZ8WvGBUanzwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 11:27:59
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:27:56.288177 2026] [security2:error] [pid 1133:tid 1 ...
show more
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:27:56.288177 2026] [security2:error] [pid 1133:tid 1133] [client 173.211.7.46:35212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dustyscomputerservice.com"] [uri "/sftp-config.json"] [unique_id "auhzvAC-Qg18FbOpd-F87QAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-10-31 16:56:46
UTC ·
(2 weeks ago)
(web_sensitive_file) srv104 Sensitive file probe (.env/.git/backup) 173.211.7.46 (US/United States/173.211.7.46.rdns.colocationamerica.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 23:14:08
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 19:12:51.370566 2026] [security2:error] [pid 14906:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 19:12:51.370566 2026] [security2:error] [pid 14906:tid 14906] [client 173.211.7.46:36772] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jemsfood.com"] [uri "/sftp-config.json"] [unique_id "auEv8wRVssNnq0CyDKAPjQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
BlueWire Hosting
2026-10-20 12:48:19
UTC ·
(3 weeks ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇩🇪
big-cloud.nl
2026-10-20 01:06:16
UTC ·
(3 weeks ago)
Try to access /.vscode/sftp.json
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 22:09:11
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 18:07:16.682814 2026] [security2:error] [pid 19936:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 18:07:16.682814 2026] [security2:error] [pid 19936:tid 19936] [client 173.211.7.46:29274] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drgas.xyz"] [uri "/sftp-config.json"] [unique_id "atKgFLWDM1037VPvspJ6wQAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 18:17:17
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 14:17:13.843172 2026] [security2:error] [pid 26978:tid ...
show more
(mod_security) mod_security (id:210492) triggered by 173.211.7.46 (173.211.7.46.rdns.colocationamerica.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 14:17:13.843172 2026] [security2:error] [pid 26978:tid 26978] [client 173.211.7.46:60272] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "knoxbestos.com"] [uri "/sftp-config.json"] [unique_id "atJqKeM6Wzfr4qjIGrYxCAAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ValtonTahiri
2026-04-03 15:32:27
UTC ·
(7 months ago)
Honeypot hit: Elasticsearch honeypot hit on port 9200
Event: elasticpot.attack
Message: Exploit
Request: POST /_search
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:128.0) Gecko/20100101 Firefox/128.0
Exploited Host
