2025-08-04 04:14:13
(10 months ago)
Backdrop CMS module - malicious activity detected
Bad Web Bot
Web App Attack
🇵🇱
sefinek.net
2025-08-03 18:52:01
(10 months ago)
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET metho ...
show more
Triggered Cloudflare WAF (firewallCustom) from SG.
Action taken: BLOCK
Protocol: HTTP/1.1 (GET method)
Endpoint: /sftp-config.json
UA: http://Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/46.0.2490.13 Safari/537.36
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇫🇮
oh.mg
2025-08-03 18:51:15
(10 months ago)
[Sun Aug 03 20:51:13.937236 2025] [security2:error] [pid 1989417:tid 1989445] [client 178.128.85.202 ...
show more
[Sun Aug 03 20:51:13.937236 2025] [security2:error] [pid 1989417:tid 1989445] [client 178.128.85.202:50123] [client 178.128.85.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.10.0-dev"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "mmn.cat"] [uri "/sftp-config.json"] [unique_id "aI-voUXj4aIvv5Y62H72aQAAAJM"], referer: http://mmn.cat/sftp-config.json
[Sun Aug 03 20:51:14.900939 2025] [security2:error] [pid 2173134:tid 2173140] [client 178.128.85.202:51010] [client 178.128.85.202] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (T
...
show less
Bad Web Bot
Web App Attack
🇨🇱
ifiguero
2025-08-03 17:20:39
(10 months ago)
Web Attack (\x00\x00\x00\x00\x00). 7d ban
Web App Attack
🇺🇸
TPI-Abuse
2025-08-03 17:13:22
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 03 13:13:18.091431 2025] [security2:error] [pid 26072:tid 26072] [client 178.128.85.202:62594] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fedeoliva.cl"] [uri "/sftp-config.json"] [unique_id "aI-YrnEjhOG8T59R5tqegwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-03 16:54:47
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 03 12:54:41.422996 2025] [security2:error] [pid 24438:tid 24438] [client 178.128.85.202:53132] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "asermaq.cl"] [uri "/sftp-config.json"] [unique_id "aI-UUTYkwxS8X_Pd0JUyiAAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-03 16:11:21
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 03 12:11:16.011826 2025] [security2:error] [pid 12817:tid 12817] [client 178.128.85.202:50648] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "getclock.click"] [uri "/sftp-config.json"] [unique_id "aI-KJILpE5hC4dJe3tNRBAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-03 15:51:51
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 03 11:51:45.694358 2025] [security2:error] [pid 12698:tid 12698] [client 178.128.85.202:65426] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fourminutedecision.com"] [uri "/index.php"] [unique_id "aI-FkUi5WTEUJuskuljbfwAAAAU"], referer: http://4minute.click/sftp-config.json
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-03 07:55:31
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 03 03:55:24.113289 2025] [security2:error] [pid 31134:tid 31134] [client 178.128.85.202:50417] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "melton.space"] [uri "/sftp-config.json"] [unique_id "aI8V7LbEssazfxwWJMNL8gAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
lindi
2025-08-03 06:36:22
(10 months ago)
Probing for resource vulnerabilities
...
Web Spam
Brute-Force
Bad Web Bot
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2025-08-02 22:10:34
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 02 18:10:29.027892 2025] [security2:error] [pid 11838:tid 11838] [client 178.128.85.202:57184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.136"] [uri "/sftp-config.json"] [unique_id "aI6M1c1GIwT2hoTxCMptYwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-02 04:53:19
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Aug 02 00:53:15.685104 2025] [security2:error] [pid 12186:tid 12186] [client 178.128.85.202:60951] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ustock.app"] [uri "/sftp-config.json"] [unique_id "aI2Zu7zzDIdf7SR0uELlwwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
betternews.app
2025-08-02 04:38:30
(10 months ago)
"a web request contained keyword "config.json"; Suspicious URL: /sftp-config.json"
Web Spam
Blog Spam
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-01 21:52:52
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 01 17:52:46.866925 2025] [security2:error] [pid 28048:tid 28048] [client 178.128.85.202:53926] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "maverickhousellc.com"] [uri "/sftp-config.json"] [unique_id "aI03LptswA9qeSkg2sexywAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-08-01 21:22:55
(10 months ago)
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 178.128.85.202 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 01 17:22:48.396467 2025] [security2:error] [pid 23789:tid 23789] [client 178.128.85.202:55448] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "logosformacion.net"] [uri "/sftp-config.json"] [unique_id "aI0wKDRyea6pNo6Mr3emuAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack