🇺🇸
TPI-Abuse
2026-11-12 13:16:44
UTC ·
(21 hours ago)
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 08:16:37.787097 2026] [security2:error] [pid 25259:tid 25259] [client 185.200.139.7:41234] M ...
show more
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 08:16:37.787097 2026] [security2:error] [pid 25259:tid 25259] [client 185.200.139.7:41234] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "williams-rodriguez.org"] [uri "/sftp-config.json"] [unique_id "avW8NYp5S93LXFMpvdQ3aQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 10:59:02
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 05:58:56.700186 2026] [security2:error] [pid 12314:tid 12314] [client 185.200.139.7:62906] M ...
show more
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 05:58:56.700186 2026] [security2:error] [pid 12314:tid 12314] [client 185.200.139.7:62906] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "siragusa.hatfulofrain.com"] [uri "/sftp-config.json"] [unique_id "avRKcPIdZYEDqrdc-toWaAAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 16:24:56
UTC ·
(5 days ago)
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 11:24:52.406783 2026] [security2:error] [pid 12597:tid 12597] [client 185.200.139.7:14942] M ...
show more
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 11:24:52.406783 2026] [security2:error] [pid 12597:tid 12597] [client 185.200.139.7:14942] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "destructionstudios.com"] [uri "/sftp-config.json"] [unique_id "au9Q1DSk-v7dhc7jfwXVVwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 10:35:11
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:32:48.630889 2026] [security2:error] [pid 23776:tid 23776] [client 185.200.139.7:14352] M ...
show more
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:32:48.630889 2026] [security2:error] [pid 23776:tid 23776] [client 185.200.139.7:14352] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "chyps.com"] [uri "/sftp-config.json"] [unique_id "au2s0Noa26VSx_Kz9Lwa5AAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 11:07:10
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 06:07:03.624356 2026] [security2:error] [pid 21834:tid 21834] [client 185.200.139.7:33030] M ...
show more
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 06:07:03.624356 2026] [security2:error] [pid 21834:tid 21834] [client 185.200.139.7:33030] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "navyveteran.us"] [uri "/sftp-config.json"] [unique_id "auxjV1xNBeZuyGSdaJQ9yAAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 11:55:01
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:54:55.778541 2026] [security2:error] [pid 6762:tid 6883] [client 185.200.139.7:44452] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:54:55.778541 2026] [security2:error] [pid 6762:tid 6883] [client 185.200.139.7:44452] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.helppeopleshare.net"] [uri "/y/yesnet.html/sftp-config.json"] [unique_id "auh6D_d98M-pQ8ZWdZcg0QAAAYM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-02 08:14:59
UTC ·
(1 week ago)
(web_sensitive_file) srv101 Sensitive file probe (.env/.git/backup) 185.200.139.7 (DE/Germany/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 05:32:21
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 00:31:26.389495 2026] [security2:error] [pid 520:tid 520] [client 185.200.139.7:58174] ModSe ...
show more
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 00:31:26.389495 2026] [security2:error] [pid 520:tid 520] [client 185.200.139.7:58174] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "thewhitedfamily.com"] [uri "/sftp-config.json"] [unique_id "auggLnTY0rGxc7Ovo7pI0wAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 11:32:50
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 07:32:25.268138 2026] [security2:error] [pid 21201:tid 21201] [client 185.200.139.7:35188] M ...
show more
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 07:32:25.268138 2026] [security2:error] [pid 21201:tid 21201] [client 185.200.139.7:35188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "alphaplanning.com"] [uri "/sftp-config.json"] [unique_id "auMuyegpkZBrv4f7xKL9-gAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
MusicLibrary
2026-10-29 09:04:51
UTC ·
(2 weeks ago)
Probing foreign-stack admin panels / known exploit paths (Joomla, phpMyAdmin, phpunit, OWA, etc.)
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 03:00:32
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 23:00:26.690585 2026] [security2:error] [pid 4771:tid 4771] [client 185.200.139.7:14274] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 23:00:26.690585 2026] [security2:error] [pid 4771:tid 4771] [client 185.200.139.7:14274] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "halblog.com"] [uri "/sftp-config.json"] [unique_id "at1wysrpnLEEKS1tfjz3RgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 20:58:27
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 16:58:21.804645 2026] [security2:error] [pid 6592:tid 6612] [client 185.200.139.7:3130] ModS ...
show more
(mod_security) mod_security (id:210492) triggered by 185.200.139.7 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 16:58:21.804645 2026] [security2:error] [pid 6592:tid 6612] [client 185.200.139.7:3130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "anglicancommission.com"] [uri "/sftp-config.json"] [unique_id "atfV7Zy-umtS9HKnZYRsfQAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
brantknudson.org
2026-10-18 06:11:15
UTC ·
(3 weeks ago)
Request path 'GET /.vscode/sftp.json HTTP/1.1'
Web App Attack
Hacking
🇵🇹
gamabe
2026-10-08 00:00:00
UTC ·
(1 month ago)
Automated account enumeration: unauthenticated email-existence lookups against a mobile app API with a spoofed iOS app user agent. This IP belongs to a rotating proxy pool of ~2,000 IPs that sent up to ~39,000 lookups per day since September 2026.
Bad Web Bot
Web App Attack
🇩🇪
Vegascosmetics
2026-09-21 07:42:17
UTC ·
(1 month ago)
Kingcopy.org AI-IDS (Vegas Cosmetics shop): auto-blocked after locale-probe / error-handler fuzzing against ASP.NET shop. Evidence: LOCALE-PROBE: MissingSlash (/de17848Products/FavolaCoup)
Hacking
Bad Web Bot
Web App Attack
