🇩🇪
LRob
2026-11-14 17:26:06
UTC ·
(16 hours ago)
Secret file probe | method: GET | path: /.vscode/sftp.json | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 22:18:43
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:18:36.706435 2026] [security2:error] [pid 6151:tid 6151] [client 185.202.157.83:31982] M ...
show more
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:18:36.706435 2026] [security2:error] [pid 6151:tid 6151] [client 185.202.157.83:31982] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "eastsidenotary.com"] [uri "/sftp-config.json"] [unique_id "avTpvODNw6M7YaCHOsxVmAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 11:07:39
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 06:07:32.161066 2026] [security2:error] [pid 15745:tid 15745] [client 185.202.157.83:17802] ...
show more
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 06:07:32.161066 2026] [security2:error] [pid 15745:tid 15745] [client 185.202.157.83:17802] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wisdomwfm.com"] [uri "/sftp-config.json"] [unique_id "avRMdHOzxo4WCbQYCnVKYQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
4server
2026-11-08 00:16:27
UTC ·
(1 week ago)
[SunNov0801:16:19.9607982026][security2:error][pid412776:tid412902][client185.202.157.83:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\\\\\\\\.vscode/\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][l ...
show more
[SunNov0801:16:19.9607982026][security2:error][pid412776:tid412902][client185.202.157.83:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\\\\\\\\.vscode/\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"1189\"][id\"350593\"][rev\"1\"][msg\"Atomicorp.comWAFRules:AttackBlocked-Dataleakage-attempttoaccessstoredvscodepasswords\"][severity\"CRITICAL\"][hostname\"cybertelgroup.com\"][uri\"/.vscode/sftp.json\"][unique_id\"au-_U-VrMuPSMlxYctuo3AAAAQ8\"]
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 19:29:01
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 14:28:56.852640 2026] [security2:error] [pid 13220:tid 13220] [client 185.202.157.83:23334] ...
show more
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 14:28:56.852640 2026] [security2:error] [pid 13220:tid 13220] [client 185.202.157.83:23334] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "davisound.com"] [uri "/DaviSoapBox.html/sftp-config.json"] [unique_id "au97-C5d7sHk68EOsoUd5QAAAC8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 03:09:48
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:09:42.700206 2026] [security2:error] [pid 29823:tid 29823] [client 185.202.157.83:55706] ...
show more
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:09:42.700206 2026] [security2:error] [pid 29823:tid 29823] [client 185.202.157.83:55706] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "a1laha.com"] [uri "/sftp-config.json"] [unique_id "au1E9r8EORE6-xhRpb72KwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 22:22:56
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 17:22:50.214647 2026] [security2:error] [pid 19432:tid 19432] [client 185.202.157.83:4184] ...
show more
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 17:22:50.214647 2026] [security2:error] [pid 19432:tid 19432] [client 185.202.157.83:4184] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "souldata.com"] [uri "/sftp-config.json"] [unique_id "au0BugqczXdzaRFVXaoucwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 11:22:37
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 06:22:33.038455 2026] [security2:error] [pid 2575:tid 2575] [client 185.202.157.83:8488] Mo ...
show more
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 06:22:33.038455 2026] [security2:error] [pid 2575:tid 2575] [client 185.202.157.83:8488] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blacksheepoffroad.com"] [uri "/sftp-config.json"] [unique_id "auxm-U640CV5pL2-MaOtkAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
Ivo Vynckier
2026-11-01 14:35:00
UTC ·
(1 week ago)
185.202.157.83 - - [31/Oct/2026:21:38:33 +0100] "GET /.vscode/sftp.json HTTP/1.1" 301 304 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36"
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 19:03:01
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 14:59:31.359878 2026] [security2:error] [pid 26098:tid 26098] [client 185.202.157.83:54714] ...
show more
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 14:59:31.359878 2026] [security2:error] [pid 26098:tid 26098] [client 185.202.157.83:54714] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "terrysavastano.com"] [uri "/sftp-config.json"] [unique_id "auOXk1QtZvn24N1i3BOrDgAAACk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇱
Budyn
2026-10-27 03:29:40
UTC ·
(2 weeks ago)
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.store | URI: /sftp-config.json | UA: ...
show more
Automated threat detected by Budyn Honeypot Sinkhole. Attack type: CRITICAL: ModSecurity WAF Exploit Block. Malicious scanner triggered a security trap targeting emulated vulnerabilities. Evidence: HOST: teddypot.store | URI: /sftp-config.json | UA: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36 | BODY: [Empty / GET Request] | HEADERS: {"Connection":"Keep-Alive","X-Forwarded-Proto":"https","Cf-Visitor":"{\"scheme\":\"https\"}","Cf-Ipcountry":"DE","Cf-Connecting-Ip":"185.202.157.83","Cdn-Loop":"cloudflare; loops=1","Cf-Ray":"a50e9e230a10e0d3-MUC","Accept":"*\/*","Accept-Encoding":"gzip, br","X-Forwarded-For":"185.202.157.83","X-Waf-Trig
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 22:34:08
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 18:34:04.358550 2026] [security2:error] [pid 8338:tid 8338] [client 185.202.157.83:44594] M ...
show more
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 18:34:04.358550 2026] [security2:error] [pid 8338:tid 8338] [client 185.202.157.83:44594] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "blockadegc.com"] [uri "/sftp-config.json"] [unique_id "atfsXDn0RspPVf7zWFrxMgAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 14:09:43
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:09:36.590822 2026] [security2:error] [pid 25491:tid 25491] [client 185.202.157.83:4516] ...
show more
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 10:09:36.590822 2026] [security2:error] [pid 25491:tid 25491] [client 185.202.157.83:4516] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "addisonchiropracticcenter.com"] [uri "/sftp-config.json"] [unique_id "atTTIIkXF24czRD7jHJ1TwAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 06:28:48
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:28:43.469435 2026] [security2:error] [pid 12944:tid 12950] [client 185.202.157.83:50746] ...
show more
(mod_security) mod_security (id:210492) triggered by 185.202.157.83 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 02:28:43.469435 2026] [security2:error] [pid 12944:tid 12950] [client 185.202.157.83:50746] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "australialifecoach.com"] [uri "/sftp-config.json"] [unique_id "atRnGzYVE7BM3aE42kFPkgAAAMM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
