Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Automated requests against a hosted website: 278 requests between 11:00 and 11:59 UTC; 56 probes for exposed secrets/config files (/_profiler/open, /_profiler/phpinfo, /app_dev.php/_profiler/phpinfo). Reported automatically.
[SunNov1511:53:24.9058222026][security2:error][pid1196649:tid1196671][client191.252.153.112:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949 ...
show more[SunNov1511:53:24.9058222026][security2:error][pid1196649:tid1196671][client191.252.153.112:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"vg13.ch\"][uri\"/database.yml\"][unique_id\"avmPJDKbLd1kCXH7uDFBoQAAANM\"]
show less
Secret file probe | method: GET | path: /~/.pulumi/credentials.json, /~/.config/vercel/auth.json | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0, Mozilla/5.0 (iPhone; ...
show moreSecret file probe | method: GET | path: /~/.pulumi/credentials.json, /~/.config/vercel/auth.json | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0, Mozilla/5.0 (iPhone; CPU iPhone OS 17_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.1 Mobile/15E148 Safar | 2026-11-15 10:50 UTC
show less