🇹🇷
Jova
2026-11-14 04:38:36
UTC ·
(1 hour ago)
Probing a web server for sensitive files (.env, backups, configs): 3 requests.
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 04:26:01
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 194.233.94.78 (vmi2016783.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 23:25:57.560663 2026] [security2:error] [pid 31581:tid 31581] [cl ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.94.78 (vmi2016783.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 23:25:57.560663 2026] [security2:error] [pid 31581:tid 31581] [client 194.233.94.78:61257] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yacher.com"] [uri "/sftp-config.json"] [unique_id "avfi1fo6lRWGPpzWSwWNAwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 01:31:05
UTC ·
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 194.233.94.78 (vmi2016783.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 20:31:01.877788 2026] [security2:error] [pid 30290:tid 30290] [cl ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.94.78 (vmi2016783.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 20:31:01.877788 2026] [security2:error] [pid 30290:tid 30290] [client 194.233.94.78:55224] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "xpengineering.com"] [uri "/sftp-config.json"] [unique_id "ave51eEvN1OoIz5f5FI69wAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
cmbplf
2026-11-13 20:32:40
UTC ·
(9 hours ago)
103 requests with url.path *config.json
Brute-Force
Bad Web Bot
🇬🇧
consul.to
2026-11-13 14:28:05
UTC ·
(16 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇫🇷
masterguru
2026-11-13 09:58:47
UTC ·
(20 hours ago)
Restricted File Access Attempt. Matched phrase "config.json" at REQUEST_FILENAME. (930130-193)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 09:50:50
UTC ·
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 194.233.94.78 (vmi2016783.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:50:45.380433 2026] [security2:error] [pid 3973:tid 3973] [clie ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.94.78 (vmi2016783.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:50:45.380433 2026] [security2:error] [pid 3973:tid 3973] [client 194.233.94.78:57960] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mapleleaf-marketing.com"] [uri "/sftp-config.json"] [unique_id "avbddTCzDOAvt79tToL2wgAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 06:43:49
UTC ·
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 194.233.94.78 (vmi2016783.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 01:43:43.778494 2026] [security2:error] [pid 6526:tid 6526] [clie ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.94.78 (vmi2016783.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 01:43:43.778494 2026] [security2:error] [pid 6526:tid 6526] [client 194.233.94.78:59722] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "xyncom.com"] [uri "/sftp-config.json"] [unique_id "avaxn1KpDr3XoI-yEv1lCAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 05:17:30
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 194.233.94.78 (vmi2016783.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 00:17:22.361666 2026] [security2:error] [pid 7668:tid 7668] [clie ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.94.78 (vmi2016783.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 00:17:22.361666 2026] [security2:error] [pid 7668:tid 7668] [client 194.233.94.78:60126] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ycrlbasketball.com"] [uri "/sftp-config.json"] [unique_id "avadYkkhZ_cUHrd94f-QTwAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-13 00:33:38
UTC ·
(1 day ago)
Web attack blocked by WAF.
Web App Attack
🇫🇷
ELYAZ
2026-11-13 00:25:17
UTC ·
(1 day ago)
(y3) Failed scan -byebye- from 194.233.94.78 (SG/Singapore/vmi2016783.contaboserver.net): (CF_ENABLE)
Hacking
🇺🇸
TPI-Abuse
2026-11-12 20:35:59
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 194.233.94.78 (vmi2016783.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:35:54.824391 2026] [security2:error] [pid 22669:tid 22669] [cl ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.94.78 (vmi2016783.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:35:54.824391 2026] [security2:error] [pid 22669:tid 22669] [client 194.233.94.78:60556] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yellowbrickfoundation.com"] [uri "/sftp-config.json"] [unique_id "avYjKhXItTkRt0xATFtBJgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
altenglaner
2026-11-12 16:17:05
UTC ·
(1 day ago)
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
Hacking
Web App Attack
2026-11-12 08:05:49
UTC ·
(1 day ago)
Web attack blocked by WAF: GET /sftp-config.json, GET /.vscode/sftp.json, GET /.vscode/ftp-config.json (Private file access; Direct access to editor deployment file).
[12/Nov/2026:11:05:38 +0300] "GET /sftp-config.json HTTP/1.1" UA="Mozilla/5.0 (Maci ...
show more
Web attack blocked by WAF: GET /sftp-config.json, GET /.vscode/sftp.json, GET /.vscode/ftp-config.json (Private file access; Direct access to editor deployment file).
[12/Nov/2026:11:05:38 +0300] "GET /sftp-config.json HTTP/1.1" UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77" -> Private file access
[12/Nov/2026:11:05:44 +0300] "GET /.vscode/sftp.json HTTP/1.1" UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77" -> Direct access to editor deployment file
[12/Nov/2026:11:05:46 +0300] "GET /.vscode/ftp-config.json HTTP/1.1" UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77" -> Hidden file access
[12/Nov/2026:11:05:48 +0300] "GET /.vscode/ftp-sync.json HTTP/1.1" UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77" -> Direct access to editor deployment file
show less
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-12 07:46:51
UTC ·
(1 day ago)
(web_sensitive_file) srv102 Sensitive file probe (.env/.git/backup) 194.233.94.78 (SG/Singapore/vmi2016783.contaboserver.net): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
