🇦🇺
A.i.D.A.N.N
2026-11-15 08:09:02
UTC ·
(7 hours ago)
A.i.D.A.N.N: Anomaly Detected - Signature match Web Service - Web application attack detected
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 07:14:01
UTC ·
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 02:13:53.260788 2026] [security2:error] [pid 1057:tid 1057] [cli ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 02:13:53.260788 2026] [security2:error] [pid 1057:tid 1057] [client 194.233.95.167:55011] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "willowgrovemusic.com"] [uri "/sftp-config.json"] [unique_id "avlbseEJrUuIrkLhcUFadQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Penny Packer
2026-11-15 06:25:09
UTC ·
(9 hours ago)
Fail2Ban apache-tripwires
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 02:54:40
UTC ·
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 21:54:32.891754 2026] [security2:error] [pid 25095:tid 25095] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 21:54:32.891754 2026] [security2:error] [pid 25095:tid 25095] [client 194.233.95.167:54632] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "willoughbywolf.com"] [uri "/sftp-config.json"] [unique_id "avke6BdPDeJLdB8uO7YUjAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-14 21:04:32
UTC ·
(18 hours ago)
Web attack blocked by WAF: GET /sftp-config.json, GET /.vscode/sftp.json, GET /.vscode/ftp-config.json (Private file access; Direct access to editor deployment file).
[15/Nov/2026:00:04:27 +0300] "GET /sftp-config.json HTTP/1.1" UA="Mozilla/5.0 (Maci ...
show more
Web attack blocked by WAF: GET /sftp-config.json, GET /.vscode/sftp.json, GET /.vscode/ftp-config.json (Private file access; Direct access to editor deployment file).
[15/Nov/2026:00:04:27 +0300] "GET /sftp-config.json HTTP/1.1" UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77" -> Private file access
[15/Nov/2026:00:04:29 +0300] "GET /.vscode/sftp.json HTTP/1.1" UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77" -> Direct access to editor deployment file
[15/Nov/2026:00:04:30 +0300] "GET /.vscode/ftp-config.json HTTP/1.1" UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77" -> Hidden file access
[15/Nov/2026:00:04:31 +0300] "GET /.vscode/ftp-sync.json HTTP/1.1" UA="Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77" -> Direct access to editor deployment file
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 20:46:11
UTC ·
(18 hours ago)
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 15:46:08.084195 2026] [security2:error] [pid 24937:tid 24937] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 15:46:08.084195 2026] [security2:error] [pid 24937:tid 24937] [client 194.233.95.167:54491] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "williambarfoot.com"] [uri "/sftp-config.json"] [unique_id "avjIkFHKZ7g1OkAag4IxRgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 17:45:38
UTC ·
(21 hours ago)
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 12:45:32.385199 2026] [security2:error] [pid 28304:tid 28304] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 12:45:32.385199 2026] [security2:error] [pid 28304:tid 28304] [client 194.233.95.167:65080] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wildpete.com"] [uri "/sftp-config.json"] [unique_id "aviePMWBi-FXK1HXg4PXdwAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 15:57:10
UTC ·
(23 hours ago)
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 10:57:06.792765 2026] [security2:error] [pid 2684:tid 2684] [cli ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 10:57:06.792765 2026] [security2:error] [pid 2684:tid 2684] [client 194.233.95.167:49461] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wildlifetaxidermy.com"] [uri "/sftp-config.json"] [unique_id "aviE0nEhGi4I-4lq6i_2lQAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 14:43:04
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 09:42:57.088909 2026] [security2:error] [pid 13113:tid 13198] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 09:42:57.088909 2026] [security2:error] [pid 13113:tid 13198] [client 194.233.95.167:49612] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "yubasutterphotographer.com"] [uri "/sftp-config.json"] [unique_id "avhzcVn82gEySzpCGTli3wAAAgk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-14 12:35:54
UTC ·
(1 day ago)
(web_sensitive_file) srv201 Sensitive file probe (.env/.git/backup) 194.233.95.167 (SG/Singapore/vmi2016784.contaboserver.net): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 11:36:37
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 06:36:29.243047 2026] [security2:error] [pid 1628:tid 1628] [cli ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 06:36:29.243047 2026] [security2:error] [pid 1628:tid 1628] [client 194.233.95.167:58814] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.wilburmanagementgroup.com"] [uri "/sftp-config.json"] [unique_id "avhHvRQbXOjim0Fj5u3t0QAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 09:28:38
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:28:32.119766 2026] [security2:error] [pid 899525:tid 899525] ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:28:32.119766 2026] [security2:error] [pid 899525:tid 899525] [client 194.233.95.167:57720] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wiknwax.com"] [uri "/sftp-config.json"] [unique_id "avgpwAHBIkulXzix_ZvDNQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 09:07:39
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:07:30.814398 2026] [security2:error] [pid 13902:tid 13902] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:07:30.814398 2026] [security2:error] [pid 13902:tid 13902] [client 194.233.95.167:54429] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wilcoxlawllc.com"] [uri "/sftp-config.json"] [unique_id "avgk0mR3o9vBfOfYRuHkBQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
JustMeHere
2026-11-14 06:12:57
UTC ·
(1 day ago)
[Sat Nov 14 01:12:52.473175 2026] [security2:error] [pid 2913:tid 2943] [client 194.233.95.167:57506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/acti ...
show more
[Sat Nov 14 01:12:52.473175 2026] [security2:error] [pid 2913:tid 2943] [client 194.233.95.167:57506] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:blocking_inbound_anomaly_score. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "233"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [ver "OWASP_CRS/4.22.0"] [tag "anomaly-evaluation"] [tag "OWASP_CRS"] [hostname "yorknation.com"] [uri "/sftp-config.json"] [unique_id "avf75HQUheohJXWQ31eqQgAAAMI"]
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 05:50:49
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 00:50:42.411271 2026] [security2:error] [pid 25786:tid 25786] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 194.233.95.167 (vmi2016784.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 00:50:42.411271 2026] [security2:error] [pid 25786:tid 25786] [client 194.233.95.167:65255] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "zackfranz.com"] [uri "/sftp-config.json"] [unique_id "avf2sr0Qpu3cRy4zCZADqwAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
