🇳🇱
Mangelot Hosting
2026-11-13 12:32:15
UTC ·
(16 hours ago)
(web_sensitive_file) srv104 Sensitive file probe (.env/.git/backup) 201.24.182.151 (FR/France/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 09:27:46
UTC ·
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:27:39.875187 2026] [security2:error] [pid 7916:tid 7970] [client 201.24.182.151:30800] M ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:27:39.875187 2026] [security2:error] [pid 7916:tid 7970] [client 201.24.182.151:30800] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "coheteverde.com"] [uri "/sftp-config.json"] [unique_id "avbYC-IiGqn9ORYLBtK5XwAAAhE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
BlueWire Hosting
2026-11-13 05:58:39
UTC ·
(22 hours ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 18:17:53
UTC ·
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 13:17:47.221177 2026] [security2:error] [pid 11141:tid 11141] [client 201.24.182.151:11846] ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 13:17:47.221177 2026] [security2:error] [pid 11141:tid 11141] [client 201.24.182.151:11846] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "daveclick.com"] [uri "/sftp-config.json"] [unique_id "au9rS1yTqyTQvJkNTD657QAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 05:01:09
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 00:01:03.722617 2026] [security2:error] [pid 352:tid 352] [client 201.24.182.151:40384] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 00:01:03.722617 2026] [security2:error] [pid 352:tid 352] [client 201.24.182.151:40384] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "snowflakechristmascards.com"] [uri "/sftp-config.json"] [unique_id "au1fD0paJYwgD6JGrKz6owAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 03:40:49
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:40:45.072554 2026] [security2:error] [pid 20622:tid 20622] [client 201.24.182.151:43362] ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:40:45.072554 2026] [security2:error] [pid 20622:tid 20622] [client 201.24.182.151:43362] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sagebrush.us"] [uri "/sftp-config.json"] [unique_id "au1MPbvI1-RlSZwyX--fkwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 10:44:42
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 05:44:36.244128 2026] [security2:error] [pid 9416:tid 9416] [client 201.24.182.151:5414] Mo ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 05:44:36.244128 2026] [security2:error] [pid 9416:tid 9416] [client 201.24.182.151:5414] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.voodooshop.com"] [uri "/sftp-config.json"] [unique_id "auxeFItAUs77reRtGIW8cAAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 16:37:36
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 11:37:30.539645 2026] [security2:error] [pid 12782:tid 12782] [client 201.24.182.151:41290] ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 11:37:30.539645 2026] [security2:error] [pid 12782:tid 12782] [client 201.24.182.151:41290] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "machineryenchantress.com"] [uri "/sftp-config.json"] [unique_id "aui8ShVb_9ZYkNTo_JyfjgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 11:24:48
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:24:41.790460 2026] [security2:error] [pid 8015:tid 8015] [client 201.24.182.151:56912] M ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:24:41.790460 2026] [security2:error] [pid 8015:tid 8015] [client 201.24.182.151:56912] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "circleway.org"] [uri "/sftp-config.json"] [unique_id "auhy-fI3funXsyh24N2e8QAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-01 04:46:14
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 00:45:20.932380 2026] [security2:error] [pid 28580:tid 28580] [client 201.24.182.151:23154] ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 01 00:45:20.932380 2026] [security2:error] [pid 28580:tid 28580] [client 201.24.182.151:23154] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "noscentpro.com"] [uri "/sftp-config.json"] [unique_id "aubD4DqS8I-_RD-zoMFsbgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 17:50:50
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 13:50:16.259275 2026] [security2:error] [pid 18675:tid 18675] [client 201.24.182.151:9210] ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 13:50:16.259275 2026] [security2:error] [pid 18675:tid 18675] [client 201.24.182.151:9210] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "electric-cosmos.com"] [uri "/sftp-config.json"] [unique_id "auYqWPzr-D9gtr2JqaWtIwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 14:28:53
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 10:27:21.757264 2026] [security2:error] [pid 8519:tid 8519] [client 201.24.182.151:11646] M ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 10:27:21.757264 2026] [security2:error] [pid 8519:tid 8519] [client 201.24.182.151:11646] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "holland-kadaster-registration.com"] [uri "/sftp-config.json"] [unique_id "auSpSZxLmsL7bCS3z-7cIwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-10-29 12:40:26
UTC ·
(2 weeks ago)
[ThuOct2913:40:19.9970522026][security2:error][pid2604647:tid2604762][client201.24.182.151:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\\\\\\\\.vscode/\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"] ...
show more
[ThuOct2913:40:19.9970522026][security2:error][pid2604647:tid2604762][client201.24.182.151:0]ModSecurity:Accessdeniedwithcode403\(phase2\).Patternmatch\"\\\\\\\\.vscode/\"atREQUEST_FILENAME.[file\"/etc/apache2/conf.d/modsec_rules/10_asl_rules.conf\"][line\"1189\"][id\"350593\"][rev\"1\"][msg\"Atomicorp.comWAFRules:AttackBlocked-Dataleakage-attempttoaccessstoredvscodepasswords\"][severity\"CRITICAL\"][hostname\"worldgoldfundltd.com\"][uri\"/.vscode/sftp.json\"][unique_id\"auM-swPgWnPlAVOVs7Rg3wAAAYc\"]
show less
Port Scan
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 00:38:05
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 20:35:46.984120 2026] [security2:error] [pid 27964:tid 27987] [client 201.24.182.151:51118] ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.182.151 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 20:35:46.984120 2026] [security2:error] [pid 27964:tid 27987] [client 201.24.182.151:51118] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "prominentregroup.com"] [uri "/sftp-config.json"] [unique_id "auFDYnV4jhDAnqSBoAhUgAAAAJE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-25 04:24:38
UTC ·
(2 weeks ago)
Fuzzing/Looking for credentials files.
Brute-Force
Web App Attack
