🇺🇸
TPI-Abuse
2026-11-15 14:39:03
UTC ·
(12 minutes ago)
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 09:38:56.093736 2026] [security2:error] [pid 6778:tid 6778] [client 201.24.183.111:42166] M ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 09:38:56.093736 2026] [security2:error] [pid 6778:tid 6778] [client 201.24.183.111:42166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "scarylogcabin.com"] [uri "/sftp-config.json"] [unique_id "avnEALGszVWCktMIW1z17QAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 00:02:05
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:01:57.958123 2026] [security2:error] [pid 17998:tid 17998] [client 201.24.183.111:23644] ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 19:01:57.958123 2026] [security2:error] [pid 17998:tid 17998] [client 201.24.183.111:23644] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "westonfamily.org"] [uri "/sftp-config.json"] [unique_id "avZTdc-HAeHhoRjgqh9SrQAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 22:12:01
UTC ·
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:11:53.719557 2026] [security2:error] [pid 12876:tid 12976] [client 201.24.183.111:28264] ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:11:53.719557 2026] [security2:error] [pid 12876:tid 12976] [client 201.24.183.111:28264] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.biblewriter.com"] [uri "/sftp-config.json"] [unique_id "avToKeQ2G6M3EPBJG2ItygAAAMk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 03:56:12
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:56:08.360692 2026] [security2:error] [pid 10279:tid 10279] [client 201.24.183.111:65150] ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:56:08.360692 2026] [security2:error] [pid 10279:tid 10279] [client 201.24.183.111:65150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "sitebuilders.org"] [uri "/sftp-config.json"] [unique_id "au1P2PR8Oo6P-WIu8vAxnwAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 02:43:04
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 21:42:57.865946 2026] [security2:error] [pid 17670:tid 17694] [client 201.24.183.111:29206] ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 21:42:57.865946 2026] [security2:error] [pid 17670:tid 17694] [client 201.24.183.111:29206] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "siriuspharmaceuticals.com"] [uri "/sftp-config.json"] [unique_id "au0-sVVhUYG3SCe_mfeHrgAAAJU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 11:53:53
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:53:17.311875 2026] [security2:error] [pid 3465:tid 3465] [client 201.24.183.111:47900] M ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:53:17.311875 2026] [security2:error] [pid 3465:tid 3465] [client 201.24.183.111:47900] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.voodooshop.com"] [uri "/voodoofest.html/sftp-config.json"] [unique_id "auh5rUIS_gw2rjqhB8MITAAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 10:01:07
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 06:01:02.510967 2026] [security2:error] [pid 12139:tid 12139] [client 201.24.183.111:20304] ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 06:01:02.510967 2026] [security2:error] [pid 12139:tid 12139] [client 201.24.183.111:20304] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bradsalerno.com"] [uri "/sftp-config.json"] [unique_id "auW8XuxN2Up8u8IKfC3b1QAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 16:16:01
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 12:15:55.851023 2026] [security2:error] [pid 2440:tid 2440] [client 201.24.183.111:11562] M ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 12:15:55.851023 2026] [security2:error] [pid 2440:tid 2440] [client 201.24.183.111:11562] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adspirowellness.com"] [uri "/sftp-config.json"] [unique_id "auTCuxB0w67uG5PX24vszQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 11:27:39
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 07:27:32.048479 2026] [security2:error] [pid 15744:tid 15744] [client 201.24.183.111:47768] ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 07:27:32.048479 2026] [security2:error] [pid 15744:tid 15744] [client 201.24.183.111:47768] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "30daysout.com"] [uri "/sftp-config.json"] [unique_id "auR_JABFsFek4Qk6_FvKJgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-10-26 21:00:32
UTC ·
(2 weeks ago)
Try to access /.vscode/sftp.json
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 14:20:05
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 10:19:56.423636 2026] [security2:error] [pid 22316:tid 22316] [client 201.24.183.111:48934] ...
show more
(mod_security) mod_security (id:210492) triggered by 201.24.183.111 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 10:19:56.423636 2026] [security2:error] [pid 22316:tid 22316] [client 201.24.183.111:48934] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "christinepeat.com"] [uri "/sftp-config.json"] [unique_id "at4QDH6h4_pVZvm4wfTc9gAAACs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-10-21 01:39:48
UTC ·
(3 weeks ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇵🇹
gamabe
2026-10-08 00:00:00
UTC ·
(1 month ago)
Automated account enumeration: unauthenticated email-existence lookups against a mobile app API with a spoofed iOS app user agent. This IP belongs to a rotating proxy pool of ~2,000 IPs that sent up to ~39,000 lookups per day since September 2026.
Bad Web Bot
Web App Attack
