2025-05-19 15:19:57
(1 year ago)
(mod_security) mod_security triggered on hostname [redacted] 209.97.175.39 (SG/Singapore/-)
SQL Injection
🇺🇸
TPI-Abuse
2025-05-19 07:21:09
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon May 19 03:21:06.065222 2025] [security2:error] [pid 250433:tid 250433] [client 209.97.175.39:59959] [client 209.97.175.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "fourminutedecision.com"] [uri "/sftp-config.json"] [unique_id "aCrb4uZwRLcpWmNTE_uNXAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-19 02:52:34
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 18 22:52:26.812295 2025] [security2:error] [pid 734125:tid 734125] [client 209.97.175.39:55146] [client 209.97.175.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cvoguemag.com"] [uri "/sftp-config.json"] [unique_id "aCqc6tJyol0z0O_Ga2WyqgAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-18 21:41:53
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun May 18 17:41:49.953739 2025] [security2:error] [pid 2096419:tid 2096419] [client 209.97.175.39:49152] [client 209.97.175.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jdeloa.com"] [uri "/sftp-config.json"] [unique_id "aCpUHQUNhHDMorfrMCa6mAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇦
polycoda
2025-05-17 14:05:36
(1 year ago)
📄 Probes for tons of inexistent files and/or PHP scripts
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-05-16 15:52:44
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 16 11:52:41.500582 2025] [security2:error] [pid 1455840:tid 1455840] [client 209.97.175.39:58873] [client 209.97.175.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "spacemonsterpublishing.com"] [uri "/sftp-config.json"] [unique_id "aCdfSTv1OnW5f0VLyFWTFgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-15 21:37:51
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 15 17:37:43.976093 2025] [security2:error] [pid 4131139:tid 4131139] [client 209.97.175.39:54901] [client 209.97.175.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "swiss-pac.com"] [uri "/sftp-config.json"] [unique_id "aCZep71cScANgjC2SV202wAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Epimetheus
2025-05-15 21:08:02
(1 year ago)
Unauthorized access attempts:
From:
209.97.175.39
Method:
HTTPS GET
URI Path:
/sftp-config.jso ...
show more
Unauthorized access attempts:
From:
209.97.175.39
Method:
HTTPS GET
URI Path:
/sftp-config.json
UA:
"Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
show less
Web App Attack
🇺🇸
TPI-Abuse
2025-05-15 11:43:16
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 15 07:43:10.075846 2025] [security2:error] [pid 2663427:tid 2663427] [client 209.97.175.39:63558] [client 209.97.175.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gh057.io"] [uri "/sftp-config.json"] [unique_id "aCXTTpiYMROflSNx2nKsmwAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇸🇪
Xpektor
2025-05-15 05:21:00
(1 year ago)
Multiple WAF violations
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2025-05-15 00:31:43
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 14 20:31:35.649716 2025] [security2:error] [pid 934077:tid 934077] [client 209.97.175.39:64904] [client 209.97.175.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "astoriaman.com"] [uri "/sftp-config.json"] [unique_id "aCU15961AssXXNGp6I7P2wAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ardexter
2025-05-14 20:10:33
(1 year ago)
Wordpress attack and DDOS
DDoS Attack
Web App Attack
🇺🇸
TPI-Abuse
2025-05-14 18:47:23
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 14 14:47:15.733278 2025] [security2:error] [pid 2500685:tid 2500685] [client 209.97.175.39:54040] [client 209.97.175.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "atticlodgeoutdoorlearningcenter.com"] [uri "/index.php/maps-compass-gps/advanced-gps-map-class/sftp-config.json"] [unique_id "aCTlM9xKyKqXWkJRkYVUoQAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
ciccio diddo
2025-05-14 16:42:11
(1 year ago)
CMS/WP Exploit multiple 404 port:Tcp/80,443
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2025-05-14 03:03:56
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.97.175.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue May 13 23:03:51.354669 2025] [security2:error] [pid 2273821:tid 2273821] [client 209.97.175.39:51719] [client 209.97.175.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wisconsinstatehuntingexpo.com"] [uri "/sftp-config.json"] [unique_id "aCQIF4WcgxQ1_b6M3izUBwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack