|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210580) triggered by 217.216.65.150 (vmi3617734.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 04:22:39.241073 2026] [security2:error] [pid 7240:tid 7240] [cli ...
show more
(mod_security) mod_security (id:210580) triggered by 217.216.65.150 (vmi3617734.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 04:22:39.241073 2026] [security2:error] [pid 7240:tid 7240] [client 217.216.65.150:41012] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "sftp-config.json" at REQUEST_COOKIES:handl_landing_page. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||alltrashremoval.com|F|2"] [data "Matched Data: sftp-config.json found within REQUEST_COOKIES:handl_landing_page: http:/topirishbettingsites.com/sftp-config.json"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "alltrashremoval.com"] [uri "/.vscode/sftp.json"] [unique_id "arzGz5QB35rH7yYhfKMREAAAAAk"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇧🇪
cmbplf
|
|
242 requests with url.path *config.json
|
Brute-Force
Bad Web Bot
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210580) triggered by 217.216.65.150 (vmi3617734.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 01:32:12.723849 2026] [security2:error] [pid 18747:tid 18747] [c ...
show more
(mod_security) mod_security (id:210580) triggered by 217.216.65.150 (vmi3617734.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Sep 30 01:32:12.723849 2026] [security2:error] [pid 18747:tid 18747] [client 217.216.65.150:58090] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "sftp-config.json" at REQUEST_COOKIES:handl_landing_page. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||sicktrax.com|F|2"] [data "Matched Data: sftp-config.json found within REQUEST_COOKIES:handl_landing_page: https:/mr-roofing.com/sftp-config.json"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "sicktrax.com"] [uri "/.vscode/sftp.json"] [unique_id "arye3E9Nwav7jJd0gFriygAAAAg"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
altenglaner
|
|
Web scanner probing for sensitive files (.env, .git, backups) or path traversal. Reported by fail2ban.
|
Hacking
Web App Attack
|
|
🇩🇪
LRob
|
|
Vulnerability scanning | method: GET | path: /sftp-config.json, /.vscode/sftp.json | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
|
Port Scan
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 217.216.65.150 (vmi3617734.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 19:43:16.351654 2026] [security2:error] [pid 26352:tid 26367] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 217.216.65.150 (vmi3617734.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 19:43:16.351654 2026] [security2:error] [pid 26352:tid 26367] [client 217.216.65.150:39008] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "iheb.org"] [uri "/sftp-config.json"] [unique_id "arxNFHM9b8byK8L-JPcvqQAAAI0"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 217.216.65.150 (vmi3617734.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 19:22:21.003400 2026] [security2:error] [pid 7691:tid 7780] [cli ...
show more
(mod_security) mod_security (id:210492) triggered by 217.216.65.150 (vmi3617734.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 19:22:21.003400 2026] [security2:error] [pid 7691:tid 7780] [client 217.216.65.150:57568] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "helppeopleshare.net"] [uri "/sftp-config.json"] [unique_id "arxILYc6lrIlLyzUdtMUZgAAAMQ"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 217.216.65.150 (vmi3617734.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 18:53:32.319967 2026] [security2:error] [pid 29476:tid 29476] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 217.216.65.150 (vmi3617734.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 18:53:32.319967 2026] [security2:error] [pid 29476:tid 29476] [client 217.216.65.150:40514] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "daassociatesllc.com"] [uri "/sftp-config.json"] [unique_id "arxBbKwp5qOalf0SA1fEwQAAAAQ"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 217.216.65.150 (vmi3617734.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 14:21:27.183935 2026] [security2:error] [pid 5685:tid 5685] [cli ...
show more
(mod_security) mod_security (id:210492) triggered by 217.216.65.150 (vmi3617734.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 14:21:27.183935 2026] [security2:error] [pid 5685:tid 5685] [client 217.216.65.150:53330] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whodatnation.com"] [uri "/sftp-config.json"] [unique_id "arwBp86enfJ6uRQpsGn15gAAABQ"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇩🇪
ghostwarriors
|
|
Attempts against non-existent wp-login
|
Brute-Force
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 217.216.65.150 (vmi3617734.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 11:03:05.346186 2026] [security2:error] [pid 15508:tid 15508] [c ...
show more
(mod_security) mod_security (id:210492) triggered by 217.216.65.150 (vmi3617734.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 29 11:03:05.346186 2026] [security2:error] [pid 15508:tid 15508] [client 217.216.65.150:38046] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mohsep-eg.com"] [uri "/sftp-config.json"] [unique_id "arvTKS8Apa2U3CUoki58zgAAAA4"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
