🇺🇸
TPI-Abuse
2026-11-13 09:25:50
UTC ·
(19 hours ago)
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:25:44.782528 2026] [security2:error] [pid 22390:tid 22390] [client 217.70.158.239:53732] ...
show more
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:25:44.782528 2026] [security2:error] [pid 22390:tid 22390] [client 217.70.158.239:53732] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "calvetparis1937.com"] [uri "/sftp-config.json"] [unique_id "avbXmEEfYXmXmulw5QsiYwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 10:53:51
UTC ·
(2 days ago)
(mod_security) mod_security (id:949110) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 05:53:44.941981 2026] [security2:error] [pid 31042:tid 31042] [client 217.70.158.239:61406] ...
show more
(mod_security) mod_security (id:949110) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 05:53:44.941981 2026] [security2:error] [pid 31042:tid 31042] [client 217.70.158.239:61406] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "pleasejustfixit.org"] [uri "/sftp-config.json"] [unique_id "avRJOGurRcjcuQDp3olaQAAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-02 11:36:51
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:36:47.626357 2026] [security2:error] [pid 9203:tid 9203] [client 217.70.158.239:49738] M ...
show more
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 06:36:47.626357 2026] [security2:error] [pid 9203:tid 9203] [client 217.70.158.239:49738] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.mitchellamazing.com"] [uri "/sftp-config.json"] [unique_id "auh1zwTUc_CmI3v6IUEjOAAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 14:28:52
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 10:27:28.504626 2026] [security2:error] [pid 24456:tid 24456] [client 217.70.158.239:16254] ...
show more
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 10:27:28.504626 2026] [security2:error] [pid 24456:tid 24456] [client 217.70.158.239:16254] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "theprideproject.net"] [uri "/sftp-config.json"] [unique_id "auSpUASoxRy0sYeSid1ljAAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 11:55:42
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 07:54:17.965773 2026] [security2:error] [pid 337:tid 337] [client 217.70.158.239:38956] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 07:54:17.965773 2026] [security2:error] [pid 337:tid 337] [client 217.70.158.239:38956] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tupansetc.com"] [uri "/sftp-config.json"] [unique_id "auSFaZ9ZYLt-2aw6tj9QbwAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 07:15:15
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 03:15:10.696870 2026] [security2:error] [pid 26682:tid 26682] [client 217.70.158.239:62904] ...
show more
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 03:15:10.696870 2026] [security2:error] [pid 26682:tid 26682] [client 217.70.158.239:62904] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gizmolabs.net"] [uri "/sftp-config.json"] [unique_id "at2sfi8wo9Qp9UXVn-hOZAAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 00:11:23
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 20:11:18.831930 2026] [security2:error] [pid 29247:tid 29247] [client 217.70.158.239:62660] ...
show more
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 20:11:18.831930 2026] [security2:error] [pid 29247:tid 29247] [client 217.70.158.239:62660] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "localprowrestling.com"] [uri "/sftp-config.json"] [unique_id "atv3pk11uQF8CTtSs6tmcQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
FeG Deutschland
2026-10-20 11:57:35
UTC ·
(3 weeks ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 124
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 03:45:09
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 23:45:03.539059 2026] [security2:error] [pid 8307:tid 8307] [client 217.70.158.239:30520] M ...
show more
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 19 23:45:03.539059 2026] [security2:error] [pid 8307:tid 8307] [client 217.70.158.239:30520] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wilcoxlawllc.com"] [uri "/sftp-config.json"] [unique_id "atbjv7m20LMk37GGCLaJoQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 16:16:52
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 12:16:45.871924 2026] [security2:error] [pid 7029:tid 7029] [client 217.70.158.239:57212] M ...
show more
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 12:16:45.871924 2026] [security2:error] [pid 7029:tid 7029] [client 217.70.158.239:57212] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adspirowellness.com"] [uri "/sftp-config.json"] [unique_id "atTw7cJ06Rx6Umu8sfEUlQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-16 22:08:10
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 18:07:19.259478 2026] [security2:error] [pid 20073:tid 20073] [client 217.70.158.239:46900] ...
show more
(mod_security) mod_security (id:210492) triggered by 217.70.158.239 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 16 18:07:19.259478 2026] [security2:error] [pid 20073:tid 20073] [client 217.70.158.239:46900] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "hygeiamedical.icu"] [uri "/sftp-config.json"] [unique_id "atKgF56WwEsxgz56Y3iqJAAAAB4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇵🇹
gamabe
2026-10-08 00:00:00
UTC ·
(1 month ago)
Automated account enumeration: unauthenticated email-existence lookups against a mobile app API with a spoofed iOS app user agent. This IP belongs to a rotating proxy pool of ~2,000 IPs that sent up to ~39,000 lookups per day since September 2026.
Bad Web Bot
Web App Attack
🇨🇭
backslash
2025-10-25 23:55:12
UTC ·
(1 year ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
2024-04-12 02:58:41
UTC ·
(2 years ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
