🇩🇪
macrob
2026-07-26 05:21:51
(5 hours ago)
2026/07/26 05:21:40 [error] 2785882#2785882: *412250701 access forbidden by rule, client: 218.145.31 ...
show more
2026/07/26 05:21:40 [error] 2785882#2785882: *412250701 access forbidden by rule, client: 218.145.31.95, server: antzfund.com, request: "GET /.vscode/sftp.json HTTP/1.1", host: "antzfund.com"
2026/07/26 05:21:42 [error] 2785882#2785882: *412250821 access forbidden by rule, client: 218.145.31.95, server: antzfund.com, request: "GET /.ftpconfig HTTP/1.1", host: "antzfund.com"
2026/07/26 05:21:50 [error] 2785882#2785882: *412251015 access forbidden by rule, client: 218.145.31.95, server: antzfund.com, request: "GET /.vscode/sftp.json HTTP/1.1", host: "antzfund.com"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-07-26 01:03:24
(10 hours ago)
(mod_security) mod_security (id:210580) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210580) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 21:03:18.420161 2026] [security2:error] [pid 1582382:tid 1582382] [client 218.145.31.95:61858] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "sftp-config.json" at REQUEST_COOKIES:handl_landing_page. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||aliciagrant.com|F|2"] [data "Matched Data: sftp-config.json found within REQUEST_COOKIES:handl_landing_page: https:/appnicorn.com/sftp-config.json"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "aliciagrant.com"] [uri "/.vscode/sftp.json"] [unique_id "amVc1rbVpB9lHfC2to0POgAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇩
Burayot
2026-07-26 00:45:53
(10 hours ago)
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 218.145.31.95 (KR/South Korea/-): 1 ...
show more
LF_MODSEC: (mod_security) mod_security (id:949110) triggered by 218.145.31.95 (KR/South Korea/-): 1 in the last 3600 secs
show less
Web App Attack
🇬🇧
consul.to
2026-07-26 00:22:16
(10 hours ago)
Web attack/malicious scanning detected
Web App Attack
🇩🇪
ISPLtd
2026-07-25 20:06:05
(15 hours ago)
218.145.31.95 [25/Jul/2026:17:06:03 -0300] altenberg-ib.com:443 URL:/sftp-config.json "GET /sftp-con ...
show more
218.145.31.95 [25/Jul/2026:17:06:03 -0300] altenberg-ib.com:443 URL:/sftp-config.json "GET /sftp-config.json
218.145.31.95 [25/Jul/2026:17:06:05 -0300] altenberg-ib.com:443 URL:/ftp_config.json "GET /ftp_config.json
...
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-07-25 19:41:23
(15 hours ago)
(mod_security) mod_security (id:210580) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210580) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 15:41:19.035784 2026] [security2:error] [pid 1909265:tid 1909265] [client 218.145.31.95:59952] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "sftp-config.json" at REQUEST_COOKIES:handl_landing_page. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||artbycorinnedodge.com|F|2"] [data "Matched Data: sftp-config.json found within REQUEST_COOKIES:handl_landing_page: https:/appnicorn.com/sftp-config.json"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "artbycorinnedodge.com"] [uri "/.vscode/sftp.json"] [unique_id "amURX6GfNblCNpWWnIUkZwAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-25 07:23:33
(1 day ago)
(mod_security) mod_security (id:210580) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210580) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 25 03:23:26.487898 2026] [security2:error] [pid 24272:tid 24272] [client 218.145.31.95:25606] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "sftp-config.json" at REQUEST_COOKIES:handl_landing_page. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||abbeygardensllandudno.com|F|2"] [data "Matched Data: sftp-config.json found within REQUEST_COOKIES:handl_landing_page: https:/appnicorn.com/sftp-config.json"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "abbeygardensllandudno.com"] [uri "/.vscode/sftp.json"] [unique_id "amRkbux8MF7mFLhnR2O0vQAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-25 03:05:25
(1 day ago)
(mod_security) mod_security (id:210580) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210580) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 23:05:18.676132 2026] [security2:error] [pid 639657:tid 639657] [client 218.145.31.95:0] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "sftp-config.json" at REQUEST_COOKIES:handl_landing_page. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||antitribu.com|F|2"] [data "Matched Data: sftp-config.json found within REQUEST_COOKIES:handl_landing_page: https:/appnicorn.com/sftp-config.json"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "antitribu.com"] [uri "/.vscode/sftp.json"] [unique_id "amQn7g8rdwaOBgwUx8bWzgAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
consul.to
2026-07-25 00:09:00
(1 day ago)
Web attack/malicious scanning detected
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 20:57:17
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 16:57:10.773983 2026] [security2:error] [pid 876317:tid 876317] [client 218.145.31.95:26228] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "aarce.me"] [uri "/sftp-config.json"] [unique_id "amPRplsSJpZipod8ziPkxAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 16:55:26
(1 day ago)
(mod_security) mod_security (id:210580) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210580) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 12:55:18.318539 2026] [security2:error] [pid 24666:tid 24666] [client 218.145.31.95:34524] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "sftp-config.json" at REQUEST_COOKIES:handl_landing_page. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||abilityimprinting.com|F|2"] [data "Matched Data: sftp-config.json found within REQUEST_COOKIES:handl_landing_page: https:/appnicorn.com/sftp-config.json"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "abilityimprinting.com"] [uri "/.vscode/sftp.json"] [unique_id "amOY9ujJtIIG_TO9rg0FxQAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 08:25:08
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 04:24:58.432846 2026] [security2:error] [pid 2001831:tid 2001831] [client 218.145.31.95:30362] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "17thstreetrealty.com"] [uri "/sftp-config.json"] [unique_id "amMhWhDj6nvJDgDDD1c3gAAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 06:28:25
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 02:28:19.220095 2026] [security2:error] [pid 3628306:tid 3628306] [client 218.145.31.95:17868] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "acmax.com"] [uri "/sftp-config.json"] [unique_id "amMGA_PVdP66mKFbgAQEXgAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-24 04:17:53
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 24 00:17:44.842155 2026] [security2:error] [pid 3181349:tid 3181349] [client 218.145.31.95:48122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.mitchellamazing.com"] [uri "/sftp-config.json"] [unique_id "amLnaOTdEG87rGTbYJ6mAgAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-23 20:14:51
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 218.145.31.95 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 23 16:14:43.500897 2026] [security2:error] [pid 3603918:tid 3603918] [client 218.145.31.95:24892] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.amazinghydraulics.com"] [uri "/sftp-config.json"] [unique_id "amJ2M4HstXoecCMLq0RPyAAAABw"]
show less
Brute-Force
Bad Web Bot
Web App Attack