🇺🇸
TPI-Abuse
2026-09-15 12:47:37
(1 hour ago)
(mod_security) mod_security (id:949110) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserve ...
show more
(mod_security) mod_security (id:949110) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 08:47:31.960810 2026] [security2:error] [pid 16208:tid 16208] [client 2605:a140:2357:5667::1:35788] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "ritualistik.com"] [uri "/sftp-config.json"] [unique_id "aqk-YyZq2xsTuE8n9OPRfwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-15 07:16:20
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 03:16:12.350413 2026] [security2:error] [pid 31908:tid 31908] [client 2605:a140:2357:5667::1:60558] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cocoscabanas.com"] [uri "/sftp-config.json"] [unique_id "aqjwvLsCxocxWPAafuGSbwAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-15 06:19:07
(7 hours ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Sep 15 02:19:02.425087 2026] [security2:error] [pid 11811:tid 11811] [client 2605:a140:2357:5667::1:45504] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jerusalem-temple-today.com"] [uri "/sftp-config.json"] [unique_id "aqjjVowTAU6WQ-2j2JZhvQAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 04:28:53
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 00:28:46.554400 2026] [security2:error] [pid 3432:tid 3432] [client 2605:a140:2357:5667::1:44380] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ismycorporationsafe.com"] [uri "/sftp-config.json"] [unique_id "aqd3_kUFNCGdPLURl56FMwAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 04:13:41
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 00:13:38.227042 2026] [security2:error] [pid 26012:tid 26012] [client 2605:a140:2357:5667::1:54792] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "ismaelcavazos.com"] [uri "/sftp-config.json"] [unique_id "aqd0cswYhLsiqEfVB_ZjzQAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-14 03:59:24
(1 day ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /sftp-config.json | 2026-09-14 03:59 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 03:56:05
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 23:56:00.928997 2026] [security2:error] [pid 25681:tid 25681] [client 2605:a140:2357:5667::1:47950] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "goepf.com"] [uri "/sftp-config.json"] [unique_id "aqdwUFwd15SamxKPlyTmRQAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 03:28:49
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 23:28:42.539583 2026] [security2:error] [pid 27134:tid 27134] [client 2605:a140:2357:5667::1:52528] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "islandimagegallery.com"] [uri "/sftp-config.json"] [unique_id "aqdp6qcckSZESNaBQN5HmQAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 03:08:18
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 23:08:10.765706 2026] [security2:error] [pid 21618:tid 21618] [client 2605:a140:2357:5667::1:38114] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bowdens-landing.com"] [uri "/sftp-config.json"] [unique_id "aqdlGui3qj89jW2Wj4SwBwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 01:46:18
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 21:46:10.271571 2026] [security2:error] [pid 2578:tid 2578] [client 2605:a140:2357:5667::1:36676] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gocdt.com"] [uri "/sftp-config.json"] [unique_id "aqdR4mV-lkw0RA4nOtDOvgAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
BlueWire Hosting
2026-09-13 23:27:45
(1 day ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 23:24:56
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 19:24:50.163536 2026] [security2:error] [pid 26893:tid 26893] [client 2605:a140:2357:5667::1:39418] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "isaacsonpaintings.com"] [uri "/sftp-config.json"] [unique_id "aqcwwo3ynhrg7nI078IZhgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 23:09:14
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 19:09:11.064806 2026] [security2:error] [pid 23041:tid 23041] [client 2605:a140:2357:5667::1:37780] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "go-901.com"] [uri "/sftp-config.json"] [unique_id "aqctF3ubLCLpc6UxGaq42QAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 20:54:31
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 16:54:27.847689 2026] [security2:error] [pid 23873:tid 23873] [client 2605:a140:2357:5667::1:54412] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "gmacguffin.com"] [uri "/sftp-config.json"] [unique_id "aqcNg3Sk-Zz7dFK8tCrHTwAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 19:47:19
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5667::1 (vmi3575667.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 15:47:16.836885 2026] [security2:error] [pid 9547:tid 9547] [client 2605:a140:2357:5667::1:32876] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "glslightingandcontrols.com"] [uri "/sftp-config.json"] [unique_id "aqb9xAHqkbPvVmzzXB_5rQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
