🇩🇪
XICTRON
2026-09-15 00:25:07
(17 hours ago)
ModSecurity rule violation detected by Fail2Ban
Web App Attack
🇩🇪
BlueWire Hosting
2026-09-14 16:35:34
(1 day ago)
High-confidence malicious configuration/VCS probe
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 12:49:19
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 08:49:11.275931 2026] [security2:error] [pid 4628:tid 4628] [client 2605:a140:2357:5668::1:54476] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "syndetec.com"] [uri "/sftp-config.json"] [unique_id "aqftR-stVg9nlXJIcMC6UgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 08:09:35
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 14 04:09:27.351762 2026] [security2:error] [pid 12895:tid 12978] [client 2605:a140:2357:5668::1:41216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "danielkerr.com"] [uri "/sftp-config.json"] [unique_id "aqert59nz8Jo5kGVJpjK4AAAAEM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 03:08:06
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 23:08:00.658361 2026] [security2:error] [pid 25123:tid 25123] [client 2605:a140:2357:5668::1:47452] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bruskiewitz.com"] [uri "/sftp-config.json"] [unique_id "aqdlEMLitmlOhO-bA4g_owAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
4server
2026-09-14 02:41:05
(1 day ago)
[MonSep1404:41:02.0399482026][security2:error][pid1196506:tid1196629][client2605:a140:2357:5668::1:0 ...
show more
[MonSep1404:41:02.0399482026][security2:error][pid1196506:tid1196629][client2605:a140:2357:5668::1:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.10\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"brunocampagna.com\"][uri\"/sftp-config.json\"][unique_id\"aqdevoPRlK9psL2teS9RwAAAAg4\"]
show less
Port Scan
Brute-Force
Web App Attack
🇫🇷
Baking333
2026-09-14 02:22:59
(1 day ago)
[redacted] 2605:a140:2357:5668::1 - - [14/Sep/2026:03:22:58 +0100] "GET /.vscode/[redacted] HTTP/1.1 ...
show more
[redacted] 2605:a140:2357:5668::1 - - [14/Sep/2026:03:22:58 +0100] "GET /.vscode/[redacted] HTTP/1.1" 302 6883 0/72053 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" [redacted] 2605:a140:2357:5668::1 - - [14/Sep/2026:03:22:58 +0100] "GET /[redacted] HTTP/1.1" 302 6878 0/61879 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36"
show less
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 01:56:52
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 21:56:45.838173 2026] [security2:error] [pid 14847:tid 14871] [client 2605:a140:2357:5668::1:57908] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brucejoell.com"] [uri "/sftp-config.json"] [unique_id "aqdUXdWY2vv2NWHBOLUrfgAAAQw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-14 00:39:50
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 20:39:47.133394 2026] [security2:error] [pid 3811707:tid 3811717] [client 2605:a140:2357:5668::1:37866] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "browbrew.com"] [uri "/sftp-config.json"] [unique_id "aqdCU7w6d-8wfjzDwfSt1gAAAMg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 23:48:09
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 19:48:04.179793 2026] [security2:error] [pid 5726:tid 5726] [client 2605:a140:2357:5668::1:45996] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brookspowell.com"] [uri "/sftp-config.json"] [unique_id "aqc2NMWe2UxrRQlIGB_keQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 21:52:26
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 17:52:18.611178 2026] [security2:error] [pid 31736:tid 31736] [client 2605:a140:2357:5668::1:54330] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brokenglasstelecom.com"] [uri "/sftp-config.json"] [unique_id "aqcbEs0hkFL4xZCQp9v5_AAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 17:07:30
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 13:07:25.098775 2026] [security2:error] [pid 8649:tid 8649] [client 2605:a140:2357:5668::1:50626] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brigittecavanagh.com"] [uri "/sftp-config.json"] [unique_id "aqbYTSWUKU--yH6AaEPS_gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 16:49:17
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 12:49:11.212330 2026] [security2:error] [pid 18578:tid 18578] [client 2605:a140:2357:5668::1:40396] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brightspine.com"] [uri "/sftp-config.json"] [unique_id "aqbUB8Siogoy17JFVrvWcwAAACY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 15:08:16
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 11:08:09.608123 2026] [security2:error] [pid 8723:tid 8723] [client 2605:a140:2357:5668::1:47964] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bridgital.com"] [uri "/sftp-config.json"] [unique_id "aqa8WQ-wUZq2eUboaoUGaAAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 13:47:07
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserve ...
show more
(mod_security) mod_security (id:210492) triggered by 2605:a140:2357:5668::1 (vmi3575668.contaboserver.net): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Sep 13 09:47:03.175197 2026] [security2:error] [pid 29562:tid 29562] [client 2605:a140:2357:5668::1:52774] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "brickyardinn.com"] [uri "/sftp-config.json"] [unique_id "aqapVxeyHWFFgdznEedtZwAAACI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
