🇺🇸
TPI-Abuse
2026-09-12 21:45:57
(1 hour ago)
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-4 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-41ff-fe3b-43ca.v6.sg-sin1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 17:45:51.393350 2026] [security2:error] [pid 16121:tid 16121] [client 2a04:3543:1000:2310:1465:41ff:fe3b:43ca:49549] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dungeonsremastered.com"] [uri "/sftp-config.json"] [unique_id "aqXIDyCLFohlnK3XS_ZtGQAAAFU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 12:56:13
(10 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-4 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-41ff-fe3b-43ca.v6.sg-sin1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 08:56:10.022291 2026] [security2:error] [pid 4585:tid 4585] [client 2a04:3543:1000:2310:1465:41ff:fe3b:43ca:55622] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dyslexiaspecialistsonline.com"] [uri "/sftp-config.json"] [unique_id "aqVL6tLvPQ-XOvKoQFJ3iQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 10:51:34
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-4 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-41ff-fe3b-43ca.v6.sg-sin1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 06:51:23.114395 2026] [security2:error] [pid 2129:tid 2129] [client 2a04:3543:1000:2310:1465:41ff:fe3b:43ca:63041] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drgweich.com"] [uri "/sftp-config.json"] [unique_id "aqUuq1GECQ7zyOgPJEeUMgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Baking333
2026-09-12 08:40:44
(14 hours ago)
[redacted] 2a04:3543:1000:2310:1465:41ff:fe3b:43ca - - [12/Sep/2026:09:40:41 +0100] "GET /[redacted] ...
show more
[redacted] 2a04:3543:1000:2310:1465:41ff:fe3b:43ca - - [12/Sep/2026:09:40:41 +0100] "GET /[redacted] HTTP/1.1" 302 6743 0/59929 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0" [redacted] 2a04:3543:1000:2310:1465:41ff:fe3b:43ca - - [12/Sep/2026:09:40:42 +0100] "GET /.vscode/[redacted] HTTP/1.1" 302 6743 0/53214 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:77.0) Gecko/20100101 Firefox/77.0"
show less
Bad Web Bot
Web App Attack
🇩🇪
SCHAPPY
2026-09-12 06:30:05
(16 hours ago)
Brute-force attack to identify web exploits
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 06:20:14
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-4 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-41ff-fe3b-43ca.v6.sg-sin1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 02:20:10.547379 2026] [security2:error] [pid 2747:tid 2747] [client 2a04:3543:1000:2310:1465:41ff:fe3b:43ca:62165] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drgracetomastolentino.com"] [uri "/sftp-config.json"] [unique_id "aqTvGroRoAu7D2_M9374dwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 06:04:54
(17 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-4 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-41ff-fe3b-43ca.v6.sg-sin1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 02:04:44.386060 2026] [security2:error] [pid 12624:tid 12624] [client 2a04:3543:1000:2310:1465:41ff:fe3b:43ca:50783] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drlwr.com"] [uri "/sftp-config.json"] [unique_id "aqTrfC3eFPDr6iPZw8nmOQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 02:55:55
(20 hours ago)
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-4 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-41ff-fe3b-43ca.v6.sg-sin1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 22:55:49.295010 2026] [security2:error] [pid 7634:tid 7634] [client 2a04:3543:1000:2310:1465:41ff:fe3b:43ca:51602] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dynarol.com"] [uri "/sftp-config.json"] [unique_id "aqS_Nf-UYahg0bnrUqC4jAAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-11 16:11:09
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-4 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-41ff-fe3b-43ca.v6.sg-sin1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 12:11:05.684983 2026] [security2:error] [pid 1981:tid 1981] [client 2a04:3543:1000:2310:1465:41ff:fe3b:43ca:61917] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dreamhomeappraisalservices.com"] [uri "/sftp-config.json"] [unique_id "aqQoGa4Pv7Zp85tsQWpMQwAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-11 14:56:05
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-4 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-41ff-fe3b-43ca.v6.sg-sin1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 10:55:57.350954 2026] [security2:error] [pid 6653:tid 6658] [client 2a04:3543:1000:2310:1465:41ff:fe3b:43ca:60716] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dpscsde.com"] [uri "/sftp-config.json"] [unique_id "aqQWfZheESlYQguXcmSTqwAAAMM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-11 13:50:10
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-4 ...
show more
(mod_security) mod_security (id:210492) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-41ff-fe3b-43ca.v6.sg-sin1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 11 09:50:07.028247 2026] [security2:error] [pid 15741:tid 15831] [client 2a04:3543:1000:2310:1465:41ff:fe3b:43ca:60224] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dreammile.info"] [uri "/sftp-config.json"] [unique_id "aqQHD2nbH8m3pyXAgPOMtQAAAIE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Skyrider
2026-09-11 06:51:49
(1 day ago)
Nginx: HTTP 4xx probe/scan attempts. Automated fail2ban report.
Bad Web Bot
Web App Attack
🇬🇧
openstrike.co.uk
2026-09-11 05:13:13
(1 day ago)
2 attacks on password/key grabbing URLs:
GET /.vscode/sftp.json HTTP/1.1
Hacking
🇩🇪
conseilgouz
2026-09-11 03:48:28
(1 day ago)
doe-17 : Block hidden directories=>/.vscode/sftp.json(/)
Hacking
🇺🇸
TPI-Abuse
2026-09-11 03:08:29
(1 day ago)
(mod_security) mod_security (id:949110) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-4 ...
show more
(mod_security) mod_security (id:949110) triggered by 2a04:3543:1000:2310:1465:41ff:fe3b:43ca (1465-41ff-fe3b-43ca.v6.sg-sin1.upcloud.host): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 10 23:08:25.040575 2026] [security2:error] [pid 27506:tid 27506] [client 2a04:3543:1000:2310:1465:41ff:fe3b:43ca:51386] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "30"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 5)"] [severity "CRITICAL"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "dplmat.com"] [uri "/sftp-config.json"] [unique_id "aqNwqUHxV0TcGHt9rT0SFgAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
