🇧🇪
cmbplf
2026-09-13 01:38:03
(2 weeks ago)
153 requests with url.path *config.json
108 requests with url.path *sftp.json
Brute-Force
Bad Web Bot
🇺🇸
TPI-Abuse
2026-09-13 00:46:18
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:46f2:1028::19c:2a8 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:46f2:1028::19c:2a8 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 20:46:15.597856 2026] [security2:error] [pid 8694:tid 8694] [client 2a09:bac5:46f2:1028::19c:2a8:51866] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jasonpolland.com"] [uri "/sftp-config.json"] [unique_id "aqXyV8boX-kaH8X8S_x8lwAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 00:29:04
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:46f2:1028::19c:2a8 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:46f2:1028::19c:2a8 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 20:28:56.495763 2026] [security2:error] [pid 30587:tid 30631] [client 2a09:bac5:46f2:1028::19c:2a8:10110] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kiwimagic.net"] [uri "/sftp-config.json"] [unique_id "aqXuSCUgZI5erEJRfJMiWQAAANY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-13 00:09:22
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:46f2:1028::19c:2a8 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:46f2:1028::19c:2a8 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 20:09:18.578724 2026] [security2:error] [pid 7432:tid 7432] [client 2a09:bac5:46f2:1028::19c:2a8:57642] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "homewaterproofing.com"] [uri "/sftp-config.json"] [unique_id "aqXprotCt3vGEltdE7K0oQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 23:51:53
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:46f2:1028::19c:2a8 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:46f2:1028::19c:2a8 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 19:51:48.863379 2026] [security2:error] [pid 7578:tid 7578] [client 2a09:bac5:46f2:1028::19c:2a8:44538] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jeranny.com"] [uri "/sftp-config.json"] [unique_id "aqXllK96G7Zq4cMTGbit3wAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-09-12 23:44:05
(2 weeks ago)
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: ...
show more
Probing for secret files (.git, .env, credentials, database dumps, wp-config) | method: GET | path: /.vscode/sftp.json | 2026-09-12 23:44 UTC
show less
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 23:22:31
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:46f2:1028::19c:2a8 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:46f2:1028::19c:2a8 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 19:22:23.837494 2026] [security2:error] [pid 14790:tid 14790] [client 2a09:bac5:46f2:1028::19c:2a8:51120] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "isyourcompanysafe.com"] [uri "/sftp-config.json"] [unique_id "aqXer3DvjakvNwODfYgtBQAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Starburst SysOp Team
2026-09-12 23:09:48
(2 weeks ago)
Restricted File Access Attempt. Matched phrase "config.json" at REQUEST_FILENAME. (930130-mnz6-3)
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-09-12 23:04:11
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:46f2:1028::19c:2a8 (Unknown): 1 in th ...
show more
(mod_security) mod_security (id:210492) triggered by 2a09:bac5:46f2:1028::19c:2a8 (Unknown): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Sep 12 19:04:04.636225 2026] [security2:error] [pid 2167773:tid 2167790] [client 2a09:bac5:46f2:1028::19c:2a8:21960] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jojoproperties.com"] [uri "/sftp-config.json"] [unique_id "aqXaZHhl9b0vxqXz04GFQwAAAMU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
