🇺🇸
TPI-Abuse
2026-11-06 14:55:50
UTC ·
(8 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.222.164.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 09:55:44.418764 2026] [security2:error] [pid 20778:tid 20778] [client 104.222.164.159:5851 ...
show more
(mod_security) mod_security (id:210492) triggered by 104.222.164.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 09:55:44.418764 2026] [security2:error] [pid 20778:tid 20778] [client 104.222.164.159:58516] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kompassconsulting.com"] [uri "/sftp-config.json"] [unique_id "au3qcI_uYwSBKgVZozZoRQAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 10:34:02
UTC ·
(12 hours ago)
(mod_security) mod_security (id:210492) triggered by 104.222.164.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:32:50.787201 2026] [security2:error] [pid 24271:tid 24271] [client 104.222.164.159:2141 ...
show more
(mod_security) mod_security (id:210492) triggered by 104.222.164.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:32:50.787201 2026] [security2:error] [pid 24271:tid 24271] [client 104.222.164.159:21418] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "donutburger.com"] [uri "/sftp-config.json"] [unique_id "au2s0sOBR7hdUxtW-vETqwAAACE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
CoreTech srl
2026-11-06 05:53:57
UTC ·
(17 hours ago)
cloudlinux2 fail2ban: 2026-11-06 06:49:04,590 fail2ban.filter [1651]: INFO [plesk-modsecurity] Found 34.19.217.2 - 2026-11-06 06:49:04cloudlinux2 fail2ban: 2026-11-06 06:49:04,646 fail2ban.filter [1651]: INFO [plesk-modsecurity] ...
show more
cloudlinux2 fail2ban: 2026-11-06 06:49:04,590 fail2ban.filter [1651]: INFO [plesk-modsecurity] Found 34.19.217.2 - 2026-11-06 06:49:04cloudlinux2 fail2ban: 2026-11-06 06:49:04,646 fail2ban.filter [1651]: INFO [plesk-modsecurity] Found 34.19.217.2 - 2026-11-06 06:49:04cloudlinux2 fail2ban: 2026-11-06 06:49:04,658 fail2ban.filter [1651]: INFO [plesk-modsecurity] Found 34.19.217.2 - 2026-11-06 06:49:04cloudlinux2 fail2ban: 2026-11-06 06:49:04,568 fail2ban.filter [1651]: INFO [plesk-modsecurity] Found 34.19.217.2 - 2026-11-06 06:49:04cloudlinux2 fail2ban: 2026-11-06 06:49:04,829 fail2ban.actions [1651]: NOTICE [plesk-modsecurity] Ban 34.19.217.2cloudlinux2 fail2ban: 2026-11-06 06:49:04,834 fail2ban.filter [1651]: INFO [recidive] Found 34.19.217.2 - 2026-11-06 06:49:04cloudlinux2 fail2ban: 2026-11-06 06:52:13,195 fail2ban.filter [1651]: INFO [plesk-modsecurity] Found 104.222.164.159 - 2026-11-06 06:52:13cloudlinux2 fail2ban: 2026-11-06 06:52
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 07:08:12
UTC ·
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 104.222.164.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 03:08:07.837886 2026] [security2:error] [pid 16203:tid 16316] [client 104.222.164.159:3695 ...
show more
(mod_security) mod_security (id:210492) triggered by 104.222.164.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 03:08:07.837886 2026] [security2:error] [pid 16203:tid 16316] [client 104.222.164.159:36954] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "danfriel.com"] [uri "/sftp-config.json"] [unique_id "auWT19mm8QJZK5CFqTr59AAAAY0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 14:29:23
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.222.164.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 10:27:25.567714 2026] [security2:error] [pid 23874:tid 23874] [client 104.222.164.159:1171 ...
show more
(mod_security) mod_security (id:210492) triggered by 104.222.164.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 10:27:25.567714 2026] [security2:error] [pid 23874:tid 23874] [client 104.222.164.159:11710] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "boat-registration-croatia.com"] [uri "/sftp-config.json"] [unique_id "auSpTZ8ZCwvDAVR-aQzDrwAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 23:14:02
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.222.164.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 19:13:01.797811 2026] [security2:error] [pid 15541:tid 15541] [client 104.222.164.159:5308 ...
show more
(mod_security) mod_security (id:210492) triggered by 104.222.164.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 19:13:01.797811 2026] [security2:error] [pid 15541:tid 15541] [client 104.222.164.159:5308] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "versahealthcare.com"] [uri "/sftp-config.json"] [unique_id "auEv_b8XKgixXwKS-lLbvAAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-20 11:35:34
UTC ·
(2 weeks ago)
Secret file probe | method: GET | path: /sftp-config.json | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-18 22:36:22
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 104.222.164.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 18:36:14.559583 2026] [security2:error] [pid 8605:tid 8632] [client 104.222.164.159:43386] ...
show more
(mod_security) mod_security (id:210492) triggered by 104.222.164.159 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 18 18:36:14.559583 2026] [security2:error] [pid 8605:tid 8632] [client 104.222.164.159:43386] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "southtampaprinting.com"] [uri "/sftp-config.json"] [unique_id "atVJ3sny3rzlU_g5IPpxgAAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Packets-Decreaser.NET
2025-09-05 20:03:40
UTC ·
(1 year ago)
Incoming Layer 7 Flood Detected
DDoS Attack
Web Spam
2024-11-09 21:22:43
UTC ·
(1 year ago)
botnet
DDoS Attack
