AbuseIPDB » 104.222.165.20
104.222.165.20
This IP was reported 6 times. Confidence of
Abuse
is 13% : ?
ISP
FASTPLANET LTD
Usage Type
Data Center/Web Hosting/Transit
ASN
AS40676
Domain Name
fastplanet.com
Country
🇮🇳
India
City
Airoli, Maharashtra
IP info including ISP, Usage Type, and Location provided
by IPInfo . Updated weekly.
IP Abuse Reports for 104.222.165.20 :
This IP address has been reported a total of
6
times from
4 distinct
sources.
104.222.165.20 was first reported on
November 9th 2024 , and the most recent report was
6 days ago
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
TPI-Abuse
2026-10-20 16:32:42
(6 days ago)
(mod_security) mod_security (id:210580) triggered by 104.222.165.20 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210580) triggered by 104.222.165.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 12:32:38.699199 2026] [security2:error] [pid 8112:tid 8112] [client 104.222.165.20:56922] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "sftp-config.json" at REQUEST_COOKIES:handl_landing_page. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/08_Global_Other.conf"] [line "57"] [id "210580"] [rev "2"] [msg "COMODO WAF: OS File Access Attempt||matchstic-branding.com|F|2"] [data "Matched Data: sftp-config.json found within REQUEST_COOKIES:handl_landing_page: https:/marqueefundinggroup.com/sftp-config.json"] [severity "CRITICAL"] [tag "CWAF"] [tag "Other"] [hostname "matchstic-branding.com"] [uri "/.vscode/sftp.json"] [unique_id "ateXpnpNfnxc8_pHlvawdgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 14:12:24
(6 days ago)
(mod_security) mod_security (id:210492) triggered by 104.222.165.20 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.222.165.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 10:12:20.236209 2026] [security2:error] [pid 30039:tid 30039] [client 104.222.165.20:32442] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "trimandtend.com"] [uri "/sftp-config.json"] [unique_id "atd2xNX2UV-JBC9Gy8pL4AAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 05:08:20
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 104.222.165.20 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 104.222.165.20 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 01:08:13.342479 2026] [security2:error] [pid 29513:tid 29513] [client 104.222.165.20:18144] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "willoughbywolf.com"] [uri "/sftp-config.json"] [unique_id "atb3PSx_zou5KsLcgQJV2gAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇷🇺
cnaize
2026-10-18 13:32:38
(1 week ago)
Malicious activity blocked by Meds firewall
Port Scan
🇮🇹
CoreTech srl
2026-08-08 13:38:56
(2 months ago)
cloudlinux2 fail2ban: 2026-08-08 15:33:56,486 fail2ban.actions [1467]: NOTICE [plesk-modsecu ...
show more
cloudlinux2 fail2ban: 2026-08-08 15:33:56,486 fail2ban.actions [1467]: NOTICE [plesk-modsecurity] Unban 122.168.1.214cloudlinux2 fail2ban: 2026-08-08 15:35:08,593 fail2ban.actions [1467]: NOTICE [plesk-modsecurity] Unban 49.204.208.148cloudlinux2 fail2ban: 2026-08-08 15:36:20,473 fail2ban.filter [1467]: INFO [plesk-wordpress] Found 104.222.165.20 - 2026-08-08 15:36:20cloudlinux2 fail2ban: 2026-08-08 15:36:51,642 fail2ban.filter [1467]: INFO [plesk-modsecurity] Found 136.85.23.66 - 2026-08-08 15:36:51cloudlinux2 fail2ban: 2026-08-08 15:36:51,566 fail2ban.filter [1467]: INFO [plesk-modsecurity] Found 136.85.23.66 - 2026-08-08 15:36:51cloudlinux2 fail2ban: 2026-08-08 15:36:51,651 fail2ban.filter [1467]: INFO [plesk-modsecurity] Found 136.85.23.66 - 2026-08-08 15:36:51cloudlinux2 fail2ban: 2026-08-08 15:36:51,924 fail2ban.actions [1467]: NOTICE [plesk-modsecurity] Ban 136.85.23.66cloudlinux2 fail2ban: 2026-08-08 15:36:51,547 fail2ban.filter
show less
Web App Attack
2024-11-09 21:22:22
(1 year ago)
botnet
DDoS Attack
Showing 1 to
6
of 6 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩
Recently Reported IPs: