🇺🇸
TPI-Abuse
2026-11-14 23:56:11
UTC ·
(2 hours ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 18:56:03.916413 2026] [security2:error] [pid 22650:tid 22650 ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 18:56:03.916413 2026] [security2:error] [pid 22650:tid 22650] [client 166.0.230.20:27258] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tankservicesinc.com"] [uri "/sftp-config.json"] [unique_id "avj1E0aLJxqNhMK_n2X1SQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 23:01:07
UTC ·
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 18:01:00.489403 2026] [security2:error] [pid 25702:tid 25702 ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 18:01:00.489403 2026] [security2:error] [pid 25702:tid 25702] [client 166.0.230.20:54384] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "robcruickshank.net"] [uri "/sftp-config.json"] [unique_id "avjoLO69Hppxf47zgCX_WQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-14 09:38:40
UTC ·
(16 hours ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:38:33.394633 2026] [security2:error] [pid 9106:tid 9106] ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 04:38:33.394633 2026] [security2:error] [pid 9106:tid 9106] [client 166.0.230.20:20892] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "bipocmentalhealthcoalition.org"] [uri "/sftp-config.json"] [unique_id "avgsGagBaPKCYAWQof-K0wAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
CoreTech srl
2026-11-07 23:03:57
UTC ·
(1 week ago)
cloudlinux2 fail2ban: 2026-11-07 23:59:00,838 fail2ban.filter [1651]: INFO [plesk-modsecurity] Found 172.64.198.151 - 2026-11-07 23:59:00cloudlinux2 fail2ban: 2026-11-07 23:59:00,827 fail2ban.filter [1651]: INFO [plesk-modsecuri ...
show more
cloudlinux2 fail2ban: 2026-11-07 23:59:00,838 fail2ban.filter [1651]: INFO [plesk-modsecurity] Found 172.64.198.151 - 2026-11-07 23:59:00cloudlinux2 fail2ban: 2026-11-07 23:59:00,827 fail2ban.filter [1651]: INFO [plesk-modsecurity] Found 172.64.198.68 - 2026-11-07 23:59:00cloudlinux2 fail2ban: 2026-11-08 00:00:16,054 fail2ban.filter [1651]: INFO [plesk-wordpress] Found 221.221.164.42 - 2026-11-08 00:00:13cloudlinux2 fail2ban: 2026-11-08 00:00:32,992 fail2ban.filter [1651]: INFO [plesk-wordpress] Found 221.221.164.42 - 2026-11-08 00:00:31cloudlinux2 fail2ban: 2026-11-08 00:00:44,120 fail2ban.actions [1651]: NOTICE [plesk-wordpress] Ban 221.221.164.42cloudlinux2 fail2ban: 2026-11-08 00:00:44,315 fail2ban.filter [1651]: INFO [recidive] Found 221.221.164.42 - 2026-11-08 00:00:44cloudlinux2 fail2ban: 2026-11-08 00:00:44,089 fail2ban.filter [1651]: INFO [plesk-wordpress] Found 221.221.164.42 - 2026-11-08 00:00:42cloudlinux2 fail2ban: 2026-11-
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 10:32:33
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:32:25.004409 2026] [security2:error] [pid 19919:tid 19919 ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:32:25.004409 2026] [security2:error] [pid 19919:tid 19919] [client 166.0.230.20:63090] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "3n1ent.com"] [uri "/sftp-config.json"] [unique_id "au2subajbdswWI3jKKJ6EQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
CoreTech srl
2026-11-01 20:48:57
UTC ·
(1 week ago)
cloudlinux2 fail2ban: 2026-11-01 21:44:32,622 fail2ban.filter [1898]: INFO [plesk-wordpress] Found 91.230.225.99 - 2026-11-01 21:44:32cloudlinux2 fail2ban: 2026-11-01 21:45:09,750 fail2ban.filter [1898]: INFO [plesk-wordpress] F ...
show more
cloudlinux2 fail2ban: 2026-11-01 21:44:32,622 fail2ban.filter [1898]: INFO [plesk-wordpress] Found 91.230.225.99 - 2026-11-01 21:44:32cloudlinux2 fail2ban: 2026-11-01 21:45:09,750 fail2ban.filter [1898]: INFO [plesk-wordpress] Found 185.92.25.121 - 2026-11-01 21:45:08cloudlinux2 fail2ban: 2026-11-01 21:45:32,602 fail2ban.filter [1898]: INFO [plesk-wordpress] Found 185.92.25.21 - 2026-11-01 21:45:32cloudlinux2 fail2ban: 2026-11-01 21:45:37,151 fail2ban.filter [1898]: INFO [plesk-wordpress] Found 185.92.25.21 - 2026-11-01 21:45:36cloudlinux2 fail2ban: 2026-11-01 21:45:55,842 fail2ban.filter [1898]: INFO [plesk-wordpress] Found 185.238.231.2 - 2026-11-01 21:45:53cloudlinux2 fail2ban: 2026-11-01 21:45:48,496 fail2ban.filter [1898]: INFO [plesk-modsecurity] Found 166.0.230.20 - 2026-11-01 21:45:48cloudlinux2 fail2ban: 2026-11-01 21:45:55,742 fail2ban.filter [1898]: INFO [plesk-wordpress] Found 185.238.231.80 - 2026-11-01 21:45:53cloudlinu
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-30 14:29:28
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 10:27:30.698516 2026] [security2:error] [pid 8934:tid 8934] ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 10:27:30.698516 2026] [security2:error] [pid 8934:tid 8934] [client 166.0.230.20:21696] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "wholesaleglassjars.com"] [uri "/sftp-config.json"] [unique_id "auSpUjLDEe3Iv3ZPUP5gEwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 17:27:42
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 13:27:39.304457 2026] [security2:error] [pid 6115:tid 6115] ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 13:27:39.304457 2026] [security2:error] [pid 6115:tid 6115] [client 166.0.230.20:3986] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "carefreesol.com"] [uri "/sftp-config.json"] [unique_id "at48C9SiJnwqtJ0JRsYH2gAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 10:28:29
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 06:28:21.831063 2026] [security2:error] [pid 11541:tid 11541 ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 06:28:21.831063 2026] [security2:error] [pid 11541:tid 11541] [client 166.0.230.20:59062] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "casaroma-alassio.com"] [uri "/sftp-config.json"] [unique_id "at3ZxSJKqPNhUUJz4Y6X4wAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇦🇺
Bay13
2026-10-24 09:30:44
UTC ·
(3 weeks ago)
CrowdSec:custom/http-sensitive-files
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 23:59:34
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 19:59:27.205510 2026] [security2:error] [pid 15083:tid 15126 ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 19:59:27.205510 2026] [security2:error] [pid 15083:tid 15126] [client 166.0.230.20:5926] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "dulemba.com"] [uri "/index_ColoringPages.html/sftp-config.json"] [unique_id "atv03-wV5OHcO-e9CUGZIAAAAcA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-20 02:29:02
UTC ·
(3 weeks ago)
Secret file probe | method: GET | path: /sftp-config.json | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-17 13:03:57
UTC ·
(4 weeks ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 09:03:51.221184 2026] [security2:error] [pid 3775:tid 3775] ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.20 (166-0-230-20.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 17 09:03:51.221184 2026] [security2:error] [pid 3775:tid 3775] [client 166.0.230.20:49506] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kingstoneproperties.com"] [uri "/sftp-config.json"] [unique_id "atNyNw1HQOcWKbp1VEJX3AAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
