🇦🇺
Bay13
2026-11-15 08:26:08
UTC ·
(14 hours ago)
CrowdSec:custom/http-sensitive-files
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-15 03:14:33
UTC ·
(19 hours ago)
(web_sensitive_file) srv102 Sensitive file probe (.env/.git/backup) 166.0.230.212 (TR/Turkey/166-0-230-212.ips.acedatacenter.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 13:43:04
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 08:42:58.884654 2026] [security2:error] [pid 4542:tid 4542 ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 08:42:58.884654 2026] [security2:error] [pid 4542:tid 4542] [client 166.0.230.212:6526] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "jamisongreen.com"] [uri "/sftp-config.json"] [unique_id "avcT4uw4A-bb_Ob393lUcAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-13 09:51:54
UTC ·
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:51:47.852235 2026] [security2:error] [pid 814:tid 814] ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 04:51:47.852235 2026] [security2:error] [pid 814:tid 814] [client 166.0.230.212:65216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "roguetechtalks.com"] [uri "/sftp-config.json"] [unique_id "avbds7BolHGNJ8rUXnmEiwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 22:32:45
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:32:39.608362 2026] [security2:error] [pid 25437:tid 254 ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:32:39.608362 2026] [security2:error] [pid 25437:tid 25437] [client 166.0.230.212:46362] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "naomipyle.com"] [uri "/sftp-config.json"] [unique_id "avTtB2U5jAqhRgcLwqtH3AAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 22:14:07
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:14:00.698187 2026] [security2:error] [pid 20041:tid 200 ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 17:14:00.698187 2026] [security2:error] [pid 20041:tid 20041] [client 166.0.230.212:44776] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.danharrisphotoart.com"] [uri "/PhotoArtWholesaleArtist.pdf/sftp-config.json"] [unique_id "avToqGV9bPLfV4yPld1VhwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
LRob
2026-11-11 12:29:41
UTC ·
(4 days ago)
Secret file probe | method: GET | path: /sftp-config.json | ua: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/118.0.0.0 Safari/537.36
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 10:32:26
UTC ·
(4 days ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 05:32:20.953881 2026] [security2:error] [pid 13867:tid 138 ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 05:32:20.953881 2026] [security2:error] [pid 13867:tid 13883] [client 166.0.230.212:25874] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "coloradosellers.com"] [uri "/sftp-config.json"] [unique_id "avRENCE9z35cbhywOJq7qQAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
Mangelot Hosting
2026-11-10 04:48:44
UTC ·
(5 days ago)
(web_sensitive_file) srv102 Sensitive file probe (.env/.git/backup) 166.0.230.212 (TR/Turkey/166-0-230-212.ips.acedatacenter.com): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs:
Web App Attack
🇺🇸
TPI-Abuse
2026-11-07 23:11:09
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 18:11:03.533168 2026] [security2:error] [pid 21882:tid 218 ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 18:11:03.533168 2026] [security2:error] [pid 21882:tid 21882] [client 166.0.230.212:60024] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "debradamico.com"] [uri "/sftp-config.json"] [unique_id "au-wB6oFW9SQQyH4PFuUnwAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 10:35:10
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:32:48.665541 2026] [security2:error] [pid 23005:tid 230 ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 05:32:48.665541 2026] [security2:error] [pid 23005:tid 23005] [client 166.0.230.212:24098] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "circleofsound.org"] [uri "/sftp-config.json"] [unique_id "au2s0HoSPYcgZ8YKRhArLAAAABU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-06 03:15:27
UTC ·
(1 week ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:15:19.624963 2026] [security2:error] [pid 440:tid 440] ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 22:15:19.624963 2026] [security2:error] [pid 440:tid 440] [client 166.0.230.212:59718] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.accordionfactory.com"] [uri "/Colombo//sftp-config.json"] [unique_id "au1GR0hr1AFjax4hc7re5gAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇽
octageeks.com
2026-11-03 05:26:51
UTC ·
(1 week ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇩🇪
LRob
2026-11-02 19:02:32
UTC ·
(1 week ago)
Secret file probe | method: GET | path: /sftp-config.json | ua: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 00:37:35
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 20:35:45.755984 2026] [security2:error] [pid 27999:tid 280 ...
show more
(mod_security) mod_security (id:210492) triggered by 166.0.230.212 (166-0-230-212.ips.acedatacenter.com): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 20:35:45.755984 2026] [security2:error] [pid 27999:tid 28019] [client 166.0.230.212:24784] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mtiminis.com"] [uri "/sftp-config.json"] [unique_id "auFDYSZm2dWi4JhLFbl8hAAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
