🇺🇸
TPI-Abuse
2026-07-20 01:46:47
(11 hours ago)
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 21:46:40.847186 2026] [security2:error] [pid 20825:tid 20825] [client 209.242.218.1:32442] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "computerizer.org"] [uri "/sftp-config.json"] [unique_id "al1-AOLOYUu7IOAhCwULpAAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-19 08:57:47
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 04:57:40.223734 2026] [security2:error] [pid 3487:tid 3584] [client 209.242.218.1:61760] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "coloradosellers.com"] [uri "/sftp-config.json"] [unique_id "alyRhOLqPOu688bAxAdtngAAAgo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-19 08:23:09
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jul 19 04:23:02.223576 2026] [security2:error] [pid 16614:tid 16614] [client 209.242.218.1:0] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "colonybet.com"] [uri "/sftp-config.json"] [unique_id "alyJZrFzfxWeIMpWz1jvpgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-18 09:01:59
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 05:01:54.246133 2026] [security2:error] [pid 16202:tid 16202] [client 209.242.218.1:28772] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cncservices.ws"] [uri "/sftp-config.json"] [unique_id "altBAu0oE22uD1ucxGLh7wAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-18 06:19:09
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 02:19:04.203476 2026] [security2:error] [pid 959476:tid 959476] [client 209.242.218.1:41880] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.cmgpartners.com"] [uri "/sftp-config.json"] [unique_id "alsa2OQdMRtYIC4YVahwPwAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-18 05:49:50
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 18 01:49:43.473083 2026] [security2:error] [pid 16827:tid 16827] [client 209.242.218.1:62794] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cmcnyc.com"] [uri "/sftp-config.json"] [unique_id "alsT92tQVEIC09r0yT_uTwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇲🇽
octageeks.com
2026-07-18 04:13:36
(2 days ago)
Wordpress malicious attack:[octablocked]
Web App Attack
🇺🇸
TPI-Abuse
2026-07-18 02:20:33
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 22:20:27.255224 2026] [security2:error] [pid 2481598:tid 2481598] [client 209.242.218.1:64972] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "clowaterart.com"] [uri "/sftp-config.json"] [unique_id "alri6xXfEm2aBu4SkejXIwAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 23:17:22
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 19:17:14.275931 2026] [security2:error] [pid 6185:tid 6185] [client 209.242.218.1:27216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "clossglobal.com"] [uri "/sftp-config.json"] [unique_id "alq3-oJ6W_DHpA7IfjF33gAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 22:18:14
(2 days ago)
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 18:18:08.710633 2026] [security2:error] [pid 1787451:tid 1787469] [client 209.242.218.1:56124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "clmtic.es"] [uri "/sftp-config.json"] [unique_id "alqqIIEluBBszIWzXgX1vgAAABA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
CoreTech srl
2026-07-17 19:23:55
(2 days ago)
cloudlinux2 fail2ban: 2026-07-17 21:20:03,816 fail2ban.filter [1598]: INFO [plesk-modsecu ...
show more
cloudlinux2 fail2ban: 2026-07-17 21:20:03,816 fail2ban.filter [1598]: INFO [plesk-modsecurity] Found 209.242.218.1 - 2026-07-17 21:20:03cloudlinux2 fail2ban: 2026-07-17 21:20:15,372 fail2ban.filter [1598]: INFO [plesk-wordpress] Found 173.239.240.137 - 2026-07-17 21:20:13cloudlinux2 fail2ban: 2026-07-17 21:20:15,537 fail2ban.filter [1598]: INFO [plesk-wordpress] Found 173.239.240.120 - 2026-07-17 21:20:13cloudlinux2 fail2ban: 2026-07-17 21:20:53,936 fail2ban.filter [1598]: INFO [plesk-modsecurity] Found 34.182.158.83 - 2026-07-17 21:20:53cloudlinux2 fail2ban: 2026-07-17 21:21:57,134 fail2ban.filter [1598]: INFO [recidive] Found 104.28.164.42 - 2026-07-17 21:21:57cloudlinux2 fail2ban: 2026-07-17 21:21:56,738 fail2ban.filter [1598]: INFO [plesk-wordpress] Found 104.28.164.42 - 2026-07-17 21:21:56cloudlinux2 fail2ban: 2026-07-17 21:21:56,692 fail2ban.filter [1598]: INFO [plesk-wordpress] Found 104.28.164.42 - 2026-07-17 21:21:56cloudlin
show less
Web App Attack
2026-07-17 17:06:04
(2 days ago)
Trying to access config files
Web App Attack
🇩🇪
CK_beats
2026-07-17 05:45:02
(3 days ago)
Blocked by os-abuseipdb on OPNsense firewall KN-FW01; 4 hits, proto=tcp, ports=80
Port Scan
Hacking
🇺🇸
TPI-Abuse
2026-07-17 05:15:16
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 17 01:15:11.283340 2026] [security2:error] [pid 5420:tid 5420] [client 209.242.218.1:47430] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cjmconsulting.net"] [uri "/sftp-config.json"] [unique_id "alm6X-8Cc6wC5xbRkUCSTgAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-07-17 03:18:59
(3 days ago)
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210492) triggered by 209.242.218.1 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jul 16 23:18:53.294451 2026] [security2:error] [pid 12791:tid 12804] [client 209.242.218.1:24614] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cityofmiddleton.org"] [uri "/sftp-config.json"] [unique_id "almfHWPL_Uf4Vc78hnLsYgAAAUs"]
show less
Brute-Force
Bad Web Bot
Web App Attack