🇺🇸
TPI-Abuse
2026-11-14 13:00:29
UTC ·
(8 minutes ago)
(mod_security) mod_security (id:210350) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 08:00:23.870960 2026] [security2:error] [pid 6605:tid 6718] [client 157.22.72.249:30091] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 08:00:23.870960 2026] [security2:error] [pid 6605:tid 6718] [client 157.22.72.249:30091] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||gamecrazy.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "gamecrazy.us"] [uri "/news/6/5679/Sony-on-GaaS-Were-Big-On-Story-But-We-Might-Enter-That-Space-With-A-Suitable-Team-amp-Concept.html"] [unique_id "avhbZ12XUYCQ1lKKVMp6MAAAAQM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-09 06:19:01
UTC ·
(5 days ago)
(mod_security) mod_security (id:210350) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 01:18:56.290364 2026] [security2:error] [pid 2400:tid 2400] [client 157.22.72.249:13499] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 01:18:56.290364 2026] [security2:error] [pid 2400:tid 2400] [client 157.22.72.249:13499] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||guldunyayayinlari.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "guldunyayayinlari.com"] [uri "/2015/01/yeni-guney-asya-feminizmleri-celiskiler-ihtimaller/"] [unique_id "avFl0Ipy9iWifJSCDYrIswAAABE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
big-cloud.nl
2026-11-03 18:02:22
UTC ·
(1 week ago)
Try to access /xmlrpc.php
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 17:49:02
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 13:48:58.533471 2026] [security2:error] [pid 13829:tid 13829] [client 157.22.72.249:43751] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 13:48:58.533471 2026] [security2:error] [pid 13829:tid 13829] [client 157.22.72.249:43751] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||modmove.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "modmove.com"] [uri "/reviews/the-keeper-movie-review/"] [unique_id "auI1ilbq1MBwdxKwPMKjFQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
neogenius
2026-10-27 10:51:47
UTC ·
(2 weeks ago)
Web App Attack
Web App Attack
Brute-Force
🇺🇸
TPI-Abuse
2026-10-26 04:30:40
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 00:30:33.659732 2026] [security2:error] [pid 13812:tid 13812] [client 157.22.72.249:34765] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 00:30:33.659732 2026] [security2:error] [pid 13812:tid 13812] [client 157.22.72.249:34765] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||resilientigm.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "resilientigm.com"] [uri "/styled/page3/index.html"] [unique_id "at7XaaWp-jXNjq5aSbc2YgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-25 16:56:04
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 12:55:59.177678 2026] [security2:error] [pid 21286:tid 21286] [client 157.22.72.249:54681] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 12:55:59.177678 2026] [security2:error] [pid 21286:tid 21286] [client 157.22.72.249:54681] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||rivercityacct.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "rivercityacct.com"] [uri "/taxes-filed-2/"] [unique_id "at40n1uuuNzzMfpqJhVDUAAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Tilellit.PRO
2026-10-25 03:32:47
UTC ·
(2 weeks ago)
Fail2Ban banned 157.22.72.249 for security violations in jail wp-armour. Log: 2026/10/25 03:32:46 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 157.22.72.249 | Target: wplogin" , client: 157.22.72.249, server: [REDACTED], request: ...
show more
Fail2Ban banned 157.22.72.249 for security violations in jail wp-armour. Log: 2026/10/25 03:32:46 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 157.22.72.249 | Target: wplogin" , client: 157.22.72.249, server: [REDACTED], request: "POST /wp-login.php?wp_lang=en_US HTTP/2.0", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php?wp_lang=en_US"
...
show less
Web Spam
🇺🇸
TPI-Abuse
2026-10-21 20:49:58
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:49:51.883560 2026] [security2:error] [pid 23283:tid 23283] [client 157.22.72.249:24817] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:49:51.883560 2026] [security2:error] [pid 23283:tid 23283] [client 157.22.72.249:24817] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jeffreycopeland.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jeffreycopeland.com"] [uri "/work/html/23.html"] [unique_id "atklb-GPSXEsDbBhNe8m7gAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
nationaleventpros.com
2026-09-30 03:36:56
UTC ·
(1 month ago)
WordPress login attempt
Brute-Force
🇩🇪
Phenix Info
2026-08-01 16:11:58
UTC ·
(3 months ago)
SmallGuard.fr - Forbidden Ext.
Web App Attack
🇦🇺
screwlooseit.com.au
2026-04-03 12:49:15
UTC ·
(7 months ago)
Blocked by CSF 13 firewall - Rule: XMLRPC
US/United States/-
Web App Attack
🇩🇪
F242
2026-03-31 11:50:08
UTC ·
(7 months ago)
Wordpress Login or XMLRPC abuse
Web App Attack
🇺🇸
TPI-Abuse
2026-03-29 05:07:10
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 01:07:03.383745 2026] [security2:error] [pid 10312:tid 10312] [client 157.22.72.249:17583] M ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Mar 29 01:07:03.383745 2026] [security2:error] [pid 10312:tid 10312] [client 157.22.72.249:17583] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||beautyradio.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "beautyradio.com"] [uri "/wp-json/wp/v2/users"] [unique_id "acizdzKZyhv6Ed7_5XNxlwAAABo"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-14 20:45:52
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 14 16:45:47.178246 2026] [security2:error] [pid 29742:tid 29742] [client 157.22.72.249:11247] M ...
show more
(mod_security) mod_security (id:225170) triggered by 157.22.72.249 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 14 16:45:47.178246 2026] [security2:error] [pid 29742:tid 29742] [client 157.22.72.249:11247] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||starsnurses.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "starsnurses.com"] [uri "/wp-json/wp/v2/users"] [unique_id "abXI-2-iafI6zusDeyYgzwAAAA0"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
