162.252.52.77

(mod_security) mod_security (id:210350) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 13:07:26.329631 2026] [security2:error] [pid 6194:tid 6194] [client 162.252.52.77:31311] Mod ... show more (mod_security) mod_security (id:210350) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 13:07:26.329631 2026] [security2:error] [pid 6194:tid 6194] [client 162.252.52.77:31311] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||mywheatgrass.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "mywheatgrass.com"] [uri "/wheatgrass-uses.shtml"] [unique_id "avSu3ggOUYwVzCsmSSOoAAAAAAI"] show less

(mod_security) mod_security (id:210350) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 19:09:08.635537 2026] [security2:error] [pid 2058:tid 2058] [client 162.252.52.77:14121] Mod ... show more (mod_security) mod_security (id:210350) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 19:09:08.635537 2026] [security2:error] [pid 2058:tid 2058] [client 162.252.52.77:14121] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.watonga.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.watonga.com"] [uri "/biblebios/lot/villa-huren-nederland/"] [unique_id "avEPJBJAduV3iejYuAn7QAAAABI"] show less

(mod_security) mod_security (id:210350) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 17:23:38.167789 2026] [security2:error] [pid 25805:tid 25805] [client 162.252.52.77:25501] M ... show more (mod_security) mod_security (id:210350) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 17:23:38.167789 2026] [security2:error] [pid 25805:tid 25805] [client 162.252.52.77:25501] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/oembed/1.0/embed"] [unique_id "au-k6lXpwtI1Md1rq28rzQAAAAg"] show less

[ti-04al] Excessive 404 errors (web scanning): 37 suspicious requests detected by fail2ban jail apache-404. Example: 162.252.52.77 - - [02/Nov/2026:16:55:46 +0100] "GET /wp/2026/09/18/sport-op-zaterdag HTTP/2.0" 404 64463 "https://gouwestad.nl/wp/202 ... show more [ti-04al] Excessive 404 errors (web scanning): 37 suspicious requests detected by fail2ban jail apache-404. Example: 162.252.52.77 - - [02/Nov/2026:16:55:46 +0100] "GET /wp/2026/09/18/sport-op-zaterdag HTTP/2.0" 404 64463 "https://gouwestad.nl/wp/2026/09/18/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" 162.252.52.77 - - [02/Nov/2026:16:55:47 +0100] "GET /wp/2026/02/05/sport-op-zaterdag HTTP/2.0" 404 64499 "https://gouwestad.nl/wp/2026/02/05/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/150.0.0.0 Safari/537.36" 162.252.52.77 - - [02/Nov/2026:16:55:47 +0100] "GET /wp/2026/04/22/sport-op-zaterdag HTTP/2.0" 404 64467 "https://gouwestad.nl/wp/2026/04/22/" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like ... show less

(mod_security) mod_security (id:210350) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 20:14:32.397100 2026] [security2:error] [pid 8744:tid 8744] [client 162.252.52.77:52565] Mod ... show more (mod_security) mod_security (id:210350) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 20:14:32.397100 2026] [security2:error] [pid 8744:tid 8744] [client 162.252.52.77:52565] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ftwwx.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ftwwx.com"] [uri "/denton.htm"] [unique_id "auKP6KB_w4sp1mmEGJHjSgAAAAo"] show less

(mod_security) mod_security (id:220150) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:34:01.489275 2026] [security2:error] [pid 6830:tid 6830] [client 162.252.52.77:58215] Mod ... show more (mod_security) mod_security (id:220150) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 04 09:34:01.489275 2026] [security2:error] [pid 6830:tid 6830] [client 162.252.52.77:58215] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:union(?:\\\\/\\\\*.{0,399}\\\\*\\\\/)?select)" at ARGS:fid. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5662"] [id "220150"] [rev "5"] [msg "COMODO WAF: SQL injection vulnerability in Ginkgo CMS 5.0 (CVE-2013-5318)||www.powerkiteforum.com|F|2"] [data ")/**/and/**/(930097204=930097204/**/union/**/all/**/select/**/'kotfcrfwiwnagspsvppesmavqiptpvvl',null--/**/2gp8cc"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.powerkiteforum.com"] [uri "/forumdisplay.php"] [unique_id "aprIyQpFF13VNDc8-YnoagAAAAQ"] show less

Website Scanning / Scraping

162.252.52.77 - - [02/Sep/2026:03:34:04 -0500] "GET /wp-login.php HTTP/1.1" 301 561 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" 162.252.52.77 - - [02/Sep/2026:03:34:04 -0500] "GET /wp-login.php HTTP/1.1" 200 ... show more 162.252.52.77 - - [02/Sep/2026:03:34:04 -0500] "GET /wp-login.php HTTP/1.1" 301 561 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" 162.252.52.77 - - [02/Sep/2026:03:34:04 -0500] "GET /wp-login.php HTTP/1.1" 200 9390 "http://delsmetalco.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" 162.252.52.77 - - [02/Sep/2026:03:34:06 -0500] "POST /wp-login.php HTTP/1.1" 200 9696 "https://delsmetalco.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" 162.252.52.77 - - [02/Sep/2026:03:34:07 -0500] "POST /wp-login.php HTTP/1.1" 200 9697 "https://delsmetalco.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" 162.252.52.77 - - [02/Sep/2026:03:34:07 -0500] "POST /wp-login.php HTTP/1.1" 200 9697 "https://delsmetalco.com/wp-login.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:138.0) Gecko/20100101 Firefox/138.0" ... show less

HTTP application-layer DoS / botnet traffic from 162.252.52.77: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.

(mod_security) mod_security (id:210730) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 21:35:08.937389 2026] [security2:error] [pid 1910613:tid 1910613] [client 162.252.52.77:6362 ... show more (mod_security) mod_security (id:210730) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jul 22 21:35:08.937389 2026] [security2:error] [pid 1910613:tid 1910613] [client 162.252.52.77:63627] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Himolla-ZeroStress-Recliner/Images/Chester/Thumbs.db"] [unique_id "amFvzHf7BFM25JcZjSM6NQAAAAA"], referer: https://vitalitywebb.com/backstore/Himolla-ZeroStress-Recliner/Images/Chester/ show less

(mod_security) mod_security (id:210730) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 20:15:31.432335 2026] [security2:error] [pid 27774:tid 27774] [client 162.252.52.77:56959] M ... show more (mod_security) mod_security (id:210730) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jul 03 20:15:31.432335 2026] [security2:error] [pid 27774:tid 27774] [client 162.252.52.77:56959] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Barcalounger/Images/Bristol II/Stetson Bordeaux/originals/Thumbs.db"] [unique_id "akhQo6S38gsx2qaShbJeXwAAAAc"], referer: https://vitalitywebb.com/backstore/Barcalounger/Images/Bristol%20II/Stetson%20Bordeaux/originals/ show less

(mod_security) mod_security (id:900177) triggered by 162.252.52.77 (US/United States/-): 5 in the last 900 secs

(mod_security) mod_security (id:210730) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 00:37:15.284825 2026] [security2:error] [pid 2034:tid 2034] [client 162.252.52.77:26671] Mod ... show more (mod_security) mod_security (id:210730) triggered by 162.252.52.77 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Jun 03 00:37:15.284825 2026] [security2:error] [pid 2034:tid 2034] [client 162.252.52.77:26671] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||vitalitywebb.com|F|2"] [data ".db"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "vitalitywebb.com"] [uri "/backstore/Barcalounger/Images/Chandler/Thumbs.db"] [unique_id "ah-ve8AK47Kpa7tJnK6lNgAAABs"], referer: https://vitalitywebb.com/backstore/Barcalounger/Images/Chandler/ show less

(mod_security) mod_security (id:900178) triggered by 162.252.52.77 (US/United States/-): 5 in the last 900 secs

block ruleset 798ECF92F12ADC636D3520C2890AF17ADEFDE3BE