🇺🇸
TPI-Abuse
2026-11-13 15:47:09
UTC ·
(1 day ago)
(mod_security) mod_security (id:210492) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:47:02.986558 2026] [security2:error] [pid 22210:tid 22210] [client 216.173.80.246:34169] ...
show more
(mod_security) mod_security (id:210492) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 10:47:02.986558 2026] [security2:error] [pid 22210:tid 22210] [client 216.173.80.246:34169] ModSecurity: Access denied with code 403 (phase 1). Matched phrase ".htaccess" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.nbcnewsradio.com"] [uri "/sample.htaccess"] [unique_id "avcw9u4eUuAuIaqYb__6kQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-09-20 19:07:08
UTC ·
(1 month ago)
Blocked abusive HTTP application-layer DoS / botnet traffic from 216.173.80.246: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user hos ...
show more
Blocked abusive HTTP application-layer DoS / botnet traffic from 216.173.80.246: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host.
show less
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-08-29 02:16:53
UTC ·
(2 months ago)
(mod_security) mod_security (id:210492) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 22:16:49.380690 2026] [security2:error] [pid 699:tid 699] [client 216.173.80.246:41681] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Aug 28 22:16:49.380690 2026] [security2:error] [pid 699:tid 699] [client 216.173.80.246:41681] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.nbcnewsradio.com"] [uri "/sftp-config.json"] [unique_id "apJBEU9ACfdB073NzmYx9wAAACU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-02-01 11:42:21
UTC ·
(9 months ago)
(mod_security) mod_security (id:210492) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 01 06:38:12.591394 2026] [security2:error] [pid 483:tid 665] [client 216.173.80.246:54805] Mod ...
show more
(mod_security) mod_security (id:210492) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Feb 01 06:38:12.591394 2026] [security2:error] [pid 483:tid 665] [client 216.173.80.246:54805] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.kettlehill.com"] [uri "/wp-config.php.old"] [unique_id "aX87JAMxl-cQ0UzvOvSB2QAAAFM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-01-16 14:44:00
UTC ·
(9 months ago)
(mod_security) mod_security (id:221260) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 16 09:43:52.943895 2026] [security2:error] [pid 31230:tid 31230] [client 216.173.80.246:58037] ...
show more
(mod_security) mod_security (id:221260) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Jan 16 09:43:52.943895 2026] [security2:error] [pid 31230:tid 31230] [client 216.173.80.246:58037] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^(?:\\\\'\\\\w+?=)?\\\\(\\\\)\\\\s{" at MATCHED_VAR. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "77"] [id "221260"] [rev "3"] [msg "COMODO WAF: Shellshock Command Injection Vulnerabilities in GNU Bash through 4.3 bash43-026 (CVE-2014-7187, CVE-2014-7186, CVE-2014-7169, CVE-2014-6278, CVE-2014-6277, CVE-2014-6271)||mail.nbcnewsradio.com:443|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.nbcnewsradio.com"] [uri "/test.cgi"] [unique_id "aWpOqKvUHDOAKZ6aGDxk1QAAAAk"], referer: () { ignored; }; echo Content-Type: text/html; echo ; /bin/cat /etc/passwd
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-12-01 05:51:34
UTC ·
(11 months ago)
(mod_security) mod_security (id:210492) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 01 00:50:54.500309 2025] [security2:error] [pid 26090:tid 26456] [client 216.173.80.246:56177] ...
show more
(mod_security) mod_security (id:210492) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 01 00:50:54.500309 2025] [security2:error] [pid 26090:tid 26456] [client 216.173.80.246:56177] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mail.kettlehill.com"] [uri "/wp-content/plugins/adaptive-images/adaptive-images-script.php"] [unique_id "aS0svgqR0geke5MRGl4GGQAAAIo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-01 14:59:06
UTC ·
(1 year ago)
(mod_security) mod_security (id:211190) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 01 10:59:02.637467 2025] [security2:error] [pid 16199:tid 16225] [client 216.173.80.246:35749] ...
show more
(mod_security) mod_security (id:211190) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 01 10:59:02.637467 2025] [security2:error] [pid 16199:tid 16225] [client 216.173.80.246:35749] ModSecurity: Access denied with code 403 (phase 2). Match of "contains cpanel" against "REQUEST_URI" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "55"] [id "211190"] [rev "9"] [msg "COMODO WAF: Remote File Access Attempt||kettlehill.com|F|2"] [data "Matched Data: /etc/ found within REQUEST_URI: /wp-content/plugins/se-html5-album-audio-player/download_audio.php?file=/wp-content/uploads/../../../../../../../../../../etc/passwd"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "kettlehill.com"] [uri "/wp-content/plugins/se-html5-album-audio-player/download_audio.php"] [unique_id "aQYgNo48O1Di385V0mCUNQAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-29 13:10:57
UTC ·
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 29 09:10:51.026704 2025] [security2:error] [pid 31729:tid 31729] [client 216.173.80.246:52981] ...
show more
(mod_security) mod_security (id:210730) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 29 09:10:51.026704 2025] [security2:error] [pid 31729:tid 31729] [client 216.173.80.246:52981] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.davispickering.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.davispickering.com"] [uri "/errors.log"] [unique_id "aQISW65CYOW8ghKC3FjuWwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-10-29 06:19:47
UTC ·
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 29 02:19:39.512531 2025] [security2:error] [pid 24398:tid 24398] [client 216.173.80.246:33405] ...
show more
(mod_security) mod_security (id:210730) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 29 02:19:39.512531 2025] [security2:error] [pid 24398:tid 24398] [client 216.173.80.246:33405] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.nbcnewsradio.com|F|2"] [data ".key"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.nbcnewsradio.com"] [uri "/server.key"] [unique_id "aQGx-0lu81U-AhgNl_vY3AAAAAs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-26 07:33:24
UTC ·
(1 year ago)
(mod_security) mod_security (id:210492) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 26 03:33:18.032371 2025] [security2:error] [pid 31589:tid 31589] [client 216.173.80.246:57869] ...
show more
(mod_security) mod_security (id:210492) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Sep 26 03:33:18.032371 2025] [security2:error] [pid 31589:tid 31589] [client 216.173.80.246:57869] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "whm.deandobkin.com"] [uri "/.env.whm"] [unique_id "aNZBvl9DL4ZQ2fv-PpcMmgAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-09-01 02:12:01
UTC ·
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 22:11:57.655022 2025] [security2:error] [pid 4167008:tid 4167063] [client 216.173.80.246:43 ...
show more
(mod_security) mod_security (id:210730) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 31 22:11:57.655022 2025] [security2:error] [pid 4167008:tid 4167063] [client 216.173.80.246:43277] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.kettlehill.net|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.kettlehill.net"] [uri "/error.log"] [unique_id "aLUA7Q6DfZQKU24eXUwuGwAAAFY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2025-06-06 12:10:10
UTC ·
(1 year ago)
| XSS (Cross Site Scripting) attempt.
Hacking
SQL Injection
Web App Attack
🇺🇸
TPI-Abuse
2025-06-01 07:09:49
UTC ·
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 01 03:09:44.409661 2025] [security2:error] [pid 2256139:tid 2256258] [client 216.173.80.246:49 ...
show more
(mod_security) mod_security (id:210730) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Jun 01 03:09:44.409661 2025] [security2:error] [pid 2256139:tid 2256258] [client 216.173.80.246:49503] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.kettlehill.kettlehill.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.kettlehill.kettlehill.com"] [uri "/logs/errors.log"] [unique_id "aDv8uHvRuSdZj0PHFrREbQAAAQA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-05-30 20:14:41
UTC ·
(1 year ago)
(mod_security) mod_security (id:210730) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 30 16:14:37.868766 2025] [security2:error] [pid 620970:tid 620970] [client 216.173.80.246:4464 ...
show more
(mod_security) mod_security (id:210730) triggered by 216.173.80.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 30 16:14:37.868766 2025] [security2:error] [pid 620970:tid 620970] [client 216.173.80.246:44647] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||ftp.nbcnewsradio.com|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "ftp.nbcnewsradio.com"] [uri "/MyErrors.log"] [unique_id "aDoRrSZ-5KfKuYz-VRCVYwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
