🇺🇸
TPI-Abuse
2026-11-09 04:52:00
UTC ·
(3 hours ago)
(mod_security) mod_security (id:210350) triggered by 216.40.72.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 23:51:56.291333 2026] [security2:error] [pid 11057:tid 11057] [client 216.40.72.57:47495] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 216.40.72.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 23:51:56.291333 2026] [security2:error] [pid 11057:tid 11057] [client 216.40.72.57:47495] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||michaelkivisto.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "michaelkivisto.com"] [uri "/2018/04/12/zero-sum-game/"] [unique_id "avFRbM-q1rMNqPGlCEN2sAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 07:59:15
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 216.40.72.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 02:59:12.324954 2026] [security2:error] [pid 24679:tid 24679] [client 216.40.72.57:16719] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 216.40.72.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 02:59:12.324954 2026] [security2:error] [pid 24679:tid 24679] [client 216.40.72.57:16719] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||celebritybikinigossip.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "celebritybikinigossip.com"] [uri "/2011/05/elisabetta-canalis-bikini-pictures-2/"] [unique_id "avAr0A4gaGtT1rNji-nmPQAAAAc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 06:13:36
UTC ·
(6 days ago)
(mod_security) mod_security (id:210730) triggered by 216.40.72.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 01:13:30.195691 2026] [security2:error] [pid 4531:tid 4531] [client 216.40.72.57:55791] ModSe ...
show more
(mod_security) mod_security (id:210730) triggered by 216.40.72.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 01:13:30.195691 2026] [security2:error] [pid 4531:tid 4531] [client 216.40.72.57:55791] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||home.agingworkforcenews.com|F|2"] [data ".thenation.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "home.agingworkforcenews.com"] [uri "/2005/http.thenation.com"] [unique_id "aul7it9IpP1x0VU8eujdfgAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 03:15:11
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 216.40.72.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 23:15:06.082336 2026] [security2:error] [pid 29894:tid 29906] [client 216.40.72.57:58393] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 216.40.72.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 23:15:06.082336 2026] [security2:error] [pid 29894:tid 29906] [client 216.40.72.57:58393] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||desert-automotive.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "desert-automotive.com"] [uri "/redneck.html"] [unique_id "auFoukJadrHXKJ0d58-T_wAAAEk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-10-16 06:12:00
UTC ·
(3 weeks ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇺🇸
TPI-Abuse
2026-10-15 13:41:57
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 216.40.72.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:41:50.786780 2026] [security2:error] [pid 28956:tid 28956] [client 216.40.72.57:30411] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 216.40.72.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:41:50.786780 2026] [security2:error] [pid 28956:tid 28956] [client 216.40.72.57:30411] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||elainebroussard.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "elainebroussard.com"] [uri "/sloppysnowman/drinks.html"] [unique_id "atDYHoSSZTrjJZ-IMhazBAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇺🇸
NetGuard
2026-05-27 23:53:01
UTC ·
(5 months ago)
#honeypot #netguard247 #ciscoasa
Captured by NetGuard 24/7 T-Pot honeypot (netguard24-7.com).
Timestamp: 2026-05-27T23:53:01.216+00:00
Attacker IP: 216.40.72.57 | Port: N/A | Country: United States
Honeypot: ciscoasa | Attack: unknown
Source: NetGuar ...
show more
#honeypot #netguard247 #ciscoasa
Captured by NetGuard 24/7 T-Pot honeypot (netguard24-7.com).
Timestamp: 2026-05-27T23:53:01.216+00:00
Attacker IP: 216.40.72.57 | Port: N/A | Country: United States
Honeypot: ciscoasa | Attack: unknown
Source: NetGuard 24/7 (netguard24-7.com) | PhantomGrid Defense
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-04-27 06:59:55
UTC ·
(6 months ago)
(mod_security) mod_security (id:210730) triggered by 216.40.72.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 02:59:48.864327 2026] [security2:error] [pid 10410:tid 10410] [client 216.40.72.57:59789] Mod ...
show more
(mod_security) mod_security (id:210730) triggered by 216.40.72.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 27 02:59:48.864327 2026] [security2:error] [pid 10410:tid 10410] [client 216.40.72.57:59789] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.htaautosales.com.modeltdr.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.htaautosales.com.modeltdr.com"] [uri "/s3cmd.ini"] [unique_id "ae8JZExX-QviqjKfHgSobQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-13 20:18:20
UTC ·
(6 months ago)
(mod_security) mod_security (id:210350) triggered by 216.40.72.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 13 16:18:17.368226 2026] [security2:error] [pid 1556199:tid 1556199] [client 216.40.72.57:51637] ...
show more
(mod_security) mod_security (id:210350) triggered by 216.40.72.57 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Apr 13 16:18:17.368226 2026] [security2:error] [pid 1556199:tid 1556199] [client 216.40.72.57:51637] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||televisonic.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "televisonic.com"] [uri "/"] [unique_id "ad1PiQD0kHtQhtp3-YzbYwAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
MusicLibrary
2026-03-31 23:24:10
UTC ·
(7 months ago)
Attempted access to non existent wordpress urls
Bad Web Bot
🇺🇸
ANTI SCANNER
2026-03-31 22:27:30
UTC ·
(7 months ago)
Scanner : /xmlrpc.php
Web Spam
🇮🇩
BPS-StatisticsIndonesia
2026-03-23 02:54:36
UTC ·
(7 months ago)
XML RPC Scan Activities: "2026-03-23T09:54:36.775+07:00" "/xmlrpc.php" "216.40.72.57" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:145.0) Gecko/20100101 Firefox/145.0"
Web App Attack
Brute-Force
🇮🇩
BPS-StatisticsIndonesia
2026-03-20 14:16:08
UTC ·
(7 months ago)
XML RPC Scan Activities: "2026-03-20T21:16:08.678+07:00" "/xmlrpc.php" "216.40.72.57" "AppleWebKit/531.31 (KHTML, like Gecko111)"
Web App Attack
Brute-Force
🇩🇪
MusicLibrary
2026-03-19 18:40:36
UTC ·
(7 months ago)
Attempted access to non existent wordpress urls
Bad Web Bot
