🇺🇸
TPI-Abuse
2026-11-12 03:40:07
UTC ·
(4 hours ago)
(mod_security) mod_security (id:210350) triggered by 216.40.72.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 22:40:03.041105 2026] [security2:error] [pid 23562:tid 23562] [client 216.40.72.69:65095] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 216.40.72.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 22:40:03.041105 2026] [security2:error] [pid 23562:tid 23562] [client 216.40.72.69:65095] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.glendaleheritage.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.glendaleheritage.org"] [uri "/glendale/wp-content/plugins/elementor/assets/js/floating-bars.740d06d17cea5cebdb61.bundle.min.js"] [unique_id "avU1E5gtDOW2lhh31MD89QAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-10 06:18:24
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 216.40.72.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 01:18:18.634307 2026] [security2:error] [pid 18257:tid 18257] [client 216.40.72.69:14191] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 216.40.72.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 01:18:18.634307 2026] [security2:error] [pid 18257:tid 18257] [client 216.40.72.69:14191] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||modmove.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "modmove.com"] [uri "/festivals/the-2019-lavazza-italian-film-festival-program-has-been-released-opening-in-brisbane-september-25/"] [unique_id "avK3KsaiTrHJauuPcuHwMgAAAAQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-02 20:00:14
UTC ·
(1 week ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇲🇹
Malta
2026-11-02 02:27:58
UTC ·
(1 week ago)
216.40.72.69 - - [02/Nov/2026:03:27:58 +0100] "POST /wp-login.php HTTP/1.1" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
Hacking
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 13:31:38
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 216.40.72.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 09:31:30.778116 2026] [security2:error] [pid 19546:tid 19550] [client 216.40.72.69:51549] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 216.40.72.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 09:31:30.778116 2026] [security2:error] [pid 19546:tid 19550] [client 216.40.72.69:51549] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||crowns.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "crowns.org"] [uri "/"] [unique_id "auH5MmwxO7GxBbds3vU5sQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 17:37:45
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 216.40.72.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 13:37:40.784658 2026] [security2:error] [pid 2707:tid 2707] [client 216.40.72.69:39563] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 216.40.72.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 13:37:40.784658 2026] [security2:error] [pid 2707:tid 2707] [client 216.40.72.69:39563] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||sjhrc.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "sjhrc.org"] [uri "/pic.html"] [unique_id "atzs5ALYkMPX4QlxLEa6lgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-23 16:47:04
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 216.40.72.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 12:46:59.020938 2026] [security2:error] [pid 2236:tid 2236] [client 216.40.72.69:33889] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 216.40.72.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 12:46:59.020938 2026] [security2:error] [pid 2236:tid 2236] [client 216.40.72.69:33889] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.maryrosevaro.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.maryrosevaro.com"] [uri "/mrv/page_relayLyrics.php"] [unique_id "atuPg4cxBMjPJqli30ArQwAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-10-15 04:33:01
UTC ·
(4 weeks ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇩🇪
big-cloud.nl
2026-09-28 02:08:12
UTC ·
(1 month ago)
Try to access /xmlrpc.php
Web App Attack
🇩🇪
LRob
2026-09-27 04:33:52
UTC ·
(1 month ago)
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack t ...
show more
This address sends abusive requests to WordPress sites we host: user enumeration through the REST API, xmlrpc.php calls the site refuses, endpoints the site does not serve. These are the reconnaissance and attack calls of automated WordPress attack tools, blocked on sight. Please check the machine behind it. | method: POST | path: /xmlrpc.php | 2026-09-27 04:33 UTC
show less
Web App Attack
Hacking
🇩🇪
FeG Deutschland
2026-09-06 12:09:46
UTC ·
(2 months ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 257
Exploited Host
Web App Attack
🇺🇸
TPI-Abuse
2026-09-03 23:45:58
UTC ·
(2 months ago)
(mod_security) mod_security (id:220150) triggered by 216.40.72.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 03 19:44:37.847593 2026] [security2:error] [pid 30167:tid 30167] [client 216.40.72.69:42089] Mod ...
show more
(mod_security) mod_security (id:220150) triggered by 216.40.72.69 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Sep 03 19:44:37.847593 2026] [security2:error] [pid 30167:tid 30167] [client 216.40.72.69:42089] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:union(?:\\\\/\\\\*.{0,399}\\\\*\\\\/)?select)" at ARGS:goto. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/30_Apps_OtherApps.conf"] [line "5662"] [id "220150"] [rev "5"] [msg "COMODO WAF: SQL injection vulnerability in Ginkgo CMS 5.0 (CVE-2013-5318)||powerkiteforum.com|F|2"] [data "')/**/and/**/('fpvupc'='fpvupc'/**/union/**/all/**/select/**/null,'hanwazzzybdlubxahsqdbkxrapwmmjlz',null--/**/wzo3kj"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "powerkiteforum.com"] [uri "/viewthread.php"] [unique_id "apoGZcB1OD8ExfLmXeF8bgAAACQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇬🇧
relianoid.com
2026-08-29 09:38:41
UTC ·
(2 months ago)
POST Abuse detected by Relianoid OSS Load Balancer - relianoid.com
Web Spam
2026-08-27 22:07:28
UTC ·
(2 months ago)
Web Spam
Bad Web Bot
🇬🇧
relianoid.com
2026-08-10 15:01:36
UTC ·
(3 months ago)
POST Abuse detected by Relianoid OSS Load Balancer - relianoid.com
Web Spam
