🇺🇸
TPI-Abuse
2026-10-15 14:16:06
(5 hours ago)
(mod_security) mod_security (id:210350) triggered by 216.40.75.24 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210350) triggered by 216.40.75.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 10:16:02.288587 2026] [security2:error] [pid 31731:tid 31731] [client 216.40.75.24:55377] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.inquiryroom.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.inquiryroom.com"] [uri "/Religious_Affections_by_Jonathan_Edwards.htm"] [unique_id "atDgIpGKzu99NAihE6AMAwAAABg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 13:41:49
(6 hours ago)
(mod_security) mod_security (id:210350) triggered by 216.40.75.24 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210350) triggered by 216.40.75.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:41:41.334157 2026] [security2:error] [pid 24833:tid 24833] [client 216.40.75.24:61697] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||eiltopofictioncritique.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "eiltopofictioncritique.com"] [uri "/eiltopofictioncritique.com/Robert_Filliou.html"] [unique_id "atDYFfBKzOlARUrIICGp-gAAADM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-22 14:19:34
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 216.40.75.24 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.40.75.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 22 10:19:26.403676 2026] [security2:error] [pid 5907:tid 5907] [client 216.40.75.24:61079] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "psychiatryabuse.com"] [uri "/.wp-config.php.swp"] [unique_id "ahBl7rhwvY5rOS3ALP5poQAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 19:38:03
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 216.40.75.24 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.40.75.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 15:37:54.957323 2026] [security2:error] [pid 7789:tid 7789] [client 216.40.75.24:37719] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "rochesterhistorical.org"] [uri "/wp-config.php.dist"] [unique_id "ag4NkmprCE_HUkxnvABmBwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-05-20 16:41:23
(4 months ago)
(mod_security) mod_security (id:210492) triggered by 216.40.75.24 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 216.40.75.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed May 20 12:41:14.621895 2026] [security2:error] [pid 4080:tid 4149] [client 216.40.75.24:34173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "tsengkwongchi.com.munatseng.org"] [uri "/wp-config.php.dist"] [unique_id "ag3kKv_CCRjj3q--r1OFdAAAAJY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-05-01 01:00:21
(5 months ago)
Repeated requests on blocked xmlrpc.php, blocked by fail2ban in custom-503-xmlrpc jail
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-29 10:28:27
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 216.40.75.24 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 216.40.75.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Apr 29 06:28:21.536068 2026] [security2:error] [pid 13910:tid 13910] [client 216.40.75.24:37983] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.bobrossi.gregorii.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.bobrossi.gregorii.com"] [uri "/s3cmd.ini"] [unique_id "afHdRXvGpYfrGaPImqxhkgAAABc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-04-28 19:53:33
(5 months ago)
(mod_security) mod_security (id:210730) triggered by 216.40.75.24 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210730) triggered by 216.40.75.24 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Apr 28 15:53:24.240452 2026] [security2:error] [pid 6424:tid 6424] [client 216.40.75.24:52817] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.bgraph.com|F|2"] [data ".ini"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.bgraph.com"] [uri "/s3cmd.ini"] [unique_id "afEQNHo6sUdgaHDFvRIU1gAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Lino Project
2026-04-17 09:44:13
(5 months ago)
216.40.75.24 - - [17/Apr/2026:11:44:12 +0200] "GET /wp-config.php HTTP/1.1" 403 3872 "-" "Mozilla/5. ...
show more
216.40.75.24 - - [17/Apr/2026:11:44:12 +0200] "GET /wp-config.php HTTP/1.1" 403 3872 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36"
...
show less
Brute-Force
Bad Web Bot
Web App Attack
🇧🇪
voormedia
2026-02-09 05:09:21
(8 months ago)
Accessed trap at '/xmlrpc.php'
Web App Attack
🇪🇸
el-brujo
2026-02-05 13:35:47
(8 months ago)
Cloudflare WAF: Request Path: /xmlrpc.php Request Query: Host: foro.elhacker.net userAgent: Mozilla ...
show more
Cloudflare WAF: Request Path: /xmlrpc.php Request Query: Host: foro.elhacker.net userAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:146.0) Gecko/20100101 Firefox/146.0 Action: managed_challenge Source: firewallManaged ASN Description: GTS-AS Country: FI Method: POST Timestamp: 2026-02-05T13:35:47Z ruleId: 5de7edfa648c4d6891dc3e7f84534ffa. Report generated by Cloudflare-WAF-to-AbuseIPDB (https://github.com/MHG-LAB/Cloudflare-WAF-to-AbuseIPDB).
show less
Hacking
SQL Injection
Web App Attack
🇪🇸
10dencehispahard SL
2026-01-16 06:20:02
(8 months ago)
Wordpress probing for vulnerabilities
Hacking
Exploited Host
2026-01-09 14:24:15
(9 months ago)
Attempted access to sensitive endpoint (/xmlrpc.php) detected. Automated scan or unauthorized probin ...
show more
Attempted access to sensitive endpoint (/xmlrpc.php) detected. Automated scan or unauthorized probing.
show less
Web App Attack
🇺🇸
nowyouknow
2025-12-18 11:53:28
(9 months ago)
(From [email protected] ) Hi Team,
I typed your main service keywords into Google today, a ...
show more
(From [email protected] ) Hi Team,
I typed your main service keywords into Google today, and I noticed something frustrating. Your website is professionally designed, but it’s buried on Page 2.
Meanwhile, 2 or 3 of your direct competitors, who frankly have weaker websites than you—are sitting at the top of Page 1.
They are effectively "stealing" leads that were looking for you. They aren't better than you; they just have better SEO signals.
I’ve already analyzed exactly what they are doing differently.
If you want to see the comparison report, just reply "Yes" and I’ll send it over.
Cheers,
QIK
show less
Phishing
Web Spam
