37.72.141.39

(mod_security) mod_security (id:210350) triggered by 37.72.141.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 06:46:51.431412 2026] [security2:error] [pid 20655:tid 20655] [client 37.72.141.39:32655] Mod ... show more (mod_security) mod_security (id:210350) triggered by 37.72.141.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 06:46:51.431412 2026] [security2:error] [pid 20655:tid 20655] [client 37.72.141.39:32655] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||kountz.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "kountz.org"] [uri "/placesearch.php"] [unique_id "avb4qxx9R5bm_U5Id88H5gAAAAg"] show less

(mod_security) mod_security (id:210350) triggered by 37.72.141.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 01:46:28.755398 2026] [security2:error] [pid 20925:tid 20925] [client 37.72.141.39:46789] Mod ... show more (mod_security) mod_security (id:210350) triggered by 37.72.141.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 01:46:28.755398 2026] [security2:error] [pid 20925:tid 20925] [client 37.72.141.39:46789] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.bodybuildbid.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.bodybuildbid.com"] [uri "/articles/mrolympia/allolympia/mrolympia1987.html"] [unique_id "avAaxEHwbiA_4FvATp_UaAAAAAA"] show less

(mod_security) mod_security (id:210350) triggered by 37.72.141.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:39:39.097785 2026] [security2:error] [pid 28308:tid 28308] [client 37.72.141.39:46579] Mod ... show more (mod_security) mod_security (id:210350) triggered by 37.72.141.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:39:39.097785 2026] [security2:error] [pid 28308:tid 28308] [client 37.72.141.39:46579] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||spyasociados.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "spyasociados.com"] [uri "/politica-de-cookies"] [unique_id "aumdy4us-_KGClMBndRnPAAAAAo"] show less

Web App Attack

(mod_security) mod_security (id:210350) triggered by 37.72.141.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:43:39.885861 2026] [security2:error] [pid 25606:tid 25606] [client 37.72.141.39:60357] Mod ... show more (mod_security) mod_security (id:210350) triggered by 37.72.141.39 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:43:39.885861 2026] [security2:error] [pid 25606:tid 25606] [client 37.72.141.39:60357] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||folkdancers.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "folkdancers.org"] [uri "/memberform.html"] [unique_id "atDYi9gMYmX8n2nHWYDKdgAAABE"] show less

Fail2Ban banned 37.72.141.39 for security violations in jail wp-armour. Log: 2026/02/12 05:55:10 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 37.72.141.39 | Target: wplogin" , client: 37.72.141.39, server: [REDACTED], request: "P ... show more Fail2Ban banned 37.72.141.39 for security violations in jail wp-armour. Log: 2026/02/12 05:55:10 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 37.72.141.39 | Target: wplogin" , client: 37.72.141.39, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://espsformacion.com/wp-login.php" ... show less

Fail2Ban banned 37.72.141.39 for security violations in jail wp-armour. Log: 2026/02/06 06:17:55 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 37.72.141.39 | Target: wplogin" , client: 37.72.141.39, server: [REDACTED], request: "P ... show more Fail2Ban banned 37.72.141.39 for security violations in jail wp-armour. Log: 2026/02/06 06:17:55 [error] FastCGI sent in stderr: "PHP message: [WP_ARMOUR_BAN] IP: 37.72.141.39 | Target: wplogin" , client: 37.72.141.39, server: [REDACTED], request: "POST /wp-login.php HTTP/1.1", upstream: [REDACTED], host: [REDACTED], referrer: "https://comerciogallego.es/wp-login.php" ... show less

This IP was involved in a brute force and password spray attack.

HTTP header is restricted by policy (/content-encoding/). String match within "/accept-charset/ /content-encoding/ /proxy/ /lock-token/ /content-range/ /if/" at TX:header_name_content-encoding. (920450-123)

Unauthorized VPN login attempts: 1 attempts were recorded from 37.72.141.39 2025-03-06T16:38:55+01:00 vpn Access-Reject 'cafc91' station: 37.72.141.39 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'

Password spraying. Multiple unauthorized login attempts

Scrapping website, using diffrent useragents, not wait for response, #botnet20231026

IP participated in a http flood ddos attack against 87.233.198.20

Password Spary Attack