Total reports
8 from
6 distinct
reporters
First reported
April 20th 2026
Most recent report
1 day ago
Last 60 days
Top reporter locations
🇺🇸
United States of America
4
🇩🇪
Germany
1
Most common categories
Bad Web Bot
4
Web App Attack
4
Brute-Force
3
DDoS Attack
1
Exploited Host
1
Recent reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇺🇸
TPI-Abuse
2026-11-08 09:00:20
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 130.49.112.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 04:00:14.314411 2026] [security2:error] [pid 3675953:tid 3675961] [client 130.49.112.104:14 ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.112.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 04:00:14.314411 2026] [security2:error] [pid 3675953:tid 3675961] [client 130.49.112.104:14921] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||delapiazza.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "delapiazza.com"] [uri "/designer-fabric-pouches-water-bottle-bags/pouch-autumn-multi-color-stripe-6"] [unique_id "avA6HtoEwTOM4esDnxAKYgAAAMM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
Zandro
2026-11-07 12:00:14
UTC ·
(1 day ago)
distributed harvester
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
TPI-Abuse
2026-11-05 22:02:20
UTC ·
(3 days ago)
(mod_security) mod_security (id:210350) triggered by 130.49.112.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 17:02:15.949239 2026] [security2:error] [pid 6965:tid 6965] [client 130.49.112.104:54523] M ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.112.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 17:02:15.949239 2026] [security2:error] [pid 6965:tid 6965] [client 130.49.112.104:54523] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2020/03/17/mar-15-2020-spanish-flu-arsenal-for-democracy-ep-300/"] [unique_id "auz85zA1Vd1xEMUQ5C278gAAADM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-11-05 05:21:28
UTC ·
(4 days ago)
Botnet flood DDOS activity
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 19:32:35
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 130.49.112.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:32:31.910343 2026] [security2:error] [pid 22225:tid 22225] [client 130.49.112.104:22913] ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.112.104 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:32:31.910343 2026] [security2:error] [pid 22225:tid 22225] [client 130.49.112.104:22913] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||elfinforest.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "elfinforest.net"] [uri "/jokesgeorgecarlin.htm"] [unique_id "auJNz902YVnoZcdrH5vItwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
kosada.com
2026-04-29 22:08:02
UTC ·
(6 months ago)
Web password guessing
Brute-Force
2026-04-27 08:55:42
UTC ·
(6 months ago)
FPROCO WEBEXPLOIT 130.49.112.104 (130.49.112.104)
Web App Attack
🇺🇸
Mainpine
2026-04-20 04:40:43
UTC ·
(6 months ago)
probing for vulnerable web apps
Web App Attack
