🇺🇸
TPI-Abuse
2026-11-14 18:31:49
UTC ·
(9 hours ago)
(mod_security) mod_security (id:210350) triggered by 130.49.112.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 13:31:41.210480 2026] [security2:error] [pid 22384:tid 22384] [client 130.49.112.145:43965] ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.112.145 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 13:31:41.210480 2026] [security2:error] [pid 22384:tid 22384] [client 130.49.112.145:43965] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.franklincountyquilters.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.franklincountyquilters.org"] [uri "/fcqgquiltshow2014/target255.html"] [unique_id "avipDSAHmYXmZ20gE_pQaAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
Reinhard
2026-10-15 14:24:41
UTC ·
(4 weeks ago)
Harvesting non-existent pages or unknown malicious BOT.
Bad Web Bot
🇨🇿
Countryman
2026-09-15 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(2 months ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇨🇭
SOC [GOLINE SA]
2026-09-09 15:19:29
UTC ·
(2 months ago)
[RoutePulse | 2026-09-09T15:19:29Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 130.49.112.145 · AS35830 BTTGROUP-AS Fast Servers (Pty) Ltd
EVIDENCE: Cisco VPN RA Brute force on Cisco FTDv — portal under siege (109 real failed logins / 15 mi ...
show more
[RoutePulse | 2026-09-09T15:19:29Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 130.49.112.145 · AS35830 BTTGROUP-AS Fast Servers (Pty) Ltd
EVIDENCE: Cisco VPN RA Brute force on Cisco FTDv — portal under siege (109 real failed logins / 15 min): 3 attacker IPs in 130.49.112.0/24 from campaign AS35830 BTTGROUP-AS Fast Servers (Pty) Ltd (70 IPs over the campaign); the attacker reuses its /2 · /24 aggregate member of 130.49.112.0/24
DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring
ACTION: BGP null route injected at RoutePulse network edge
show less
Brute-Force
Hacking
🇨🇭
SOC [GOLINE SA]
2026-09-08 21:44:51
UTC ·
(2 months ago)
[RoutePulse | 2026-09-08T21:44:51Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 130.49.112.145
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — distributed attack (3 attempts/15min) — shun on the VPN ...
show more
[RoutePulse | 2026-09-08T21:44:51Z | RTBH-INJECTED]
ATTACK CLASS: vpn_bruteforce
SOURCE: 130.49.112.145
EVIDENCE: Shunned on the Cisco FTD VPN gateway — Cisco VPN RA Brute force on Cisco FTDv — distributed attack (3 attempts/15min) — shun on the VPN gateway
DETECTION: Conviction Engine SPRT + 14-detector ML stack (6-model weighted ensemble) + 5-pillar threat scoring
ACTION: BGP null route injected at RoutePulse network edge
show less
Brute-Force
Hacking
🇫🇷
mrcrassi
2026-08-25 12:41:56
UTC ·
(2 months ago)
Triggered Cloudflare WAF (firewallCustom) from SE.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0
This report was generated by:
https:// ...
show more
Triggered Cloudflare WAF (firewallCustom) from SE.
Action taken: BLOCK
Protocol: HTTP/2 (POST method)
Endpoint: /wp-login.php
UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0
This report was generated by:
https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB
show less
Bad Web Bot
🇩🇪
FD-IX
2026-08-21 09:08:25
UTC ·
(2 months ago)
Brute-force login attack detected by WordPress firewall.
Brute-Force
🇳🇱
i-turnradio.nl
2026-02-20 03:07:14
UTC ·
(8 months ago)
2026-02-20 @ 04:07:13 (CET) ~ Blocked for trying to access: /erker/wp/wp-login.php
Web App Attack
🇹🇷
rtbh.com.tr
2026-02-04 00:11:22
UTC ·
(9 months ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇫🇷
solution.it
2026-01-29 09:17:48
UTC ·
(9 months ago)
[Thu Jan 29 10:17:47.339636 2026] [php7:error] [pid 3410966:tid 3410966] [client 130.49.112.145:61005] script '/var/www/html/wp-login.php' not found or unable to stat
Web App Attack
🇫🇷
SpaceHost-Server
2026-01-27 23:30:08
UTC ·
(9 months ago)
Brute-Force
Web App Attack
🇹🇷
rtbh.com.tr
2026-01-27 20:11:15
UTC ·
(9 months ago)
list.rtbh.com.tr report: tcp/0
Brute-Force
🇫🇷
SpaceHost-Server
2026-01-26 23:29:42
UTC ·
(9 months ago)
Brute-Force
Web App Attack
