🇺🇸
TPI-Abuse
2026-11-10 05:45:06
UTC ·
(10 hours ago)
(mod_security) mod_security (id:210350) triggered by 130.49.113.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 00:45:00.174064 2026] [security2:error] [pid 28957:tid 28957] [client 130.49.113.220:48571] ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.113.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 10 00:45:00.174064 2026] [security2:error] [pid 28957:tid 28957] [client 130.49.113.220:48571] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||painting-with-numbers.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "painting-with-numbers.com"] [uri "/the-book/related-articles-posts/"] [unique_id "avKvXLek8oyAnBmiXc3B_QAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 11:29:43
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 130.49.113.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 07:29:35.905804 2026] [security2:error] [pid 22733:tid 22733] [client 130.49.113.220:50243] ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.113.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 07:29:35.905804 2026] [security2:error] [pid 22733:tid 22733] [client 130.49.113.220:50243] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||aim-controls.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "aim-controls.com"] [uri "/application-custom.php"] [unique_id "auXRH-FoOOxu1_YiJTJUDgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 23:13:44
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 130.49.113.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 19:13:39.580026 2026] [security2:error] [pid 27109:tid 27109] [client 130.49.113.220:61713] ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.113.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 19:13:39.580026 2026] [security2:error] [pid 27109:tid 27109] [client 130.49.113.220:61713] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||agenesis7.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "agenesis7.com"] [uri "/Products/Editor/edit_srcip.htm"] [unique_id "auKBo7mFhUMtvNnZMyMt_QAAABs"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 12:10:57
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 130.49.113.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 08:10:48.993973 2026] [security2:error] [pid 23955:tid 23955] [client 130.49.113.220:65033] ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.113.220 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 08:10:48.993973 2026] [security2:error] [pid 23955:tid 23955] [client 130.49.113.220:65033] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||cookingwithjule.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cookingwithjule.com"] [uri "/ApplePieRollUps.htm"] [unique_id "auHmSIMkWDOEsEgHzR_50gAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇩🇪
LRob
2026-10-14 13:39:26
UTC ·
(3 weeks ago)
Not following 301 redirects — wasted requests | method: GET, HEAD | path: /__wp_probe_nourra_does_not_exist.php, /wp-login.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36, Mozi ...
show more
Not following 301 redirects — wasted requests | method: GET, HEAD | path: /__wp_probe_nourra_does_not_exist.php, /wp-login.php | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36, Mozilla/5.0 (X11; Linux x86_64; rv:140.0) Gecko/20100101 Firefox/140.0
show less
Bad Web Bot
🇨🇭
backslash
2026-09-18 00:12:00
UTC ·
(1 month ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot
🇨🇭
4server
2026-09-15 06:35:15
UTC ·
(1 month ago)
[TueSep1508:35:09.8765362026][security2:error][pid4002727:tid4002934][client130.49.113.220:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"614\"][id\ ...
show more
[TueSep1508:35:09.8765362026][security2:error][pid4002727:tid4002934][client130.49.113.220:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Stringmatch\"/xmlrpc.php\"atREQUEST_URI.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"614\"][id\"960024\"][msg\"XML-RPCdisabled\"][hostname\"leonitraslochi.ch\"][uri\"/xmlrpc.php\"][unique_id\"aqjnHQNLgMIHcr5APQGPawAAAAs\"]
show less
Hacking
Web App Attack
2026-09-04 12:46:44
UTC ·
(2 months ago)
130.49.113.220 arduino.ua [04/Sep/2026:15:46:43 +0300] "GET /index.php?newprods=yes&srsltid=AfmBOory1sXwY0tld_zfAxGCKDkMa11GN-_OA1Id4h3PAMvnoRbhz0aj%25%27%29%29%20OR%20EXTRACTVALUE%287387%2CCONCAT%280x7e%2C%28%28SELECT%20%28ELT%287387%3D7387%2C1%29%2 ...
show more
130.49.113.220 arduino.ua [04/Sep/2026:15:46:43 +0300] "GET /index.php?newprods=yes&srsltid=AfmBOory1sXwY0tld_zfAxGCKDkMa11GN-_OA1Id4h3PAMvnoRbhz0aj%25%27%29%29%20OR%20EXTRACTVALUE%287387%2CCONCAT%280x7e%2C%28%28SELECT%20%28ELT%287387%3D7387%2C1%29%29%29%29%2C0x7e%29%29--%20- HTTP/1.1" 200 164676 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Edg/120.0.0.0" 0.105 2566
...
show less
Hacking
SQL Injection
Web App Attack
🇪🇸
librebit
2026-08-20 13:35:14
UTC ·
(2 months ago)
Brute force
Brute-Force
2026-08-20 12:45:46
UTC ·
(2 months ago)
Multiple failed login attemps RDS-Web-Access-Server
Brute-Force
Web App Attack
🇪🇸
librebit
2026-06-20 04:57:56
UTC ·
(4 months ago)
Brute force
Brute-Force
🇧🇪
DrLex0
2025-10-29 17:12:37
UTC ·
(1 year ago)
Web spam on hidden bait web form
Web Spam
2025-10-29 15:08:55
UTC ·
(1 year ago)
Forum/form spam
Web Spam
