🇺🇸
TPI-Abuse
2026-11-12 07:46:20
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 130.49.114.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 02:46:16.531790 2026] [security2:error] [pid 16483:tid 16549] [client 130.49.114.231:57149] ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.114.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 02:46:16.531790 2026] [security2:error] [pid 16483:tid 16549] [client 130.49.114.231:57149] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||howardhallis.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "howardhallis.com"] [uri "/doctorstrange/posters/postersB/files/res/mobile"] [unique_id "avVuyF9pAQi65ZTkdHn7tgAAAQc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 11:29:48
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 130.49.114.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 06:29:41.246833 2026] [security2:error] [pid 4566:tid 4566] [client 130.49.114.231:41427] M ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.114.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 06:29:41.246833 2026] [security2:error] [pid 4566:tid 4566] [client 130.49.114.231:41427] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.fundingangelinvestors.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fundingangelinvestors.com"] [uri "/tag/personal-loans/"] [unique_id "avRRpQXGkpYZkLPr_SfOFQAAABk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-05 00:11:36
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 130.49.114.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 19:11:32.471685 2026] [security2:error] [pid 10856:tid 10856] [client 130.49.114.231:65075] ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.114.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 19:11:32.471685 2026] [security2:error] [pid 10856:tid 10856] [client 130.49.114.231:65075] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.ctrussell.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.ctrussell.us"] [uri "/manna/R3054.htm"] [unique_id "auvJtA7kyn1Yjv8nR59AJQAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 17:19:59
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210730) triggered by 130.49.114.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 13:19:55.054786 2026] [security2:error] [pid 10626:tid 10626] [client 130.49.114.231:43855] ...
show more
(mod_security) mod_security (id:210730) triggered by 130.49.114.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 13:19:55.054786 2026] [security2:error] [pid 10626:tid 10626] [client 130.49.114.231:43855] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||williamfitzsimmons.com|F|2"] [data ".accousticlakeside.com"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "williamfitzsimmons.com"] [uri "/news/william-announces-european-tour/www.accousticlakeside.com"] [unique_id "atzouwVmX3pMgC4u8G1ChgAAAA8"], referer: https://williamfitzsimmons.com/news/william-announces-european-tour/
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-24 10:18:51
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 130.49.114.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 06:18:44.171951 2026] [security2:error] [pid 28518:tid 28518] [client 130.49.114.231:65435] ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.114.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 06:18:44.171951 2026] [security2:error] [pid 28518:tid 28518] [client 130.49.114.231:65435] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||dylanwalsh.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "dylanwalsh.net"] [uri "/javacert/d0e1635.htm"] [unique_id "atyGBK5fsevnwTESp4E_oQAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-20 17:14:29
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 130.49.114.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 13:14:22.539909 2026] [security2:error] [pid 9463:tid 9463] [client 130.49.114.231:15319] M ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.114.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 20 13:14:22.539909 2026] [security2:error] [pid 9463:tid 9463] [client 130.49.114.231:15319] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ran101.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ran101.com"] [uri "/pecan_pie.htm"] [unique_id "atehbgQgxTfn4WDa23rzhwAAAA0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
www.winos.me
2026-08-31 10:52:21
UTC ·
(2 months ago)
Scanning for sensitive files/paths: /xmlrpc.php
Hacking
Web App Attack
🇩🇪
LRob
2026-08-28 14:31:25
UTC ·
(2 months ago)
Malicious web request: probing for secrets, traversal or a known exploit path | method: POST | path: /xmlrpc.php | 2026-08-28 14:31 UTC
Hacking
Web App Attack
🇩🇪
4server
2026-07-18 14:50:52
UTC ·
(3 months ago)
[SatJul1816:50:46.8603822026][security2:error][pid3340047:tid3340103][client130.49.114.231:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\|wget\|python\|nikto\|sqlmap\|acunetix\|fimap\|dirbuster\|cmsmap\)\"atREQUEST_HEADE ...
show more
[SatJul1816:50:46.8603822026][security2:error][pid3340047:tid3340103][client130.49.114.231:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\|wget\|python\|nikto\|sqlmap\|acunetix\|fimap\|dirbuster\|cmsmap\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"217\"][id\"990210\"][msg\"Suspicioususer-agentblocked\"][hostname\"www.gustotondo.ch\"][uri\"/wp-login.php\"][unique_id\"aluSxmzIox-trc1F0Xu26gAAAFQ\"]
show less
Port Scan
Brute-Force
Web App Attack
🇪🇸
librebit
2026-07-11 09:14:52
UTC ·
(4 months ago)
Brute force
Brute-Force
🇪🇸
librebit
2026-07-07 15:51:08
UTC ·
(4 months ago)
Brute force
Brute-Force
🇪🇸
librebit
2026-07-04 05:20:16
UTC ·
(4 months ago)
Brute force
Brute-Force
🇩🇪
stinpriza
2026-04-01 11:01:04
UTC ·
(7 months ago)
Web App Attack
Web App Attack
🇺🇸
kosada.com
2026-03-31 13:59:19
UTC ·
(7 months ago)
Web password guessing
Brute-Force
🇺🇸
TPI-Abuse
2026-03-25 07:30:04
UTC ·
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 130.49.114.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 25 03:29:57.038139 2026] [security2:error] [pid 29840:tid 29847] [client 130.49.114.231:39675] ...
show more
(mod_security) mod_security (id:225170) triggered by 130.49.114.231 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 25 03:29:57.038139 2026] [security2:error] [pid 29840:tid 29847] [client 130.49.114.231:39675] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||abadie.com.uy|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "abadie.com.uy"] [uri "/wp-json/wp/v2/users"] [unique_id "acOO9dmcBhLRBuhFMayBZAAAAIU"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
