🇺🇸
TPI-Abuse
2026-10-26 01:13:48
(13 hours ago)
(mod_security) mod_security (id:210350) triggered by 130.49.76.146 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.76.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Oct 25 21:13:43.982102 2026] [security2:error] [pid 19338:tid 19338] [client 130.49.76.146:48539] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||scatchellsbeefstand.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "scatchellsbeefstand.com"] [uri "/"] [unique_id "at6pR-5M8x9o14lsEOOM8gAAAC4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 20:20:58
(4 days ago)
(mod_security) mod_security (id:210350) triggered by 130.49.76.146 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.76.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:20:50.630270 2026] [security2:error] [pid 25104:tid 25104] [client 130.49.76.146:22253] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||thresholddigital.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "thresholddigital.com"] [uri "/video.html"] [unique_id "atkeoiwzKJ233h4Hjq3UlwAAAF0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 13:54:12
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 130.49.76.146 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.76.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:54:04.264415 2026] [security2:error] [pid 14216:tid 14216] [client 130.49.76.146:16963] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.perthdps.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.perthdps.com"] [uri "/convicts/conwad23.htm"] [unique_id "atDa_C4F7F6eX8SN84IrzwAAADc"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-15 13:08:52
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 130.49.76.146 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.76.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:08:45.422149 2026] [security2:error] [pid 1815:tid 1815] [client 130.49.76.146:12459] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.tobyjohnson.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.tobyjohnson.com"] [uri "/dafodil.html"] [unique_id "atDQXcTCU0C63h7N8BlveQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇿
lp
2026-09-14 06:21:14
(1 month ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 130.49.76.146
2026-09-14T07:20:20+02: ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 130.49.76.146
2026-09-14T07:20:20+02:00 vpn Access-Reject '[email protected] ' station: 130.49.76.146 auth-type: - realm: DEFAULT nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
lp
2026-09-10 06:21:20
(1 month ago)
Unauthorized VPN login attempts: 6 attempts were recorded from 130.49.76.146
2026-09-10T06:56:34+02: ...
show more
Unauthorized VPN login attempts: 6 attempts were recorded from 130.49.76.146
2026-09-10T06:56:34+02:00 vpn Access-Reject 'Tunde.Fisher' station: 130.49.76.146 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-10T06:57:49+02:00 vpn Access-Reject 'Sachith.Elakumbura' station: 130.49.76.146 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-10T06:59:10+02:00 vpn Access-Reject 'Ahmed.Mokhles' station: 130.49.76.146 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-10T07:00:32+02:00 vpn Access-Reject 'Jack.Kennedy' station: 130.49.76.146 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
2026-09-10T07:01:55+02:00 vpn Access-Reject 'Chamini.Jayarandika' station: 130.49.76.14
show less
Brute-Force
Web App Attack
🇩🇪
FeG Deutschland
2026-09-06 05:18:24
(1 month ago)
Looking for CMS/PHP/SQL vulnerablilities/excessive crawling - 27
Exploited Host
Web App Attack
🇮🇹
mgarofano80
2026-08-26 02:29:13
(2 months ago)
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-08-11 18:00:14
(2 months ago)
(mod_security) mod_security (id:218580) triggered by 130.49.76.146 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:218580) triggered by 130.49.76.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 14:00:10.986865 2026] [security2:error] [pid 3346040:tid 3346040] [client 130.49.76.146:21305] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?i:\\\\/\\\\*[!+](?:[\\\\w\\\\s=_\\\\-()]+)?\\\\*\\\\/)" at ARGS:menu. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/22_SQL_SQLi.conf"] [line "76"] [id "218580"] [rev "1"] [msg "COMODO WAF: MySQL in-line comment detected.||www.caferutadelaseda.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "SQLi"] [hostname "www.caferutadelaseda.com"] [uri "/menu-detalle.php"] [unique_id "antjKlAm9iPQ2s_AOQf6XgAAAB0"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
masterguru
2026-06-18 00:55:35
(4 months ago)
(modsec_2000110) ModSec 2000110: Malicious username admlnlx from 130.49.76.146 (PL/Poland/-): 1 in t ...
show more
(modsec_2000110) ModSec 2000110: Malicious username admlnlx from 130.49.76.146 (PL/Poland/-): 1 in the last 3600 secs (0-195)
show less
Hacking
🇫🇷
masterguru
2026-06-07 06:36:39
(4 months ago)
(modsec_2000110) ModSec 2000110: Malicious username admlnlx from 130.49.76.146 (PL/Poland/-): 1 in t ...
show more
(modsec_2000110) ModSec 2000110: Malicious username admlnlx from 130.49.76.146 (PL/Poland/-): 1 in the last 3600 secs (0-195)
show less
Hacking
🇫🇷
masterguru
2026-05-28 17:31:35
(4 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 130.49.76.146 (PL/Poland/-): 1 in the last 360 ...
show more
(modsec_5015) ModSec 5015: Suspicious User-Agent from 130.49.76.146 (PL/Poland/-): 1 in the last 3600 secs (0-195)
show less
Hacking
🇫🇷
masterguru
2026-05-26 03:42:28
(5 months ago)
(modsec_5015) ModSec 5015: Suspicious User-Agent from 130.49.76.146 (PL/Poland/-): 1 in the last 360 ...
show more
(modsec_5015) ModSec 5015: Suspicious User-Agent from 130.49.76.146 (PL/Poland/-): 1 in the last 3600 secs (0-195)
show less
Hacking
🇺🇸
TPI-Abuse
2026-01-22 11:46:05
(9 months ago)
(mod_security) mod_security (id:225170) triggered by 130.49.76.146 (-): 1 in the last 300 secs; Port ...
show more
(mod_security) mod_security (id:225170) triggered by 130.49.76.146 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Jan 22 06:45:58.108923 2026] [security2:error] [pid 2223:tid 2317] [client 130.49.76.146:40593] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||arizonasolutionsgroup.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "arizonasolutionsgroup.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aXIN9tl4teXSWGbqEWg6kgAAAUg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇪🇸
10dencehispahard SL
2025-11-13 06:44:21
(11 months ago)
WP probing for vulnerabilities
Hacking
Exploited Host
