🇺🇸
TPI-Abuse
2026-11-15 05:25:36
UTC ·
(7 hours ago)
(mod_security) mod_security (id:210350) triggered by 130.49.77.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 00:25:28.544920 2026] [security2:error] [pid 14372:tid 14372] [client 130.49.77.175:33359] M ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.77.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 00:25:28.544920 2026] [security2:error] [pid 14372:tid 14372] [client 130.49.77.175:33359] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.jerusalem-korczak-home.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.jerusalem-korczak-home.com"] [uri "/np/war/np143.html"] [unique_id "avlCSLzvV6yY0fveZIsuWwAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-15 02:11:28
UTC ·
(11 hours ago)
(mod_security) mod_security (id:210350) triggered by 130.49.77.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 21:11:23.741316 2026] [security2:error] [pid 27156:tid 27156] [client 130.49.77.175:30927] M ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.77.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 14 21:11:23.741316 2026] [security2:error] [pid 27156:tid 27156] [client 130.49.77.175:30927] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||campnecon.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "campnecon.com"] [uri "/camp-necon-41/registration-for-camp-necon-41-now-open/"] [unique_id "avkUyxDj_iOnmGNzG4mytAAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-05 00:27:14
UTC ·
(1 week ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-11-04 20:17:50
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 130.49.77.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 15:17:46.492039 2026] [security2:error] [pid 12044:tid 12044] [client 130.49.77.175:54609] M ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.77.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 04 15:17:46.492039 2026] [security2:error] [pid 12044:tid 12044] [client 130.49.77.175:54609] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/tag/gilded-age/"] [unique_id "auuS6sbTtSRTLCegvf4HfgAAAAE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇮🇹
sssrit
2026-11-03 07:01:51
UTC ·
(1 week ago)
130.49.77.175 - - [03/Nov/2026:08:01:50 +0100] "GET /notizie-dal-mondo/salute-e-benessere/hub-vaccinazione-di-sassari-si-trasferisce-in-via-grazia-deledda/ HTTP/1.1" 404 13469 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, ...
show more
130.49.77.175 - - [03/Nov/2026:08:01:50 +0100] "GET /notizie-dal-mondo/salute-e-benessere/hub-vaccinazione-di-sassari-si-trasferisce-in-via-grazia-deledda/ HTTP/1.1" 404 13469 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 Edg/135.0.0.0"
...
show less
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 17:53:49
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 130.49.77.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 13:53:43.222449 2026] [security2:error] [pid 24747:tid 24747] [client 130.49.77.175:13475] M ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.77.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 13:53:43.222449 2026] [security2:error] [pid 24747:tid 24747] [client 130.49.77.175:13475] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.painting-with-numbers.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.painting-with-numbers.com"] [uri "/blog/tag/Quantation Philosophy"] [unique_id "auOIJwSZtMa6QECYHqu5nwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 18:28:40
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 130.49.77.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 14:28:36.474213 2026] [security2:error] [pid 20794:tid 20794] [client 130.49.77.175:50505] M ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.77.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 14:28:36.474213 2026] [security2:error] [pid 20794:tid 20794] [client 130.49.77.175:50505] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||doctorc.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "doctorc.net"] [uri "/Labs/Lab26/Notes/birdnose.htm"] [unique_id "auDtVJuZsmxnjPgAObDw_QAAAAY"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-22 23:24:53
UTC ·
(3 weeks ago)
(mod_security) mod_security (id:210350) triggered by 130.49.77.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 19:24:45.462719 2026] [security2:error] [pid 3706:tid 3706] [client 130.49.77.175:14081] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.77.175 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 22 19:24:45.462719 2026] [security2:error] [pid 3706:tid 3706] [client 130.49.77.175:14081] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||angeltarrac.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "angeltarrac.com"] [uri "/angel-tarrac-museum/listmonuments.html"] [unique_id "atqbPSz1LZr-394-xwzzfgAAAA8"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-18 20:37:17
UTC ·
(3 weeks ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
2026-09-04 12:46:39
UTC ·
(2 months ago)
130.49.77.175 arduino.ua [04/Sep/2026:15:46:39 +0300] "GET /index.php?newprods=yes%20UNION%20ALL%20SELECT%20%27kydjkjagfnjobkvohaonglxqlaerorot%27%2CNULL%2CNULL%2CNULL%2CNULL--%203a44v5&srsltid=AfmBOory1sXwY0tld_zfAxGCKDkMa11GN-_OA1Id4h3PAMvnoRbhz0aj ...
show more
130.49.77.175 arduino.ua [04/Sep/2026:15:46:39 +0300] "GET /index.php?newprods=yes%20UNION%20ALL%20SELECT%20%27kydjkjagfnjobkvohaonglxqlaerorot%27%2CNULL%2CNULL%2CNULL%2CNULL--%203a44v5&srsltid=AfmBOory1sXwY0tld_zfAxGCKDkMa11GN-_OA1Id4h3PAMvnoRbhz0aj HTTP/1.1" 200 165305 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36" 0.099 2566
...
show less
Hacking
SQL Injection
Web App Attack
2026-08-14 07:31:36
UTC ·
(3 months ago)
Web Spam
🇩🇪
LRob
2026-07-30 18:44:59
UTC ·
(3 months ago)
CrowdSec: crowdsecurity/http-admin-interface-probing | req: /admin-login.php | 3 distinct paths | UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
Hacking
🇺🇸
nationaleventpros.com
2026-06-14 22:40:44
UTC ·
(5 months ago)
WordPress login attempt
Brute-Force
2026-06-12 03:24:44
UTC ·
(5 months ago)
(caddyscan) Scanner path probe from 130.49.77.175 (FR/France/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 130.49.77.175 - - [12/Jun/2026:03:24:06 +0000] "POST /xmlrpc.php HTTP/1.1"
[RED ...
show more
(caddyscan) Scanner path probe from 130.49.77.175 (FR/France/-): 5 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: [REDACTED] 200 2627 130.49.77.175 - - [12/Jun/2026:03:24:06 +0000] "POST /xmlrpc.php HTTP/1.1"
[REDACTED] 200 2627 130.49.77.175 - - [12/Jun/2026:03:24:12 +0000] "GET /wp-login.php HTTP/1.1"
[REDACTED] 200 2627 130.49.77.175 - - [12/Jun/2026:03:24:13 +0000] "GET /wp-login.php HTTP/1.1"
[REDACTED] 200 2627 130.49.77.175 - - [12/Jun/2026:03:24:28 +0000] "POST /xmlrpc.php HTTP/1.1"
[REDACTED] 200 2627 130.49.77.175 - - [12/Jun/2026:03:24:39 +0000] "GET /wp-login.php HTTP/1.1"
show less
Port Scan
🇺🇸
Jason Howell
2026-06-02 19:39:10
UTC ·
(5 months ago)
130.49.77.175 - - [02/Jun/2026:13:59:10 -0500] "GET /wp-login.php HTTP/1.1" 200 4493 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
130.49.77.175 - - [02/Jun/2026:13:59 ...
show more
130.49.77.175 - - [02/Jun/2026:13:59:10 -0500] "GET /wp-login.php HTTP/1.1" 200 4493 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
130.49.77.175 - - [02/Jun/2026:13:59:11 -0500] "POST /wp-login.php HTTP/1.1" 200 4596 "https://abstractco.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
130.49.77.175 - - [02/Jun/2026:13:59:11 -0500] "GET /wp-admin/ HTTP/1.1" 302 2817 "https://abstractco.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
130.49.77.175 - - [02/Jun/2026:13:59:12 -0500] "GET /wp-login.php?redirect_to=https%3A%2F%2Fwww.abstractco.com%2Fwp-admin%2F&reauth=1 HTTP/1.1" 200 6654 "https://abstractco.com/wp-login.php" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
130.49.77.175 - - [02/Jun/2026:14:39:09
...
show less
Web App Attack
