🇫🇷
Sklurk
2026-11-09 00:35:39
UTC ·
(1 day ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 17:12:49
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 12:12:44.470193 2026] [security2:error] [pid 30983:tid 30983] [client 130.49.77.226:21477] M ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 12:12:44.470193 2026] [security2:error] [pid 30983:tid 30983] [client 130.49.77.226:21477] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.crescentcitycafe.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.crescentcitycafe.com"] [uri "/because-of-you-2000-has-been-raised/"] [unique_id "avCtjGh79-xDF7ABJ9wqBQAAAA4"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 14:11:01
UTC ·
(1 day ago)
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 09:10:57.747923 2026] [security2:error] [pid 324628:tid 324650] [client 130.49.77.226:36759] ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 09:10:57.747923 2026] [security2:error] [pid 324628:tid 324650] [client 130.49.77.226:36759] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||certifiedpoliticalscientist.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "certifiedpoliticalscientist.com"] [uri "/political-science-certification/"] [unique_id "avCC8QpJ4x0JZqk8OgWW3wAAAUw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 18:57:43
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 13:57:36.924097 2026] [security2:error] [pid 9102:tid 9102] [client 130.49.77.226:53899] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 13:57:36.924097 2026] [security2:error] [pid 9102:tid 9102] [client 130.49.77.226:53899] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||ricketyshack.ca|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "ricketyshack.ca"] [uri "/web/"] [unique_id "auouoIr6ulOATvotzxQcOAAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 08:05:49
UTC ·
(6 days ago)
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:05:43.732091 2026] [security2:error] [pid 6617:tid 6617] [client 130.49.77.226:14181] Mod ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 03:05:43.732091 2026] [security2:error] [pid 6617:tid 6617] [client 130.49.77.226:14181] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.cygnetsilks.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.cygnetsilks.com"] [uri "/silk-tarot-altar-cloths/"] [unique_id "aumV1wuaGCLL3Rv5PlZiZgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-31 18:20:42
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 14:20:38.592202 2026] [security2:error] [pid 30480:tid 30480] [client 130.49.77.226:28331] M ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 14:20:38.592202 2026] [security2:error] [pid 30480:tid 30480] [client 130.49.77.226:28331] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.jerusalem-korczak-home.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.jerusalem-korczak-home.com"] [uri "/np/arab/"] [unique_id "auYxdnrDGsRyGEncHBlgSAAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 18:05:07
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 14:05:02.644796 2026] [security2:error] [pid 32134:tid 32134] [client 130.49.77.226:45427] M ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 14:05:02.644796 2026] [security2:error] [pid 32134:tid 32134] [client 130.49.77.226:45427] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||stage15.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "stage15.com"] [uri "/colette.htm"] [unique_id "auOKzjx1eP_DjkRERw7mrwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-29 13:39:37
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 09:39:32.003502 2026] [security2:error] [pid 26642:tid 26656] [client 130.49.77.226:21321] M ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 09:39:32.003502 2026] [security2:error] [pid 26642:tid 26656] [client 130.49.77.226:21321] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||newtrendmag.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "newtrendmag.org"] [uri "/ntma1160.htm"] [unique_id "auNMlOBvRXGRkDWRb_LPNQAAAIE"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-27 14:35:38
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 10:35:30.667793 2026] [security2:error] [pid 14518:tid 14518] [client 130.49.77.226:38841] M ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 10:35:30.667793 2026] [security2:error] [pid 14518:tid 14518] [client 130.49.77.226:38841] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||colorwize.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "colorwize.com"] [uri "/RESEARCH.htm"] [unique_id "auC2stS-KBjkOJSC6IfQzwAAABo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
SX Communications
2026-09-05 10:04:24
UTC ·
(2 months ago)
HTTP application-layer DoS / botnet traffic from 130.49.77.226: repeated high-cost dynamic page and feed requests (profile/tag views, forums, tracker, RSS) at abusive rates via completed TCP/HTTPS. Likely compromised end-user host.
DDoS Attack
Bad Web Bot
Exploited Host
🇺🇸
kosada.com
2026-05-03 13:31:33
UTC ·
(6 months ago)
Web password guessing
Brute-Force
🇺🇸
NicoID
2026-05-01 00:15:56
UTC ·
(6 months ago)
130.49.77.226 - - [30/Apr/2026:15:43:32 -0600] "GET /wp-login.php HTTP/1.1" 200 4883 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
...
Brute-Force
🇺🇸
kosada.com
2026-04-23 16:44:19
UTC ·
(6 months ago)
Web password guessing
Brute-Force
🇺🇸
kosada.com
2026-04-13 23:37:05
UTC ·
(6 months ago)
Web password guessing
Brute-Force
🇺🇸
TPI-Abuse
2026-04-10 19:33:14
UTC ·
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 10 15:33:08.043362 2026] [security2:error] [pid 2121998:tid 2121998] [client 130.49.77.226:1347 ...
show more
(mod_security) mod_security (id:225170) triggered by 130.49.77.226 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 10 15:33:08.043362 2026] [security2:error] [pid 2121998:tid 2121998] [client 130.49.77.226:13477] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||siczewicz.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "siczewicz.com"] [uri "/wp-json/wp/v2/users"] [unique_id "adlQdOEA9Hvy3cJ88cC8KwAAAAQ"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
