🇺🇸
TPI-Abuse
2026-10-27 18:13:57
(23 hours ago)
(mod_security) mod_security (id:210350) triggered by 130.49.8.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 14:13:52.623796 2026] [security2:error] [pid 8062:tid 8062] [client 130.49.8.13:32215] ModSecu ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.8.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Oct 27 14:13:52.623796 2026] [security2:error] [pid 8062:tid 8062] [client 130.49.8.13:32215] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||mdgcontrols.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "mdgcontrols.com"] [uri "/AC-VFD-Safe-Torque-Off--STO-.php"] [unique_id "auDp4GwHjlpocTk06X3rmgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-21 13:28:51
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 130.49.8.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 09:28:43.859120 2026] [security2:error] [pid 30164:tid 30225] [client 130.49.8.13:30951] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.8.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 09:28:43.859120 2026] [security2:error] [pid 30164:tid 30225] [client 130.49.8.13:30951] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.chelseyrae.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.chelseyrae.com"] [uri "/category/blondes-can-cook-too/page/2/"] [unique_id "ati-C0rgiutHDuFjTU2ONgAAAFQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇮
bittiguru.fi
2026-09-22 18:38:32
(1 month ago)
130.49.8.13 - [22/Sep/2026:21:37:42 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" "4.66"
130.49.8.13 - [22/Sep/2026:21:38:31 +0 ...
show more
130.49.8.13 - [22/Sep/2026:21:37:42 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" "4.66"
130.49.8.13 - [22/Sep/2026:21:38:31 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12529 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" "4.66"
...
show less
Hacking
Brute-Force
Web App Attack
🇫🇮
bittiguru.fi
2026-09-21 08:14:38
(1 month ago)
130.49.8.13 - [21/Sep/2026:11:13:48 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" "4.66"
130.49.8.13 - [21/Sep/2026:11:14:37 +0300] "POST /xmlrpc.php HTTP/2.0" 404 ...
show more
130.49.8.13 - [21/Sep/2026:11:13:48 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0" "4.66"
130.49.8.13 - [21/Sep/2026:11:14:37 +0300] "POST /xmlrpc.php HTTP/2.0" 404 12528 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15" "4.66"
...
show less
Hacking
Brute-Force
Web App Attack
🇩🇪
4server
2026-09-01 18:34:29
(1 month ago)
[TueSep0120:34:27.2219202026][security2:error][pid347158:tid347284][client130.49.8.13:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\|wget\|python\|nikto\|sqlmap\|acunetix\|fimap\|dirbuster\|cmsmap\)\"atREQUEST_HEADERS:Us ...
show more
[TueSep0120:34:27.2219202026][security2:error][pid347158:tid347284][client130.49.8.13:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\|wget\|python\|nikto\|sqlmap\|acunetix\|fimap\|dirbuster\|cmsmap\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"217\"][id\"990210\"][msg\"Suspicioususer-agentblocked\"][hostname\"prstartup.ch\"][uri\"/\"][unique_id\"apcas9f2_v_kFCtl8cjcxAAAAQg\"]
show less
Port Scan
Brute-Force
Web App Attack
🇪🇸
librebit
2026-06-24 00:54:59
(4 months ago)
Brute force
Brute-Force
🇪🇸
librebit
2026-06-17 04:07:16
(4 months ago)
Brute force
Brute-Force
🇮🇹
VHosting
2026-03-26 20:15:25
(7 months ago)
Detected attack and reported by a human
Brute-Force
Web App Attack
SSH
DDoS Attack
Exploited Host
Bad Web Bot
🇺🇸
TPI-Abuse
2025-11-15 17:07:00
(11 months ago)
(mod_security) mod_security (id:210350) triggered by 130.49.8.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 15 12:06:54.879711 2025] [security2:error] [pid 31833:tid 31833] [client 130.49.8.13:21721] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.8.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 15 12:06:54.879711 2025] [security2:error] [pid 31833:tid 31833] [client 130.49.8.13:21721] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||realtorpaul.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "realtorpaul.com"] [uri "/"] [unique_id "aRizLh9pq8XIOXuOGEtRRwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2025-11-12 06:03:26
(11 months ago)
(mod_security) mod_security (id:210350) triggered by 130.49.8.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 12 01:03:19.464878 2025] [security2:error] [pid 18827:tid 18827] [client 130.49.8.13:16053] ModSe ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.8.13 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 12 01:03:19.464878 2025] [security2:error] [pid 18827:tid 18827] [client 130.49.8.13:16053] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||seese.us|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "seese.us"] [uri "/"] [unique_id "aRQjJ_D6_OgH8hTTBGbV1AAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
