🇺🇸
TPI-Abuse
2026-10-23 10:36:12
(7 hours ago)
(mod_security) mod_security (id:210350) triggered by 130.49.9.250 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210350) triggered by 130.49.9.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 06:36:07.680584 2026] [security2:error] [pid 21892:tid 21892] [client 130.49.9.250:31187] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||anatolyaleksin.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "anatolyaleksin.com"] [uri "/ta.htm"] [unique_id "ats4l2HUjdwGEXRD6MS0wgAAAAo"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
IndigoRidge
2026-07-30 21:55:47
(2 months ago)
130.49.9.250 - - [30/Jul/2026:17:55:34 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5092 "-" "Apache-HttpC ...
show more
130.49.9.250 - - [30/Jul/2026:17:55:34 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5092 "-" "Apache-HttpClient/4.5.13 (Java/11.0.31)"
130.49.9.250 - - [30/Jul/2026:17:55:37 -0400] "POST /xmlrpc.php HTTP/1.0" 200 5092 "-" "Apache-HttpClient/4.5.13 (Java/11.0.31)"
130.49.9.250 - - [30/Jul/2026:17:55:40 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5771 "-" "Apache-HttpClient/4.5.13 (Java/11.0.31)"
130.49.9.250 - - [30/Jul/2026:17:55:41 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5771 "-" "Apache-HttpClient/4.5.13 (Java/11.0.31)"
130.49.9.250 - - [30/Jul/2026:17:55:45 -0400] "POST /xmlrpc.php HTTP/1.0" 403 5771 "-" "Apache-HttpClient/4.5.13 (Java/11.0.31)"
...
show less
Web App Attack
🇨🇦
DRI
2026-07-19 20:24:14
(3 months ago)
Web attack/Malicious activity detected
Web App Attack
🇺🇸
ambor
2026-07-19 03:25:30
(3 months ago)
Honeypot access: WordPress admin access attempt. Path: /wp-login.php
Brute-Force
Web App Attack
🇺🇸
TPI-Abuse
2026-07-14 11:59:41
(3 months ago)
(mod_security) mod_security (id:225170) triggered by 130.49.9.250 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 130.49.9.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Jul 14 07:59:37.383942 2026] [security2:error] [pid 27327:tid 27327] [client 130.49.9.250:49515] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||joesteiner.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "joesteiner.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alYkqRe7F-pzZ0CtpoWZTAAAAB0"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
NicoID
2026-05-02 00:14:34
(5 months ago)
130.49.9.250 - - [01/May/2026:12:15:52 -0600] "GET /wp-login.php HTTP/1.1" 200 4884 "https://www.goo ...
show more
130.49.9.250 - - [01/May/2026:12:15:52 -0600] "GET /wp-login.php HTTP/1.1" 200 4884 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36"
...
show less
Brute-Force
🇺🇸
TPI-Abuse
2026-04-24 19:22:43
(5 months ago)
(mod_security) mod_security (id:225170) triggered by 130.49.9.250 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 130.49.9.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Apr 24 15:22:37.142599 2026] [security2:error] [pid 906569:tid 906569] [client 130.49.9.250:44023] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||garyoneal.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "garyoneal.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aevC_eFeqsaePPNw62P6vAAAABM"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-04-23 10:23:47
(6 months ago)
FPROCO WEBEXPLOIT 130.49.9.250 (130.49.9.250)
Web App Attack
🇺🇸
TPI-Abuse
2026-04-18 05:51:02
(6 months ago)
(mod_security) mod_security (id:210492) triggered by 130.49.9.250 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:210492) triggered by 130.49.9.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Apr 18 01:50:34.028122 2026] [security2:error] [pid 1322507:tid 1322507] [client 130.49.9.250:54803] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.evolute.io"] [uri "/wp-config.php.old"] [unique_id "aeMbqpjSa6m_iC4-LIwnnwAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-25 18:19:22
(6 months ago)
(mod_security) mod_security (id:225170) triggered by 130.49.9.250 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 130.49.9.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Mar 25 14:19:15.458056 2026] [security2:error] [pid 1633:tid 1672] [client 130.49.9.250:55617] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||maxpowered.jp|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "maxpowered.jp"] [uri "/wp-json/wp/v2/users"] [unique_id "acQnIzg-hKFYJhbBX8khEQAAAMw"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-03-21 08:51:01
(7 months ago)
(mod_security) mod_security (id:225170) triggered by 130.49.9.250 (-): 1 in the last 300 secs; Ports ...
show more
(mod_security) mod_security (id:225170) triggered by 130.49.9.250 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Mar 21 04:50:55.017161 2026] [security2:error] [pid 9297:tid 9297] [client 130.49.9.250:41725] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||thestardance.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "thestardance.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ab5b7zwM49qAwiV6vfqWBQAAAAg"], referer: https://www.google.com
show less
Brute-Force
Bad Web Bot
Web App Attack
🇨🇭
backslash
2026-03-20 21:36:00
(7 months ago)
block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8
Bad Web Bot