166.1.131.190

(mod_security) mod_security (id:210350) triggered by 166.1.131.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 03:08:41.454899 2026] [security2:error] [pid 21678:tid 21678] [client 166.1.131.190:14071] M ... show more (mod_security) mod_security (id:210350) triggered by 166.1.131.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 15 03:08:41.454899 2026] [security2:error] [pid 21678:tid 21678] [client 166.1.131.190:14071] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.melkanbassil.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.melkanbassil.com"] [uri "/360/mauguio-chateaudescomtes.html"] [unique_id "avloif6zU4KzCxAZTTE82AAAABc"] show less

(mod_security) mod_security (id:210350) triggered by 166.1.131.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:33:55.106186 2026] [security2:error] [pid 30475:tid 30475] [client 166.1.131.190:16537] M ... show more (mod_security) mod_security (id:210350) triggered by 166.1.131.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 12 15:33:55.106186 2026] [security2:error] [pid 30475:tid 30475] [client 166.1.131.190:16537] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||tersch.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "tersch.com"] [uri "/terschproject/lightphotos.html"] [unique_id "avYis7Z-HiMvFtDBOJih8gAAABQ"] show less

(mod_security) mod_security (id:210350) triggered by 166.1.131.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 23:21:41.398437 2026] [security2:error] [pid 18059:tid 18059] [client 166.1.131.190:64451] M ... show more (mod_security) mod_security (id:210350) triggered by 166.1.131.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 23:21:41.398437 2026] [security2:error] [pid 18059:tid 18059] [client 166.1.131.190:64451] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||jerusalem-temple-today.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "jerusalem-temple-today.com"] [uri "/for/viewtopic.php"] [unique_id "avU-1Qkf_kvNUfgUnMZpIQAAACM"] show less

(mod_security) mod_security (id:210350) triggered by 166.1.131.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 16:31:48.731781 2026] [security2:error] [pid 13475:tid 13475] [client 166.1.131.190:59509] M ... show more (mod_security) mod_security (id:210350) triggered by 166.1.131.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 16:31:48.731781 2026] [security2:error] [pid 13475:tid 13475] [client 166.1.131.190:59509] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.3wf.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.3wf.com"] [uri "/news_details/2"] [unique_id "avTexKfetYXeze4AMNt6QgAAABw"] show less

Web App Attack

(mod_security) mod_security (id:210350) triggered by 166.1.131.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 00:12:15.767997 2026] [security2:error] [pid 10332:tid 10347] [client 166.1.131.190:52483] M ... show more (mod_security) mod_security (id:210350) triggered by 166.1.131.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 00:12:15.767997 2026] [security2:error] [pid 10332:tid 10347] [client 166.1.131.190:52483] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.doorways.dk|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.doorways.dk"] [uri "/phpbb/viewtopic.php"] [unique_id "aultL1quVFs-jWAJZfFTmgAAAI0"] show less

(mod_security) mod_security (id:210350) triggered by 166.1.131.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 10:18:48.854337 2026] [security2:error] [pid 30334:tid 30334] [client 166.1.131.190:12955] M ... show more (mod_security) mod_security (id:210350) triggered by 166.1.131.190 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 24 10:18:48.854337 2026] [security2:error] [pid 30334:tid 30334] [client 166.1.131.190:12955] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||lertap5.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "lertap5.com"] [uri "/HTMLHelp/Lrtp59HTML/chemquizintro.htm"] [unique_id "aty-SL0imsIMzISNjkk1RQAAAB0"] show less

Triggered Cloudflare WAF (firewallCustom) from SE. Action taken: BLOCK Protocol: HTTP/2 (POST method) Endpoint: /wp-login.php UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15 T ... show more Triggered Cloudflare WAF (firewallCustom) from SE. Action taken: BLOCK Protocol: HTTP/2 (POST method) Endpoint: /wp-login.php UA: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.0 Safari/605.1.15 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less

This IP was involved in an brute force and password spray attack on 2025/03/30 08:05:46

This IP was involved in an brute force and password spray attack on 2025/03/28 08:12:58

Unauthorized VPN login attempts: 1 attempts were recorded from 166.1.131.190 2025-02-05T16:29:37+01:00 vpn Access-Reject 'wall' station: 166.1.131.190 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'

Incoming TCP Connection from 166.1.131.190 to port: 1433. Honeypot was triggered at 3/6/2024 08:58:00 PM.