🇺🇸
TPI-Abuse
2026-11-08 19:51:11
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 146.19.140.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:51:06.452644 2026] [security2:error] [pid 32028:tid 32028] [client 146.19.140.229:17079] ...
show more
(mod_security) mod_security (id:210350) triggered by 146.19.140.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 14:51:06.452644 2026] [security2:error] [pid 32028:tid 32028] [client 146.19.140.229:17079] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.stlrosesociety.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.stlrosesociety.org"] [uri "/Growing Roses in STL.htm"] [unique_id "avDSqtmVgmEDl5H4Da97lAAAABQ"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-08 00:51:38
UTC ·
(2 days ago)
(mod_security) mod_security (id:210350) triggered by 146.19.140.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 19:51:35.056550 2026] [security2:error] [pid 29135:tid 29135] [client 146.19.140.229:47433] ...
show more
(mod_security) mod_security (id:210350) triggered by 146.19.140.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Nov 07 19:51:35.056550 2026] [security2:error] [pid 29135:tid 29135] [client 146.19.140.229:47433] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.partybuseslansing.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.partybuseslansing.com"] [uri "/pricing-policy.html"] [unique_id "au_Hl_AiLpEpB-eV7Kk4nwAAAAw"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
Sklurk
2026-11-08 00:23:47
UTC ·
(2 days ago)
Web App Attack
Web App Attack
🇺🇸
TPI-Abuse
2026-10-28 19:15:57
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 146.19.140.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:15:51.167245 2026] [security2:error] [pid 7527:tid 7527] [client 146.19.140.229:20589] M ...
show more
(mod_security) mod_security (id:210350) triggered by 146.19.140.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 15:15:51.167245 2026] [security2:error] [pid 7527:tid 7527] [client 146.19.140.229:20589] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||canadianprimarysources.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "canadianprimarysources.org"] [uri "/historicalmethod.htm"] [unique_id "auJJ5xvP0e5tY7u_s1qUIQAAAAI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇫🇷
claude CALVET
2026-08-26 13:09:03
UTC ·
(2 months ago)
gee-Joomla Admin : try to force the door...
Hacking
🇳🇱
homeshowdomain.nl
2026-06-08 22:00:45
UTC ·
(5 months ago)
Auto-ban: single probe for restricted files (.env / backups / admin endpoints). Likely mass-scan on 2026-06-07.
Web App Attack
SSH
Hacking
🇮🇩
hermawan
2026-06-04 08:00:18
UTC ·
(5 months ago)
06/04/2026-15:00:15.108908 [Drop] [**] [1:3300183:6] Suricata 🐾 - 🚨 Network 🕵 scan 🎩 Nuclei 👨💻 [**] [Classification: Potential Corporate Privacy Violation] [Priority: 1] {TCP} 146.19.140.229:9937 -> 103.166.156.58:443
...
Email Spam
Hacking
🇮🇩
Burayot
2025-08-19 21:49:51
UTC ·
(1 year ago)
LF_MODSEC: (mod_security) mod_security (id:1000001) triggered by 146.19.140.229 (GB/United Kingdom/-): 1 in the last 3600 secs
Web App Attack
2025-07-31 00:09:39
UTC ·
(1 year ago)
Unauthorized connection attempt
Port Scan
Hacking
Exploited Host
2025-05-17 20:07:30
UTC ·
(1 year ago)
Ports: 80,443; Direction: 0; Trigger: LF_CUSTOMTRIGGER
Brute-Force
SSH
2024-10-12 10:15:38
UTC ·
(2 years ago)
apache-wordpress-login
Brute-Force
Web App Attack
🇫🇮
JimArchon72
2024-10-06 00:00:04
UTC ·
(2 years ago)
2024/10/05 23:59:24 "GET /wp-login.php HTTP/1.1"
Web App Attack
🇺🇸
TheMadBeaker
2024-08-05 00:33:22
UTC ·
(2 years ago)
Fail2Ban Ban Triggered
HTTP SQL Injection Attempt
Hacking
SQL Injection
🇪🇸
10dencehispahard SL
2024-05-03 03:03:34
UTC ·
(2 years ago)
Unauthorized login attempts [ accesslogs]
Brute-Force
🇯🇵
HeliJP
2022-09-29 11:19:39
UTC ·
(4 years ago)
2022-09-29 11:05:56 - Recognized attacks\bad behavior from IP address 146.19.140.229 on port 443\80 (12 daily hits): Remote Command Execution: Wildcard bypass technique attempt, PHP Injection Attack: High-Risk PHP Function Call Found, SQL Injection A ...
show more
2022-09-29 11:05:56 - Recognized attacks\bad behavior from IP address 146.19.140.229 on port 443\80 (12 daily hits): Remote Command Execution: Wildcard bypass technique attempt, PHP Injection Attack: High-Risk PHP Function Call Found, SQL Injection Attack Detected via libinjection, SQL Injection Attack: SQL Operator Detected, SQL Injection Attack: SQL Tautology Detected, SQL Injection Attack, Detects MySQL comments, conditions and ch(a)r injections, Detects classic SQL injection probings 2/3, Restricted SQL Character Anomaly Detection (args): # of special characters exceeded (12), SQL Comment Sequence Detected
show less
Hacking
SQL Injection
Web App Attack
