146.19.44.84

Fail2Ban ct101 Jail: tomcat-honeypot | Evidence: 146.19.44.84 172.68.151.139 - - [08/Nov/2026:22:18:56 -0300] "GET /wp-admin/ HTTP/1.1" 404 18149

Fail2Ban ct101 Jail: tomcat-honeypot | Evidence: 146.19.44.84 172.68.151.139 - - [08/Nov/2026:22:18:56 -0300] "GET /wp-admin/ HTTP/1.1" 404 18149

(mod_security) mod_security (id:210350) triggered by 146.19.44.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 10:01:23.861052 2026] [security2:error] [pid 16288:tid 16288] [client 146.19.44.84:48325] Mod ... show more (mod_security) mod_security (id:210350) triggered by 146.19.44.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 10:01:23.861052 2026] [security2:error] [pid 16288:tid 16288] [client 146.19.44.84:48325] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/tag/domestic-science/"] [unique_id "auNRs-8fqqrgDRvgUtq0lAAAAAE"] show less

(mod_security) mod_security (id:210350) triggered by 146.19.44.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 21:18:54.425126 2026] [security2:error] [pid 10046:tid 10046] [client 146.19.44.84:36305] Mod ... show more (mod_security) mod_security (id:210350) triggered by 146.19.44.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 21:18:54.425126 2026] [security2:error] [pid 10046:tid 10046] [client 146.19.44.84:36305] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.mtbpv.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.mtbpv.org"] [uri "/"] [unique_id "at_7_oD1LMT-A4pWflSZHQAAAAs"] show less

Not following 301 redirects — wasted requests | method: HEAD | path: / | ua: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36

(mod_security) mod_security (id:210350) triggered by 146.19.44.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:39:34.201191 2026] [security2:error] [pid 7246:tid 7246] [client 146.19.44.84:43267] ModSe ... show more (mod_security) mod_security (id:210350) triggered by 146.19.44.84 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 15 09:39:34.201191 2026] [security2:error] [pid 7246:tid 7246] [client 146.19.44.84:43267] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||faithlines.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "faithlines.com"] [uri "/the-order-of-rights-a-sacred-value/"] [unique_id "atDXlqjf2q01F51sFDnNZgAAACc"] show less

Aggressive web scan

Triggered Cloudflare WAF (firewallCustom) from FR. Action taken: BLOCK Protocol: HTTP/2 (POST method) Endpoint: /wp-login.php UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 This re ... show more Triggered Cloudflare WAF (firewallCustom) from FR. Action taken: BLOCK Protocol: HTTP/2 (POST method) Endpoint: /wp-login.php UA: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/124.0.0.0 Safari/537.36 This report was generated by: https://github.com/sefinek/Cloudflare-WAF-To-AbuseIPDB show less

http-bad-user-agent - IP: 146.19.44.84 - time="2026-04-29T14:02:55+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-bad-user-agent by ip 146.19.44.84 (US/59651) : 4h ban on Ip 146.19.44.84" module ... show more http-bad-user-agent - IP: 146.19.44.84 - time="2026-04-29T14:02:55+02:00" level=info msg="(555f66b4f6a74558bc11e3f93469658es8App0Mcc0TKEeje/crowdsec) crowdsecurity/http-bad-user-agent by ip 146.19.44.84 (US/59651) : 4h ban on Ip 146.19.44.84" module=db show less

wordpress-trap

Attempts against non-existent wordpress site

Incoming Layer 7 Flood Detected

Unauthorized VPN login attempts: 1 attempts were recorded from 146.19.44.84 2025-05-27T05:44:32+02:00 vpn Access-Reject 'cali' station: 146.19.44.84 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'

Unauthorized VPN login attempts: 1 attempts were recorded from 146.19.44.84 2025-05-26T10:41:35+02:00 vpn Access-Reject 'acoelomates' station: 146.19.44.84 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redac ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 146.19.44.84 2025-05-26T10:41:35+02:00 vpn Access-Reject 'acoelomates' station: 146.19.44.84 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less

This IP was involved in an brute force and password spray attack on 2025/03/31 09:11:02