🇺🇸
TPI-Abuse
2026-11-11 17:58:30
UTC ·
(10 hours ago)
(mod_security) mod_security (id:210350) triggered by 157.22.100.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 12:58:25.114116 2026] [security2:error] [pid 6051:tid 6051] [client 157.22.100.246:45819] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.100.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 12:58:25.114116 2026] [security2:error] [pid 6051:tid 6051] [client 157.22.100.246:45819] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||n3fjp.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "n3fjp.com"] [uri "/giftcertificate.html"] [unique_id "avSswRKb1_8w--MSFyLXkQAAAAU"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-11 08:02:24
UTC ·
(20 hours ago)
(mod_security) mod_security (id:210350) triggered by 157.22.100.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 03:02:19.332339 2026] [security2:error] [pid 2710307:tid 2710366] [client 157.22.100.246:30 ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.100.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 03:02:19.332339 2026] [security2:error] [pid 2710307:tid 2710366] [client 157.22.100.246:30485] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.pflagabq.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.pflagabq.org"] [uri "/give.html"] [unique_id "avQhC_QaleLN5y18kWk48AAAAFg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 12:49:30
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 157.22.100.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 07:49:25.332570 2026] [security2:error] [pid 3312372:tid 3312381] [client 157.22.100.246:30 ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.100.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 07:49:25.332570 2026] [security2:error] [pid 3312372:tid 3312381] [client 157.22.100.246:30079] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.financialcertified.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.financialcertified.com"] [uri "/about.html"] [unique_id "aunYVbSsFb43RQyUgxrmogAAAUM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-11-03 02:18:37
UTC ·
(1 week ago)
(mod_security) mod_security (id:210350) triggered by 157.22.100.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 21:18:28.642588 2026] [security2:error] [pid 9999:tid 9999] [client 157.22.100.246:45061] M ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.100.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 02 21:18:28.642588 2026] [security2:error] [pid 9999:tid 9999] [client 157.22.100.246:45061] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.homebuilt.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.homebuilt.org"] [uri "/aircraft/rutan.html"] [unique_id "aulEdAnSxjElpUS51Ck9MwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-10-26 11:28:46
UTC ·
(2 weeks ago)
(mod_security) mod_security (id:210350) triggered by 157.22.100.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 07:28:43.026094 2026] [security2:error] [pid 16626:tid 16626] [client 157.22.100.246:38043] ...
show more
(mod_security) mod_security (id:210350) triggered by 157.22.100.246 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Oct 26 07:28:43.026094 2026] [security2:error] [pid 16626:tid 16626] [client 157.22.100.246:38043] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.byles.net|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.byles.net"] [uri "/ink-review/2016-8-2-ink-review-kobe-38-kitanozoka-night-blue/"] [unique_id "at85a1h09ssx1YMTYUpi_QAAABI"]
show less
Brute-Force
Bad Web Bot
Web App Attack
2026-10-18 19:10:59
UTC ·
(3 weeks ago)
IP matched detection query 20 more in short time bad rqs.
Brute-Force
Web App Attack
Hacking
🇨🇿
lp
2026-09-14 00:21:25
UTC ·
(1 month ago)
Unauthorized VPN login attempts: 1 attempts were recorded from 157.22.100.246
2026-09-14T02:11:39+02:00 vpn Access-Reject '[email protected] ' station: 157.22.100.246 auth-type: - realm: DEFAULT nas: <redacted> called: <redacted> => address-pool: - ...
show more
Unauthorized VPN login attempts: 1 attempts were recorded from 157.22.100.246
2026-09-14T02:11:39+02:00 vpn Access-Reject '[email protected] ' station: 157.22.100.246 auth-type: - realm: DEFAULT nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'
show less
Brute-Force
Web App Attack
🇨🇿
Countryman
2026-09-13 00:10:01
UTC ·
(1 month ago)
repeated unauthorized VPN login attempt, user sweep
VPN IP
Hacking
Brute-Force
🇸🇪
OnTheEdge
2026-09-08 11:54:52
UTC ·
(2 months ago)
Password spraying. Multiple unauthorized login attempts
Hacking
Web App Attack
🇨🇭
backslash
2026-08-17 10:42:05
UTC ·
(2 months ago)
block ruleset 51D5331ECDCF70C2C6410C0D0EEB5F69B17B5F56
Bad Web Bot
🇹🇷
neron
2026-08-15 05:06:48
UTC ·
(2 months ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇹🇷
neron
2026-08-04 06:29:43
UTC ·
(3 months ago)
CrowdSec blocked: http:scan detected via OPNsense firewall
Hacking
Web App Attack
🇩🇪
4server
2026-05-21 07:30:05
UTC ·
(5 months ago)
[ThuMay2109:29:58.0231972026][security2:error][pid1568754:tid1568861][client157.22.100.246:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949- ...
show more
[ThuMay2109:29:58.0231972026][security2:error][pid1568754:tid1568861][client157.22.100.246:0]ModSecurity:Accessdeniedwithcode403\(phase2\).OperatorGEmatched5atTX:anomaly_score.[file\"/etc/apache2/conf.d/modsec_vendor_configs/OWASP3/rules/REQUEST-949-BLOCKING-EVALUATION.conf\"][line\"94\"][id\"949110\"][msg\"InboundAnomalyScoreExceeded\(TotalScore:5\)\"][severity\"CRITICAL\"][ver\"OWASP_CRS/3.3.9\"][tag\"application-multi\"][tag\"language-multi\"][tag\"platform-multi\"][tag\"attack-generic\"][hostname\"www.artisteer-italia.org\"][uri\"/\"][unique_id\"ag60dnD31TKWBqIyrN7CUgAAANM\"]
show less
Port Scan
Brute-Force
Web App Attack
