122.8.46.17

(mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 06:46:29.227062 2026] [security2:error] [pid 21666:tid 21666] [client 122.8.46.17:64673] ModSe ... show more (mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 13 06:46:29.227062 2026] [security2:error] [pid 21666:tid 21666] [client 122.8.46.17:64673] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.accordionfactory.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.accordionfactory.com"] [uri "/ProductDetail/tabid/371/rvdsfpid/rossetti-60-bass-model-737/rvdsfcatid/accordions-1/Default.aspx"] [unique_id "avb4ldG0en1LA31gNlJ4NQAAAAg"] show less

(mod_security) mod_security (id:211180) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 14:31:11.916282 2026] [security2:error] [pid 3212:tid 3212] [client 122.8.46.17:44271] ModSecu ... show more (mod_security) mod_security (id:211180) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Nov 11 14:31:11.916282 2026] [security2:error] [pid 3212:tid 3212] [client 122.8.46.17:44271] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "50"] [id "211180"] [rev "3"] [msg "COMODO WAF: Session Fixation: SessionID Parameter Name with No Referer||needsmoresubs.com|F|2"] [data "Matched Data: phpsessid found within REQUEST_HEADERS: 0"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "needsmoresubs.com"] [uri "/23NMSForum/index.php/topic,456.msg694.html"] [unique_id "avTCf2odqTTeF04v3cUeuQAAAA8"] show less

(mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 20:21:19.954455 2026] [security2:error] [pid 20383:tid 20383] [client 122.8.46.17:42427] ModSe ... show more (mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 20:21:19.954455 2026] [security2:error] [pid 20383:tid 20383] [client 122.8.46.17:42427] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/2014/11/15/burkina-faso-army-preps-to-hand-back-control-to-civilians/"] [unique_id "avJxj6Im8-iueOEMuet-gQAAAAE"] show less

(mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 02:34:06.619398 2026] [security2:error] [pid 11150:tid 11150] [client 122.8.46.17:9305] ModSec ... show more (mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 02:34:06.619398 2026] [security2:error] [pid 11150:tid 11150] [client 122.8.46.17:9305] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||johnhansonmemorial.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "johnhansonmemorial.org"] [uri "/the-john-hanson-national-memorial.html"] [unique_id "avF3buoiV_Tpz0bPXA0nuAAAABE"] show less

(mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 00:15:46.033989 2026] [security2:error] [pid 2399:tid 2399] [client 122.8.46.17:41981] ModSecu ... show more (mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 00:15:46.033989 2026] [security2:error] [pid 2399:tid 2399] [client 122.8.46.17:41981] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||michaelkivisto.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "michaelkivisto.com"] [uri "/2018/04/23/seize-the-moment/"] [unique_id "avFXAu7zlrxvTeiJyemHHAAAABQ"] show less

Web App Attack

Web App Attack

(mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 05:14:16.158990 2026] [security2:error] [pid 24209:tid 24209] [client 122.8.46.17:10877] ModSe ... show more (mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Nov 03 05:14:16.158990 2026] [security2:error] [pid 24209:tid 24209] [client 122.8.46.17:10877] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||tobyjohnson.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "tobyjohnson.com"] [uri "/review-Kenneth-Low-Dark-Knowledge.html"] [unique_id "aumz-FD8lMhm7UV_Hq9BVgAAABM"] show less

(mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 03:04:04.477625 2026] [security2:error] [pid 20787:tid 20787] [client 122.8.46.17:45369] ModSe ... show more (mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Oct 31 03:04:04.477625 2026] [security2:error] [pid 20787:tid 20787] [client 122.8.46.17:45369] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||glslightingandcontrols.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "glslightingandcontrols.com"] [uri "/privacy-policy.html"] [unique_id "auWS5JqMBXhehnwt8Bme_gAAAAM"] show less

(mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 07:19:39.157147 2026] [security2:error] [pid 25772:tid 25772] [client 122.8.46.17:62223] ModSe ... show more (mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 07:19:39.157147 2026] [security2:error] [pid 25772:tid 25772] [client 122.8.46.17:62223] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||persnicketyinc.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "persnicketyinc.com"] [uri "/tag/abbreviation-on-wedding-invitations/"] [unique_id "auR9S7QQJamDp-fYvox61gAAAA0"] show less

(mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 04:31:14.543334 2026] [security2:error] [pid 659:tid 659] [client 122.8.46.17:53907] ModSecuri ... show more (mod_security) mod_security (id:210350) triggered by 122.8.46.17 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 30 04:31:14.543334 2026] [security2:error] [pid 659:tid 659] [client 122.8.46.17:53907] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.fgrotary.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.fgrotary.org"] [uri "/rotary-rewind/rotary-rewind-oct-9-2019/"] [unique_id "auRV0iNZyPrY7zt3Lf74pQAAAA8"] show less

repeated unauthorized VPN login attempt, user sweep

repeated unauthorized VPN login attempt, user sweep

Fail2Ban detected brute-force attempt on Cisco Anyconnect

Unauthorized VPN login attempts: 1 attempts were recorded from 122.8.46.17 2026-09-12T01:47:52+02:00 vpn Access-Reject 'export2' station: 122.8.46.17 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'