162.252.53.209

(mod_security) mod_security (id:210350) triggered by 162.252.53.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 10:51:03.017512 2026] [security2:error] [pid 1533341:tid 1533460] [client 162.252.53.209:62 ... show more (mod_security) mod_security (id:210350) triggered by 162.252.53.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 10:51:03.017512 2026] [security2:error] [pid 1533341:tid 1533460] [client 162.252.53.209:62027] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||cheqs.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "cheqs.org"] [uri "/About-Council-of-Higher-Education-Quality-Standards.html"] [unique_id "avHr5_rU1lE3MDFu5eCLYQAAAQc"] show less

(mod_security) mod_security (id:210350) triggered by 162.252.53.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 07:24:25.963895 2026] [security2:error] [pid 11871:tid 11871] [client 162.252.53.209:63841] ... show more (mod_security) mod_security (id:210350) triggered by 162.252.53.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 07:24:25.963895 2026] [security2:error] [pid 11871:tid 11871] [client 162.252.53.209:63841] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.creartest.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.creartest.com"] [uri "/hacertests-137381-Cuanto_sabes_de_VEGETTA777.php"] [unique_id "avBp-Sq4bK2yKwaifvQY-QAAAAA"] show less

(mod_security) mod_security (id:210350) triggered by 162.252.53.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 09:55:51.232688 2026] [security2:error] [pid 9918:tid 9918] [client 162.252.53.209:21493] M ... show more (mod_security) mod_security (id:210350) triggered by 162.252.53.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Nov 06 09:55:51.232688 2026] [security2:error] [pid 9918:tid 9918] [client 162.252.53.209:21493] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||passwordresearch.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "passwordresearch.com"] [uri "/stats/statistic37.html"] [unique_id "au3qdzDOX52m4vKspyqJOQAAAAc"] show less

[ti-26al] Web exploit scanning: 1 suspicious requests detected by fail2ban jail apache-scanner. Example: 162.252.53.209 - - [05/Nov/2026:23:25:43 +0100] "GET /.git/objects/info/packs HTTP/1.1" 301 6673 "-" "multi-scanner/5 (public-sources)" ...

(mod_security) mod_security (id:210350) triggered by 162.252.53.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 11:28:12.991788 2026] [security2:error] [pid 8824:tid 8824] [client 162.252.53.209:65343] M ... show more (mod_security) mod_security (id:210350) triggered by 162.252.53.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Oct 29 11:28:12.991788 2026] [security2:error] [pid 8824:tid 8824] [client 162.252.53.209:65343] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.gundiahgazette.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.gundiahgazette.com.au"] [uri "/History-ANZAC.html"] [unique_id "auNmDLZI9uMs95llAz14MAAAACE"] show less

(mod_security) mod_security (id:210350) triggered by 162.252.53.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 14:19:55.913031 2026] [security2:error] [pid 24636:tid 24636] [client 162.252.53.209:46599] ... show more (mod_security) mod_security (id:210350) triggered by 162.252.53.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 23 14:19:55.913031 2026] [security2:error] [pid 24636:tid 24636] [client 162.252.53.209:46599] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.thereisaplaceonearth.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.thereisaplaceonearth.com"] [uri "/explore/in-the-spotlight/"] [unique_id "atulSz0-mDXa488-EyvmUAAAABI"] show less

(mod_security) mod_security (id:210350) triggered by 162.252.53.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:41:19.008754 2026] [security2:error] [pid 8320:tid 8320] [client 162.252.53.209:49377] M ... show more (mod_security) mod_security (id:210350) triggered by 162.252.53.209 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:41:19.008754 2026] [security2:error] [pid 8320:tid 8320] [client 162.252.53.209:49377] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||davidnevue.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "davidnevue.com"] [uri "/albums/christmas.htm"] [unique_id "atkjb_9wj91F_6SKF93kRgAAABU"] show less

repeated unauthorized VPN login attempt, user sweep

Unauthorized VPN login attempts: 6 attempts were recorded from 162.252.53.209 2026-09-09T15:28:27+02:00 vpn Access-Reject 'forti_admin_66' station: 162.252.53.209 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: ... show more Unauthorized VPN login attempts: 6 attempts were recorded from 162.252.53.209 2026-09-09T15:28:27+02:00 vpn Access-Reject 'forti_admin_66' station: 162.252.53.209 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' 2026-09-09T15:29:49+02:00 vpn Access-Reject 'it' station: 162.252.53.209 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' 2026-09-09T15:31:09+02:00 vpn Access-Reject 'fanny' station: 162.252.53.209 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' 2026-09-09T15:32:30+02:00 vpn Access-Reject 'hawa' station: 162.252.53.209 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' 2026-09-09T15:33:50+02:00 vpn Access-Reject 'faradilah' station: 162.252.53.209 auth-type: - realm: vse.cz nas: show less