167.253.17.75

(mod_security) mod_security (id:210350) triggered by 167.253.17.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 10:07:30.085134 2026] [security2:error] [pid 23904:tid 23904] [client 167.253.17.75:40769] M ... show more (mod_security) mod_security (id:210350) triggered by 167.253.17.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 10:07:30.085134 2026] [security2:error] [pid 23904:tid 23904] [client 167.253.17.75:40769] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||blog.l3l4.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "blog.l3l4.com"] [uri "/iot/automatic-water-pump/"] [unique_id "avCQMubFzpPvkKX0kKTYpAAAAAM"] show less

(mod_security) mod_security (id:210350) triggered by 167.253.17.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:55:40.695937 2026] [security2:error] [pid 9487:tid 9487] [client 167.253.17.75:58147] Mod ... show more (mod_security) mod_security (id:210350) triggered by 167.253.17.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Nov 08 08:55:40.695937 2026] [security2:error] [pid 9487:tid 9487] [client 167.253.17.75:58147] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.universeinternational.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.universeinternational.org"] [uri "/winners/mrsui2024"] [unique_id "avB_XOPoGfeLGB126Dt07QAAAAA"] show less

trolling for resource vulnerabilities

block ruleset 798ECF92F12ADC636D3520C2890AF17ADEFDE3BE

Web App Attack

(mod_security) mod_security (id:210350) triggered by 167.253.17.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:01:16.940387 2026] [security2:error] [pid 10991:tid 10991] [client 167.253.17.75:24817] M ... show more (mod_security) mod_security (id:210350) triggered by 167.253.17.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 16:01:16.940387 2026] [security2:error] [pid 10991:tid 10991] [client 167.253.17.75:24817] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||leveeboard.org|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "leveeboard.org"] [uri "/history9.html"] [unique_id "atkaDBkfWgd35l02GxOGzwAAAAU"] show less

(mod_security) mod_security (id:210350) triggered by 167.253.17.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 03:31:12.087980 2026] [security2:error] [pid 4701:tid 4701] [client 167.253.17.75:19007] Mod ... show more (mod_security) mod_security (id:210350) triggered by 167.253.17.75 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 21 03:31:12.087980 2026] [security2:error] [pid 4701:tid 4701] [client 167.253.17.75:19007] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||christinastoddard.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "christinastoddard.com"] [uri "/poems/noh_theater.html"] [unique_id "athqQLu7bhXV_YeOhAST0QAAAAU"] show less

Web attack/Malicious activity detected

IM360 WAF: Attempt to upload malware

Bad web bot attempting to run wp-json on non-WP site

167.253.17.75 - - [30/Dec/2025:18:17:53 +0000] "GET /wp-login.php HTTP/1.1" 404 47 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" 167.253.17.75 - - [30/Dec/2025:18:17:5 ... show more 167.253.17.75 - - [30/Dec/2025:18:17:53 +0000] "GET /wp-login.php HTTP/1.1" 404 47 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" 167.253.17.75 - - [30/Dec/2025:18:17:55 +0000] "GET /wp-login.php HTTP/1.1" 404 47 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" 167.253.17.75 - - [30/Dec/2025:18:17:56 +0000] "GET /wp-login.php HTTP/1.1" 404 47 "https://www.google.com" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" show less

(From [email protected]) Hi Team, I typed your main service keywords into Google today, and I noticed something frustrating. Your website is professionally designed, but it’s buried on Page 2. Meanwhile, 2 or 3 of your direct compe ... show more (From [email protected]) Hi Team, I typed your main service keywords into Google today, and I noticed something frustrating. Your website is professionally designed, but it’s buried on Page 2. Meanwhile, 2 or 3 of your direct competitors, who frankly have weaker websites than you—are sitting at the top of Page 1. They are effectively "stealing" leads that were looking for you. They aren't better than you; they just have better SEO signals. I’ve already analyzed exactly what they are doing differently. If you want to see the comparison report, just reply "Yes" and I’ll send it over. Cheers, PMP show less

Unauthorized VPN login attempts: 1 attempts were recorded from 167.253.17.75 2025-09-09T12:40:53+02:00 vpn Access-Reject 'vpn' station: 167.253.17.75 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'

Unauthorized VPN login attempts: 1 attempts were recorded from 167.253.17.75 2025-09-03T09:14:12+02:00 vpn Access-Reject 'test' station: 167.253.17.75 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'

Unauthorized VPN login attempts: 1 attempts were recorded from 167.253.17.75 2025-08-28T09:06:12+02:00 vpn Access-Reject 'testuser' station: 167.253.17.75 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redact ... show more Unauthorized VPN login attempts: 1 attempts were recorded from 167.253.17.75 2025-08-28T09:06:12+02:00 vpn Access-Reject 'testuser' station: 167.253.17.75 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>' show less