213.108.0.99

(mod_security) mod_security (id:210350) triggered by 213.108.0.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 08:40:01.533616 2026] [security2:error] [pid 27441:tid 27441] [client 213.108.0.99:34375] Mod ... show more (mod_security) mod_security (id:210350) triggered by 213.108.0.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Nov 09 08:40:01.533616 2026] [security2:error] [pid 27441:tid 27441] [client 213.108.0.99:34375] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||vitality-web.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "vitality-web.com"] [uri "/Stressless-Chair/Stressless-View-Signature-Paloma-Tomato-Red-Leather-Recliner-Chair.htm"] [unique_id "avHNMb3Ww1InrW9pR8gLIQAAAAU"] show less

(mod_security) mod_security (id:210350) triggered by 213.108.0.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:09:48.490481 2026] [security2:error] [pid 9665:tid 9665] [client 213.108.0.99:38401] ModSe ... show more (mod_security) mod_security (id:210350) triggered by 213.108.0.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu Nov 05 01:09:48.490481 2026] [security2:error] [pid 9665:tid 9665] [client 213.108.0.99:38401] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||arsenalfordemocracy.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "arsenalfordemocracy.com"] [uri "/wp-json/wp/v2/posts/9301"] [unique_id "auwdrLzIYjMgo4gWe2YjsgAAAAQ"] show less

(mod_security) mod_security (id:210350) triggered by 213.108.0.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 13:57:54.353774 2026] [security2:error] [pid 5419:tid 5419] [client 213.108.0.99:37277] ModSe ... show more (mod_security) mod_security (id:210350) triggered by 213.108.0.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Wed Oct 28 13:57:54.353774 2026] [security2:error] [pid 5419:tid 5419] [client 213.108.0.99:37277] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||agenesis7.com|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "agenesis7.com"] [uri "/Products/Test/TstPtf9902.htm"] [unique_id "auI3osw05B0OmJYVDKYN7wAAAAg"] show less

(mod_security) mod_security (id:225170) triggered by 213.108.0.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 13:10:11.356192 2026] [security2:error] [pid 4082762:tid 4082762] [client 213.108.0.99:19303] ... show more (mod_security) mod_security (id:225170) triggered by 213.108.0.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Jul 27 13:10:11.356192 2026] [security2:error] [pid 4082762:tid 4082762] [client 213.108.0.99:19303] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||closedfortheseason.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "closedfortheseason.com"] [uri "/wp-json/wp/v2/users"] [unique_id "ameQ8818VVz4EtWlNBnDUAAAAAs"], referer: https://www.google.com show less

Web attack/Malicious activity detected

Web attack/Malicious activity detected

block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8

(mod_security) mod_security (id:225170) triggered by 213.108.0.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 17:39:42.830112 2026] [security2:error] [pid 17450:tid 17450] [client 213.108.0.99:49755] Mod ... show more (mod_security) mod_security (id:225170) triggered by 213.108.0.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 11 17:39:42.830112 2026] [security2:error] [pid 17450:tid 17450] [client 213.108.0.99:49755] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||vigants.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "vigants.com"] [uri "/wp-json/wp/v2/users"] [unique_id "alK4Ho1x60aE-ozHQppf_AAAACA"], referer: https://www.google.com show less

Failed Wordpress login using wp-login.php

(mod_security) mod_security (id:225170) triggered by 213.108.0.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 03 11:31:32.332226 2025] [security2:error] [pid 26902:tid 26902] [client 213.108.0.99:13315] Mod ... show more (mod_security) mod_security (id:225170) triggered by 213.108.0.99 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri Oct 03 11:31:32.332226 2025] [security2:error] [pid 26902:tid 26902] [client 213.108.0.99:13315] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||admin.turedinmobiliaria.com|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "admin.turedinmobiliaria.com"] [uri "/wp-json/wp/v2/users"] [unique_id "aN_sVL6OtCg-iqYf27e7hwAAAAc"], referer: https://www.google.com show less

Detected attack by Imunify360

“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to log ... show more “BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user” show less

“BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to log ... show more “BruteForce attack on SSL VPN. Appears to be addresses coming from US Datacenters. Most all tried users are invalid and random.Most Tried Users are Guest and Admin. n type=event subtype=vpn level=alert action=ssl-login-fail msg=SSL user failed to logged in logdesc=SSL VPN login fail user=datadevscan02 group=N/A tunnelid=0 tunneltype=ssl-web dst_host=N/A reason=sslvpn_login_unknown_user “ show less

block ruleset bad bot: wordpress scans 82C095539D4FDAF84E2E2FD6B6FC0664645851A8

Unauthorized VPN login attempts: 1 attempts were recorded from 213.108.0.99 2025-03-19T13:11:16+01:00 vpn Access-Reject 'markp' station: 213.108.0.99 auth-type: - realm: vse.cz nas: <redacted> called: <redacted> => address-pool: - msg: '<redacted>'