🇺🇸
40.124.186.100
1 minute ago
(mod_security) mod_security (id:913100) triggered by 40.124.186.100 (US/United States/azpdsg1ue5fj.s ...
show more
(mod_security) mod_security (id:913100) triggered by 40.124.186.100 (US/United States/azpdsg1ue5fj.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 15:55:31.424568 2026] [security2:error] [pid 98241:tid 98680] [client 40.124.186.100:36646] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/developmentserver/metadatauploader"] [unique_id "al_OsxmEQjWlf4KSnTDPOQAAAU4"]
show less
Port Scan
🇺🇸
2602:80d:1008::84
5 minutes ago
(mod_security) mod_security (id:920350) triggered by 2602:80d:1008::84 (Unknown): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920350) triggered by 2602:80d:1008::84 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 15:51:29.680057 2026] [security2:error] [pid 98241:tid 98678] [client 2602:80d:1008::84:57204] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "al_NwRmEQjWlf4KSnTDOvAAAAU0"]
show less
Port Scan
🇰🇷
114.202.253.7
22 minutes ago
(smtpauth) Failed SMTP AUTH login from 114.202.253.7 (KR/South Korea/-): 1 in the last 3600 secs; Po ...
show more
(smtpauth) Failed SMTP AUTH login from 114.202.253.7 (KR/South Korea/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2026-07-21 15:34:30 plain authenticator failed for H=(localhost) [114.202.253.7]: 535 Incorrect authentication data ([email protected] )
show less
Port Scan
🇻🇳
103.106.104.25
52 minutes ago
(smtpauth) Failed SMTP AUTH login from 103.106.104.25 (VN/Vietnam/-): 1 in the last 3600 secs; Ports ...
show more
(smtpauth) Failed SMTP AUTH login from 103.106.104.25 (VN/Vietnam/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2026-07-21 15:05:07 plain authenticator failed for H=(localhost) [103.106.104.25]: 535 Incorrect authentication data ([email protected] )
show less
Port Scan
🇺🇸
47.251.107.237
1 hour ago
(mod_security) mod_security (id:920350) triggered by 47.251.107.237 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920350) triggered by 47.251.107.237 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 14:47:36.631289 2026] [security2:error] [pid 98212:tid 98613] [client 47.251.107.237:17736] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "al--yGVqNtp5pgKJF-x8CAAAAMQ"]
show less
Port Scan
🇺🇸
146.190.167.42
1 hour ago
(mod_security) mod_security (id:920350) triggered by 146.190.167.42 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920350) triggered by 146.190.167.42 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 14:32:38.204915 2026] [security2:error] [pid 98212:tid 98689] [client 146.190.167.42:52370] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "al-7RmVqNtp5pgKJF-x5TAAAAP0"]
show less
Port Scan
🇺🇸
66.132.186.169
1 hour ago
(eximsyntax) Exim syntax errors from 66.132.186.169 (US/United States/169.186.132.66.censys-scanner. ...
show more
(eximsyntax) Exim syntax errors from 66.132.186.169 (US/United States/169.186.132.66.censys-scanner.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2026-07-21 14:07:08 SMTP call from 169.186.132.66.censys-scanner.com [66.132.186.169] dropped: too many syntax or protocol errors (last command was "?", NULL)
show less
Port Scan
🇰🇭
103.30.198.226
2 hours ago
(mod_security) mod_security (id:920350) triggered by 103.30.198.226 (KH/Cambodia/ezecom.103.30.198.0 ...
show more
(mod_security) mod_security (id:920350) triggered by 103.30.198.226 (KH/Cambodia/ezecom.103.30.198.0.226.ezecom.com.kh): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 13:39:32.680589 2026] [security2:error] [pid 94742:tid 94845] [client 103.30.198.226:59753] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "al-u1JUM1yRyi0wW0E9I2gAAAFQ"]
show less
Port Scan
🇨🇦
85.217.149.7
2 hours ago
(mod_security) mod_security (id:920350) triggered by 85.217.149.7 (CA/Canada/o008.scanner.modat.io): ...
show more
(mod_security) mod_security (id:920350) triggered by 85.217.149.7 (CA/Canada/o008.scanner.modat.io): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 13:15:44.534079 2026] [security2:error] [pid 94742:tid 94845] [client 85.217.149.7:36192] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "al-pQJUM1yRyi0wW0E84vwAAAFQ"]
show less
Port Scan
🇩🇪
94.156.179.69
3 hours ago
(mod_security) mod_security (id:920350) triggered by 94.156.179.69 (DE/Germany/-): 1 in the last 360 ...
show more
(mod_security) mod_security (id:920350) triggered by 94.156.179.69 (DE/Germany/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 12:32:42.194887 2026] [security2:error] [pid 94742:tid 94876] [client 94.156.179.69:57174] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/cgi-bin/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/.%2e/bin/sh"] [unique_id "al-fKpUM1yRyi0wW0E8mRwAAAHM"]
show less
Port Scan
🇩🇪
91.92.33.65
3 hours ago
(mod_security) mod_security (id:920350) triggered by 91.92.33.65 (DE/Germany/-): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920350) triggered by 91.92.33.65 (DE/Germany/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 12:18:21.425574 2026] [security2:error] [pid 94742:tid 94828] [client 91.92.33.65:11568] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "al-bzZUM1yRyi0wW0E8cFAAAAEM"]
show less
Port Scan
🇭🇰
47.243.35.191
4 hours ago
(mod_security) mod_security (id:920280) triggered by 47.243.35.191 (HK/Hong Kong/-): 1 in the last 3 ...
show more
(mod_security) mod_security (id:920280) triggered by 47.243.35.191 (HK/Hong Kong/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 10:57:20.007205 2026] [security2:error] [pid 93238:tid 93363] [client 47.243.35.191:55340] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "al-I0C_YHUDB76DVnrc42AAAACo"]
show less
Port Scan
🇳🇱
91.92.41.64
5 hours ago
(mod_security) mod_security (id:920350) triggered by 91.92.41.64 (BG/Bulgaria/-): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920350) triggered by 91.92.41.64 (BG/Bulgaria/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 10:35:55.072518 2026] [security2:error] [pid 91740:tid 91882] [client 91.92.41.64:53024] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.env"] [unique_id "al-Dy2zWHLElwjwEQjQl6QAAAHs"]
show less
Port Scan
🇸🇬
43.134.56.214
5 hours ago
(mod_security) mod_security (id:920210) triggered by 43.134.56.214 (SG/Singapore/-): 1 in the last 3 ...
show more
(mod_security) mod_security (id:920210) triggered by 43.134.56.214 (SG/Singapore/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 10:33:17.793240 2026] [security2:error] [pid 91740:tid 91843] [client 43.134.56.214:35798] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "al-DLWzWHLElwjwEQjQjWAAAAFQ"]
show less
Port Scan
🇺🇸
65.49.1.131
5 hours ago
(mod_security) mod_security (id:920350) triggered by 65.49.1.131 (US/United States/131.0-24.1.49.65. ...
show more
(mod_security) mod_security (id:920350) triggered by 65.49.1.131 (US/United States/131.0-24.1.49.65.in-addr.arpa): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 10:27:46.999960 2026] [security2:error] [pid 91740:tid 91873] [client 65.49.1.131:58973] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "al-B4mzWHLElwjwEQjQeCgAAAHI"]
show less
Port Scan
🇺🇸
65.49.1.122
5 hours ago
(mod_security) mod_security (id:920350) triggered by 65.49.1.122 (US/United States/122.0-24.1.49.65. ...
show more
(mod_security) mod_security (id:920350) triggered by 65.49.1.122 (US/United States/122.0-24.1.49.65.in-addr.arpa): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 10:18:36.515387 2026] [security2:error] [pid 91740:tid 91848] [client 65.49.1.122:49666] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "al9_vGzWHLElwjwEQjQVPAAAAFk"]
show less
Port Scan
🇭🇰
152.32.169.7
5 hours ago
(mod_security) mod_security (id:920280) triggered by 152.32.169.7 (HK/Hong Kong/-): 1 in the last 36 ...
show more
(mod_security) mod_security (id:920280) triggered by 152.32.169.7 (HK/Hong Kong/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 09:57:28.671996 2026] [security2:error] [pid 91740:tid 91864] [client 152.32.169.7:11298] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "al96yGzWHLElwjwEQjQCjAAAAGk"]
show less
Port Scan
🇭🇰
199.45.154.132
6 hours ago
(eximsyntax) Exim syntax errors from 199.45.154.132 (HK/Hong Kong/132.154.45.199.censys-scanner.com) ...
show more
(eximsyntax) Exim syntax errors from 199.45.154.132 (HK/Hong Kong/132.154.45.199.censys-scanner.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2026-07-21 09:03:10 SMTP call from 132.154.45.199.censys-scanner.com [199.45.154.132] dropped: too many syntax or protocol errors (last command was "?", NULL)
show less
Port Scan
🇩🇪
167.94.146.57
7 hours ago
(mod_security) mod_security (id:920350) triggered by 167.94.146.57 (DE/Germany/57.146.94.167.censys- ...
show more
(mod_security) mod_security (id:920350) triggered by 167.94.146.57 (DE/Germany/57.146.94.167.censys-scanner.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 08:13:05.378903 2026] [security2:error] [pid 90071:tid 90183] [client 167.94.146.57:26122] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "al9iUQGMGcl0g9CoyzsHdgAAAB0"]
show less
Port Scan
🇩🇪
43.131.36.84
8 hours ago
(mod_security) mod_security (id:920210) triggered by 43.131.36.84 (DE/Germany/-): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920210) triggered by 43.131.36.84 (DE/Germany/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 07:54:49.909728 2026] [security2:error] [pid 90071:tid 90213] [client 43.131.36.84:37938] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "al9eCQGMGcl0g9Coyzv5mgAAADs"]
show less
Port Scan
🇵🇰
153.117.34.232
8 hours ago
(mod_security) mod_security (id:920280) triggered by 153.117.34.232 (PK/Pakistan/-): 1 in the last 3 ...
show more
(mod_security) mod_security (id:920280) triggered by 153.117.34.232 (PK/Pakistan/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 07:45:33.114894 2026] [security2:error] [pid 75790:tid 75864] [client 153.117.34.232:22236] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/boaform/admin/formLogin"] [unique_id "al9b3Y0KA7GhCWBs2dbOyAAAAEc"]
show less
Port Scan
🇺🇸
20.65.193.1
9 hours ago
(mod_security) mod_security (id:913100) triggered by 20.65.193.1 (US/United States/azpdsssyxvsv.stre ...
show more
(mod_security) mod_security (id:913100) triggered by 20.65.193.1 (US/United States/azpdsssyxvsv.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 06:26:57.493503 2026] [security2:error] [pid 73813:tid 73885] [client 20.65.193.1:55506] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/autodiscover/autodiscover.json"] [unique_id "al9JceqixIWE1V6lkR0o4wAAAAU"]
show less
Port Scan
🇺🇸
135.222.40.122
9 hours ago
(mod_security) mod_security (id:913100) triggered by 135.222.40.122 (US/United States/azpdescck8gl.s ...
show more
(mod_security) mod_security (id:913100) triggered by 135.222.40.122 (US/United States/azpdescck8gl.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 06:06:06.722719 2026] [security2:error] [pid 73813:tid 73922] [client 135.222.40.122:42662] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/actuator/health"] [unique_id "al9EjuqixIWE1V6lkR0UaQAAACk"]
show less
Port Scan
🇺🇸
43.165.125.66
9 hours ago
(mod_security) mod_security (id:920210) triggered by 43.165.125.66 (US/United States/-): 1 in the la ...
show more
(mod_security) mod_security (id:920210) triggered by 43.165.125.66 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 06:05:12.638506 2026] [security2:error] [pid 73813:tid 73907] [client 43.165.125.66:40366] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "al9EWOqixIWE1V6lkR0TigAAABs"]
show less
Port Scan
🇳🇱
45.142.193.24
10 hours ago
(mod_security) mod_security (id:920350) triggered by 45.142.193.24 (GB/United Kingdom/-): 1 in the l ...
show more
(mod_security) mod_security (id:920350) triggered by 45.142.193.24 (GB/United Kingdom/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Jul 21 05:24:42.393097 2026] [security2:error] [pid 73813:tid 73910] [client 45.142.193.24:49528] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.27.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/global-protect/login.esp"] [unique_id "al862uqixIWE1V6lkR351wAAAB4"]
show less
Port Scan