🇺🇸
2602:80d:1008::3e
31 Oct 2026
(mod_security) mod_security (id:920350) triggered by 2602:80d:1008::3e (Unknown): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920350) triggered by 2602:80d:1008::3e (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat Oct 31 04:49:58.988083 2026] [security2:error] [pid 2874892:tid 2875369] [client 2602:80d:1008::3e:63870] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auWrtgzQ_TtHulcWzc3CogAAARE"]
show less
Port Scan
🇺🇸
45.33.80.243
31 Oct 2026
(mod_security) mod_security (id:920350) triggered by 45.33.80.243 (US/United States/minsk.scan.buffe ...
show more
(mod_security) mod_security (id:920350) triggered by 45.33.80.243 (US/United States/minsk.scan.bufferover.run): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat Oct 31 04:39:16.768813 2026] [security2:error] [pid 2874892:tid 2875372] [client 45.33.80.243:36788] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auWpNAzQ_TtHulcWzc3CEgAAARQ"]
show less
Port Scan
🇺🇸
172.234.217.192
31 Oct 2026
(mod_security) mod_security (id:920350) triggered by 172.234.217.192 (US/United States/172-234-217-1 ...
show more
(mod_security) mod_security (id:920350) triggered by 172.234.217.192 (US/United States/172-234-217-192.ip.linodeusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat Oct 31 03:48:12.579932 2026] [security2:error] [pid 2874892:tid 2875389] [client 172.234.217.192:43282] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auWdPAzQ_TtHulcWzc2_FQAAASU"]
show less
Port Scan
🇱🇹
91.224.92.45
31 Oct 2026
(mod_security) mod_security (id:920350) triggered by 91.224.92.45 (LT/Lithuania/srv-91-224-92-45.ser ...
show more
(mod_security) mod_security (id:920350) triggered by 91.224.92.45 (LT/Lithuania/srv-91-224-92-45.serveroffer.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat Oct 31 03:27:13.064253 2026] [security2:error] [pid 2874890:tid 2875252] [client 91.224.92.45:37566] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/SDK/webLanguage"] [unique_id "auWYUf_uqzRgzy8rqdYrRAAAAFo"]
show less
Port Scan
🇺🇸
66.132.159.116
31 Oct 2026
(mod_security) mod_security (id:920350) triggered by 66.132.159.116 (US/United States/116.159.132.66 ...
show more
(mod_security) mod_security (id:920350) triggered by 66.132.159.116 (US/United States/116.159.132.66.censys-scanner.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat Oct 31 02:45:52.220466 2026] [security2:error] [pid 2874892:tid 2875352] [client 66.132.159.116:54856] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auWOoAzQ_TtHulcWzc27rwAAAQA"]
show less
Port Scan
🇭🇰
165.154.41.232
31 Oct 2026
(mod_security) mod_security (id:920350) triggered by 165.154.41.232 (HK/Hong Kong/-): 1 in the last ...
show more
(mod_security) mod_security (id:920350) triggered by 165.154.41.232 (HK/Hong Kong/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat Oct 31 01:27:53.075938 2026] [security2:error] [pid 2874892:tid 2875369] [client 165.154.41.232:57392] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auV8WQzQ_TtHulcWzc23LwAAARE"]
show less
Port Scan
🇧🇪
35.206.184.41
31 Oct 2026
(mod_security) mod_security (id:920350) triggered by 35.206.184.41 (BE/Belgium/41.184.206.35.bc.goog ...
show more
(mod_security) mod_security (id:920350) triggered by 35.206.184.41 (BE/Belgium/41.184.206.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat Oct 31 00:50:22.358978 2026] [security2:error] [pid 2874892:tid 2875388] [client 35.206.184.41:64928] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auVzjgzQ_TtHulcWzc21GAAAASQ"]
show less
Port Scan
🇧🇪
35.210.235.198
31 Oct 2026
(ftpd) Failed FTP login from 35.210.235.198 (BE/Belgium/198.235.210.35.bc.googleusercontent.com): 1 ...
show more
(ftpd) Failed FTP login from 35.210.235.198 (BE/Belgium/198.235.210.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 31 00:33:10 web pure-ftpd: ([email protected] ) [WARNING] Authentication failed for user [anonymous]
show less
Port Scan
🇺🇸
43.166.134.47
31 Oct 2026
(mod_security) mod_security (id:920210) triggered by 43.166.134.47 (US/United States/-): 1 in the la ...
show more
(mod_security) mod_security (id:920210) triggered by 43.166.134.47 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sat Oct 31 00:13:34.635527 2026] [security2:error] [pid 2874892:tid 2875362] [client 43.166.134.47:58084] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auVq7gzQ_TtHulcWzc2yoQAAAQo"]
show less
Port Scan
🇺🇸
216.180.246.174
31 Oct 2026
(mod_security) mod_security (id:920280) triggered by 216.180.246.174 (FR/France/crawler174.deepfield ...
show more
(mod_security) mod_security (id:920280) triggered by 216.180.246.174 (FR/France/crawler174.deepfield.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 23:51:49.153020 2026] [security2:error] [pid 1241691:tid 1241786] [client 216.180.246.174:21949] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auVl1d3bj7BT4tGd5urfGAAAAEw"]
show less
Port Scan
🇫🇷
51.210.220.167
31 Oct 2026
(mod_security) mod_security (id:920350) triggered by 51.210.220.167 (FR/France/server.midoriweb.io): ...
show more
(mod_security) mod_security (id:920350) triggered by 51.210.220.167 (FR/France/server.midoriweb.io): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 22:43:01.885017 2026] [security2:error] [pid 1241691:tid 1241802] [client 51.210.220.167:48678] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/graphql"] [unique_id "auVVtd3bj7BT4tGd5urX-QAAAFw"]
show less
Port Scan
🇳🇱
165.232.92.114
31 Oct 2026
(mod_security) mod_security (id:920350) triggered by 165.232.92.114 (NL/The Netherlands/117613.fores ...
show more
(mod_security) mod_security (id:920350) triggered by 165.232.92.114 (NL/The Netherlands/117613.forestengine.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 22:27:25.769307 2026] [security2:error] [pid 1241691:tid 1241836] [client 165.232.92.114:52736] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auVSDd3bj7BT4tGd5urWWgAAAH4"]
show less
Port Scan
🇬🇧
78.153.140.40
31 Oct 2026
(mod_security) mod_security (id:920350) triggered by 78.153.140.40 (GB/United Kingdom/-): 1 in the l ...
show more
(mod_security) mod_security (id:920350) triggered by 78.153.140.40 (GB/United Kingdom/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 22:08:38.772583 2026] [security2:error] [pid 1241691:tid 1241791] [client 78.153.140.40:44262] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.env"] [unique_id "auVNpt3bj7BT4tGd5urUZAAAAFE"]
show less
Port Scan
🇺🇸
45.79.149.61
31 Oct 2026
(mod_security) mod_security (id:920350) triggered by 45.79.149.61 (US/United States/45-79-149-61.ip. ...
show more
(mod_security) mod_security (id:920350) triggered by 45.79.149.61 (US/United States/45-79-149-61.ip.linodeusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 21:46:14.643020 2026] [security2:error] [pid 1241691:tid 1241781] [client 45.79.149.61:47668] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auVIZt3bj7BT4tGd5urSAQAAAEc"]
show less
Port Scan
🇳🇱
91.92.40.236
31 Oct 2026
(mod_security) mod_security (id:920350) triggered by 91.92.40.236 (NL/The Netherlands/-): 1 in the l ...
show more
(mod_security) mod_security (id:920350) triggered by 91.92.40.236 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 21:14:40.099584 2026] [security2:error] [pid 1241691:tid 1241784] [client 91.92.40.236:64752] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auVBAN3bj7BT4tGd5urOqgAAAEo"]
show less
Port Scan
🇬🇧
87.236.176.185
31 Oct 2026
(mod_security) mod_security (id:920350) triggered by 87.236.176.185 (GB/United Kingdom/r3-185-b9.mon ...
show more
(mod_security) mod_security (id:920350) triggered by 87.236.176.185 (GB/United Kingdom/r3-185-b9.monitoring.internet-measurement.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 20:45:17.020595 2026] [security2:error] [pid 1241691:tid 1241814] [client 87.236.176.185:41535] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auU6Hd3bj7BT4tGd5urLiwAAAGg"]
show less
Port Scan
🇩🇪
91.92.41.32
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 91.92.41.32 (BG/Bulgaria/-): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920350) triggered by 91.92.41.32 (BG/Bulgaria/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 19:47:20.713107 2026] [security2:error] [pid 1241691:tid 1241787] [client 91.92.41.32:52280] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.env"] [unique_id "auUsiN3bj7BT4tGd5urFbQAAAE0"]
show less
Port Scan
🇺🇸
4.236.164.36
30 Oct 2026
(mod_security) mod_security (id:913100) triggered by 4.236.164.36 (US/United States/azpdesqrgeg1.str ...
show more
(mod_security) mod_security (id:913100) triggered by 4.236.164.36 (US/United States/azpdesqrgeg1.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 19:43:03.385275 2026] [security2:error] [pid 1241691:tid 1241802] [client 4.236.164.36:35040] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/"] [unique_id "auUrh93bj7BT4tGd5urE-AAAAFw"]
show less
Port Scan
🇦🇺
170.64.154.131
30 Oct 2026
(mod_security) mod_security (id:913100) triggered by 170.64.154.131 (AU/Australia/-): 1 in the last ...
show more
(mod_security) mod_security (id:913100) triggered by 170.64.154.131 (AU/Australia/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 19:37:36.530315 2026] [security2:error] [pid 1241691:tid 1241779] [client 170.64.154.131:48878] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/"] [unique_id "auUqQN3bj7BT4tGd5urEKwAAAEU"]
show less
Port Scan
🇺🇸
216.25.90.19
30 Oct 2026
(mod_security) mod_security (id:920280) triggered by 216.25.90.19 (US/United States/-): 1 in the las ...
show more
(mod_security) mod_security (id:920280) triggered by 216.25.90.19 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 18:45:48.545613 2026] [security2:error] [pid 1241691:tid 1241801] [client 216.25.90.19:50174] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auUeHN3bj7BT4tGd5uq-YgAAAFs"]
show less
Port Scan
🇲🇾
47.250.155.102
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 47.250.155.102 (MY/Malaysia/-): 1 in the last 3 ...
show more
(mod_security) mod_security (id:920350) triggered by 47.250.155.102 (MY/Malaysia/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 18:07:59.056095 2026] [security2:error] [pid 3762865:tid 3762993] [client 47.250.155.102:53756] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auUVP7Fh5-zlXcrpcSBsFgAAAC0"]
show less
Port Scan
🇮🇳
172.232.108.36
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 172.232.108.36 (IN/India/172-232-108-36.ip.lino ...
show more
(mod_security) mod_security (id:920350) triggered by 172.232.108.36 (IN/India/172-232-108-36.ip.linodeusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 18:03:20.637469 2026] [security2:error] [pid 3762865:tid 3762991] [client 172.232.108.36:40536] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auUUKLFh5-zlXcrpcSBrlgAAACs"]
show less
Port Scan
🇬🇧
144.126.229.200
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 144.126.229.200 (GB/United Kingdom/-): 1 in the ...
show more
(mod_security) mod_security (id:920350) triggered by 144.126.229.200 (GB/United Kingdom/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 17:38:26.085879 2026] [security2:error] [pid 3762865:tid 3763011] [client 144.126.229.200:48296] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auUOUrFh5-zlXcrpcSBo1wAAAD8"]
show less
Port Scan
🇷🇴
92.118.39.18
30 Oct 2026
(mod_security) mod_security (id:930130) triggered by 92.118.39.18 (NL/The Netherlands/-): 1 in the l ...
show more
(mod_security) mod_security (id:930130) triggered by 92.118.39.18 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 17:19:36.166970 2026] [security2:error] [pid 3762865:tid 3762978] [client 92.118.39.18:44770] ModSecurity: Access denied with code 406 (phase 1). Matched phrase ".git/" at REQUEST_FILENAME. [file "/etc/modsecurity.d/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "150"] [id "930130"] [msg "Restricted File Access Attempt"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-LFI"] [tag "capec/1000/255/153/126"] [redacted] [uri "/.git/HEAD"] [unique_id "auUJ6LFh5-zlXcrpcSBm4QAAAB4"]
show less
Port Scan
🇫🇮
147.185.133.48
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 147.185.133.48 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920350) triggered by 147.185.133.48 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 15:40:12.486786 2026] [security2:error] [pid 3762865:tid 3762962] [client 147.185.133.48:60212] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auTynLFh5-zlXcrpcSBbVwAAAA4"]
show less
Port Scan