🇵🇰
175.107.228.210
30 Oct 2026
(mod_security) mod_security (id:920280) triggered by 175.107.228.210 (PK/Pakistan/-): 1 in the last ...
show more
(mod_security) mod_security (id:920280) triggered by 175.107.228.210 (PK/Pakistan/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 14:58:21.423366 2026] [security2:error] [pid 3762865:tid 3762962] [client 175.107.228.210:50058] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/boaform/admin/formLogin"] [unique_id "auTozbFh5-zlXcrpcSBWqgAAAA4"]
show less
Port Scan
🇸🇬
43.106.106.108
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 43.106.106.108 (SG/Singapore/-): 1 in the last ...
show more
(mod_security) mod_security (id:920350) triggered by 43.106.106.108 (SG/Singapore/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 14:34:27.448002 2026] [security2:error] [pid 3762865:tid 3762967] [client 43.106.106.108:40592] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auTjM7Fh5-zlXcrpcSBULAAAABM"]
show less
Port Scan
🇭🇰
103.203.56.2
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 103.203.56.2 (CN/China/scan-56-2.security.ipip. ...
show more
(mod_security) mod_security (id:920350) triggered by 103.203.56.2 (CN/China/scan-56-2.security.ipip.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 14:25:02.797329 2026] [security2:error] [pid 3762865:tid 3762979] [client 103.203.56.2:54296] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auTg_rFh5-zlXcrpcSBTEQAAAB8"]
show less
Port Scan
🇳🇱
151.245.151.231
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 151.245.151.231 (AE/United Arab Emirates/-): 1 ...
show more
(mod_security) mod_security (id:920350) triggered by 151.245.151.231 (AE/United Arab Emirates/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 13:34:33.740537 2026] [security2:error] [pid 3762865:tid 3762972] [client 151.245.151.231:52024] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auTVKbFh5-zlXcrpcSBNtAAAABg"]
show less
Port Scan
🇺🇸
109.105.209.57
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 109.105.209.57 (US/United States/zl-laxk-us-gp7 ...
show more
(mod_security) mod_security (id:920350) triggered by 109.105.209.57 (US/United States/zl-laxk-us-gp7-wk118a.internet-census.org): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 12:26:42.154890 2026] [security2:error] [pid 3762865:tid 3762948] [client 109.105.209.57:56550] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auTFQrFh5-zlXcrpcSBFBAAAAAA"]
show less
Port Scan
🇺🇸
43.166.129.247
30 Oct 2026
(mod_security) mod_security (id:920210) triggered by 43.166.129.247 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920210) triggered by 43.166.129.247 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 11:47:29.222182 2026] [security2:error] [pid 489376:tid 489844] [client 43.166.129.247:44046] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auS8EdpIRkzGal5KSXxSrAAAALU"]
show less
Port Scan
🇰🇷
152.32.139.228
30 Oct 2026
(ftpd) Failed FTP login from 152.32.139.228 (KR/South Korea/-): 1 in the last 3600 secs; Ports: *; D ...
show more
(ftpd) Failed FTP login from 152.32.139.228 (KR/South Korea/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 30 11:20:42 web pure-ftpd: ([email protected] ) [WARNING] Authentication failed for user [anonymous]
show less
Port Scan
🇺🇸
47.251.71.112
30 Oct 2026
(eximsyntax) Exim syntax errors from 47.251.71.112 (US/United States/-): 1 in the last 3600 secs; Po ...
show more
(eximsyntax) Exim syntax errors from 47.251.71.112 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2026-10-30 11:14:51 SMTP call from [47.251.71.112] dropped: too many syntax or protocol errors (last command was "?", NULL)
show less
Port Scan
🇳🇱
188.166.68.30
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 188.166.68.30 (NL/The Netherlands/-): 1 in the ...
show more
(mod_security) mod_security (id:920350) triggered by 188.166.68.30 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 10:25:20.728229 2026] [security2:error] [pid 489371:tid 489900] [client 188.166.68.30:60606] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auSo0Nt1EWklP1xNLigS_QAAADA"]
show less
Port Scan
🇺🇸
54.166.249.45
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 54.166.249.45 (US/United States/ec2-54-166-249- ...
show more
(mod_security) mod_security (id:920350) triggered by 54.166.249.45 (US/United States/ec2-54-166-249-45.compute-1.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 10:04:32.709994 2026] [security2:error] [pid 489371:tid 489875] [client 54.166.249.45:59526] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auSj8Nt1EWklP1xNLigR1AAAABo"]
show less
Port Scan
🇵🇰
139.135.41.67
30 Oct 2026
(mod_security) mod_security (id:920280) triggered by 139.135.41.67 (PK/Pakistan/-): 1 in the last 36 ...
show more
(mod_security) mod_security (id:920280) triggered by 139.135.41.67 (PK/Pakistan/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 07:49:13.409722 2026] [security2:error] [pid 489376:tid 489783] [client 139.135.41.67:8837] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/boaform/admin/formLogin"] [unique_id "auSEOdpIRkzGal5KSXxEiAAAAI0"]
show less
Port Scan
🇺🇸
172.104.11.34
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 172.104.11.34 (US/United States/edinburgh.scan. ...
show more
(mod_security) mod_security (id:920350) triggered by 172.104.11.34 (US/United States/edinburgh.scan.bufferover.run): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 07:38:41.034042 2026] [security2:error] [pid 489371:tid 489915] [client 172.104.11.34:35640] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auSBwdt1EWklP1xNLigJpgAAAD8"]
show less
Port Scan
🇺🇸
149.165.154.76
30 Oct 2026
(mod_security) mod_security (id:913100) triggered by 149.165.154.76 (US/United States/worker4.cis250 ...
show more
(mod_security) mod_security (id:913100) triggered by 149.165.154.76 (US/United States/worker4.cis250324.projects.jetstream-cloud.org): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 07:21:54.917233 2026] [security2:error] [pid 489371:tid 489881] [client 149.165.154.76:17606] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/"] [unique_id "auR90tt1EWklP1xNLigIsQAAACA"]
show less
Port Scan
🇬🇧
84.32.41.99
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 84.32.41.99 (GB/United Kingdom/-): 1 in the las ...
show more
(mod_security) mod_security (id:920350) triggered by 84.32.41.99 (GB/United Kingdom/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 06:04:41.024327 2026] [security2:error] [pid 489371:tid 489909] [client 84.32.41.99:59704] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRrudt1EWklP1xNLigERwAAADk"]
show less
Port Scan
🇺🇸
20.169.91.1
30 Oct 2026
(mod_security) mod_security (id:913100) triggered by 20.169.91.1 (US/United States/azpdws8zty0m.stre ...
show more
(mod_security) mod_security (id:913100) triggered by 20.169.91.1 (US/United States/azpdws8zty0m.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 05:55:36.526045 2026] [security2:error] [pid 489371:tid 489860] [client 20.169.91.1:41480] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/hudson"] [unique_id "auRpmNt1EWklP1xNLigDxQAAAA0"]
show less
Port Scan
🇷🇴
193.32.162.233
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 193.32.162.233 (NL/The Netherlands/-): 1 in the ...
show more
(mod_security) mod_security (id:920350) triggered by 193.32.162.233 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 05:27:48.553532 2026] [security2:error] [pid 489376:tid 489811] [client 193.32.162.233:43354] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRjFNpIRkzGal5KSXw9eAAAAKc"]
show less
Port Scan
🇬🇧
5.226.140.16
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 5.226.140.16 (GB/United Kingdom/5-226-140-16.in ...
show more
(mod_security) mod_security (id:920350) triggered by 5.226.140.16 (GB/United Kingdom/5-226-140-16.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 04:09:58.135228 2026] [security2:error] [pid 489371:tid 489860] [client 5.226.140.16:2486] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRQ1tt1EWklP1xNLij82wAAAA0"]
show less
Port Scan
🇬🇧
81.19.219.215
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 81.19.219.215 (GB/United Kingdom/81-19-219-215. ...
show more
(mod_security) mod_security (id:920350) triggered by 81.19.219.215 (GB/United Kingdom/81-19-219-215.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 04:09:58.276457 2026] [security2:error] [pid 489371:tid 489841] [client 81.19.219.215:2078] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/favicon.ico"] [unique_id "auRQ1tt1EWklP1xNLij83AAAAAU"]
show less
Port Scan
🇬🇧
81.19.219.221
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 81.19.219.221 (GB/United Kingdom/81-19-219-221. ...
show more
(mod_security) mod_security (id:920350) triggered by 81.19.219.221 (GB/United Kingdom/81-19-219-221.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 04:09:58.424177 2026] [security2:error] [pid 489376:tid 489799] [client 81.19.219.221:12224] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/mcp"] [unique_id "auRQ1tpIRkzGal5KSXw5DAAAAJw"]
show less
Port Scan
🇬🇧
188.240.59.13
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 188.240.59.13 (GB/United Kingdom/188-240-59-13. ...
show more
(mod_security) mod_security (id:920350) triggered by 188.240.59.13 (GB/United Kingdom/188-240-59-13.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 04:09:58.417820 2026] [security2:error] [pid 489371:tid 489914] [client 188.240.59.13:15588] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/mcp/"] [unique_id "auRQ1tt1EWklP1xNLij83QAAAD4"]
show less
Port Scan
🇬🇧
188.240.59.17
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 188.240.59.17 (GB/United Kingdom/188-240-59-17. ...
show more
(mod_security) mod_security (id:920350) triggered by 188.240.59.17 (GB/United Kingdom/188-240-59-17.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 04:09:58.417876 2026] [security2:error] [pid 489376:tid 489804] [client 188.240.59.17:8090] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRQ1tpIRkzGal5KSXw5CwAAAKE"]
show less
Port Scan
🇩🇪
69.5.169.113
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 69.5.169.113 (DE/Germany/69-5-169-113.infrawat. ...
show more
(mod_security) mod_security (id:920350) triggered by 69.5.169.113 (DE/Germany/69-5-169-113.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 04:07:58.192073 2026] [security2:error] [pid 489376:tid 489799] [client 69.5.169.113:57562] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRQXtpIRkzGal5KSXw49gAAAJw"]
show less
Port Scan
🇺🇸
43.162.124.109
30 Oct 2026
(mod_security) mod_security (id:920280) triggered by 43.162.124.109 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920280) triggered by 43.162.124.109 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 03:56:17.881251 2026] [security2:error] [pid 489376:tid 489794] [client 43.162.124.109:57934] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRNodpIRkzGal5KSXw4YQAAAJc"]
show less
Port Scan
🇺🇸
43.159.152.184
30 Oct 2026
(mod_security) mod_security (id:920210) triggered by 43.159.152.184 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920210) triggered by 43.159.152.184 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 03:51:39.718658 2026] [security2:error] [pid 489376:tid 489772] [client 43.159.152.184:47836] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRMi9pIRkzGal5KSXw4HQAAAII"]
show less
Port Scan
🇺🇸
2602:80d:1007::37
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 2602:80d:1007::37 (Unknown): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920350) triggered by 2602:80d:1007::37 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 03:46:08.637635 2026] [security2:error] [pid 489376:tid 489811] [client 2602:80d:1007::37:17058] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRLQNpIRkzGal5KSXw30QAAAKc"]
show less
Port Scan