🇬🇧
188.240.59.17
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 188.240.59.17 (GB/United Kingdom/188-240-59-17. ...
show more
(mod_security) mod_security (id:920350) triggered by 188.240.59.17 (GB/United Kingdom/188-240-59-17.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 04:09:58.417876 2026] [security2:error] [pid 489376:tid 489804] [client 188.240.59.17:8090] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRQ1tpIRkzGal5KSXw5CwAAAKE"]
show less
Port Scan
🇩🇪
69.5.169.113
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 69.5.169.113 (DE/Germany/69-5-169-113.infrawat. ...
show more
(mod_security) mod_security (id:920350) triggered by 69.5.169.113 (DE/Germany/69-5-169-113.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 04:07:58.192073 2026] [security2:error] [pid 489376:tid 489799] [client 69.5.169.113:57562] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRQXtpIRkzGal5KSXw49gAAAJw"]
show less
Port Scan
🇺🇸
43.162.124.109
30 Oct 2026
(mod_security) mod_security (id:920280) triggered by 43.162.124.109 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920280) triggered by 43.162.124.109 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 03:56:17.881251 2026] [security2:error] [pid 489376:tid 489794] [client 43.162.124.109:57934] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRNodpIRkzGal5KSXw4YQAAAJc"]
show less
Port Scan
🇺🇸
43.159.152.184
30 Oct 2026
(mod_security) mod_security (id:920210) triggered by 43.159.152.184 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920210) triggered by 43.159.152.184 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 03:51:39.718658 2026] [security2:error] [pid 489376:tid 489772] [client 43.159.152.184:47836] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRMi9pIRkzGal5KSXw4HQAAAII"]
show less
Port Scan
🇺🇸
2602:80d:1007::37
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 2602:80d:1007::37 (Unknown): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920350) triggered by 2602:80d:1007::37 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 03:46:08.637635 2026] [security2:error] [pid 489376:tid 489811] [client 2602:80d:1007::37:17058] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRLQNpIRkzGal5KSXw30QAAAKc"]
show less
Port Scan
🇺🇸
172.235.41.44
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 172.235.41.44 (US/United States/172-235-41-44.i ...
show more
(mod_security) mod_security (id:920350) triggered by 172.235.41.44 (US/United States/172-235-41-44.ip.linodeusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 03:24:32.332923 2026] [security2:error] [pid 489371:tid 489869] [client 172.235.41.44:54954] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRGMNt1EWklP1xNLij6AAAAABQ"]
show less
Port Scan
🇹🇭
165.154.120.253
30 Oct 2026
(ftpd) Failed FTP login from 165.154.120.253 (TH/Thailand/-): 1 in the last 3600 secs; Ports: *; Dir ...
show more
(ftpd) Failed FTP login from 165.154.120.253 (TH/Thailand/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 30 02:54:09 web pure-ftpd: ([email protected] ) [WARNING] Authentication failed for user [anonymous]
show less
Port Scan
🇳🇱
91.92.40.12
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 91.92.40.12 (NL/The Netherlands/-): 1 in the la ...
show more
(mod_security) mod_security (id:920350) triggered by 91.92.40.12 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 02:37:13.779448 2026] [security2:error] [pid 489376:tid 489788] [client 91.92.40.12:25200] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auQ7GdpIRkzGal5KSXw0MAAAAJI"]
show less
Port Scan
🇺🇸
71.6.134.234
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 71.6.134.234 (US/United States/-): 1 in the las ...
show more
(mod_security) mod_security (id:920350) triggered by 71.6.134.234 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 02:35:19.623581 2026] [security2:error] [pid 489376:tid 489808] [client 71.6.134.234:39848] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auQ6p9pIRkzGal5KSXw0HgAAAKQ"]
show less
Port Scan
🇩🇪
167.94.146.50
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 167.94.146.50 (DE/Germany/50.146.94.167.censys- ...
show more
(mod_security) mod_security (id:920350) triggered by 167.94.146.50 (DE/Germany/50.146.94.167.censys-scanner.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 02:35:10.483543 2026] [security2:error] [pid 489371:tid 489839] [client 167.94.146.50:46186] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auQ6ntt1EWklP1xNLij25AAAAAQ"]
show less
Port Scan
🇫🇷
13.37.249.199
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 13.37.249.199 (FR/France/ec2-13-37-249-199.eu-w ...
show more
(mod_security) mod_security (id:920350) triggered by 13.37.249.199 (FR/France/ec2-13-37-249-199.eu-west-3.compute.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 01:54:57.129125 2026] [security2:error] [pid 489371:tid 489904] [client 13.37.249.199:34096] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.git/config"] [unique_id "auQxMdt1EWklP1xNLij0iwAAADQ"]
show less
Port Scan
🇳🇱
45.148.10.120
30 Oct 2026
(mod_security) mod_security (id:930130) triggered by 45.148.10.120 (AD/Andorra/-): 1 in the last 360 ...
show more
(mod_security) mod_security (id:930130) triggered by 45.148.10.120 (AD/Andorra/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 01:48:58.302349 2026] [security2:error] [pid 489371:tid 489882] [client 45.148.10.120:35592] ModSecurity: Access denied with code 406 (phase 1). Matched phrase ".git/" at REQUEST_FILENAME. [file "/etc/modsecurity.d/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "150"] [id "930130"] [msg "Restricted File Access Attempt"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-LFI"] [tag "capec/1000/255/153/126"] [redacted] [uri "/.git/config"] [unique_id "auQvytt1EWklP1xNLijx4AAAACE"]
show less
Port Scan
🇧🇪
35.206.155.99
30 Oct 2026
(ftpd) Failed FTP login from 35.206.155.99 (BE/Belgium/99.155.206.35.bc.googleusercontent.com): 1 in ...
show more
(ftpd) Failed FTP login from 35.206.155.99 (BE/Belgium/99.155.206.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 30 01:26:09 web pure-ftpd: ([email protected] ) [WARNING] Authentication failed for user [anonymous]
show less
Port Scan
🇺🇸
40.119.29.247
30 Oct 2026
(mod_security) mod_security (id:913100) triggered by 40.119.29.247 (US/United States/azpdsgyk0fuz.st ...
show more
(mod_security) mod_security (id:913100) triggered by 40.119.29.247 (US/United States/azpdsgyk0fuz.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 01:02:29.898668 2026] [security2:error] [pid 489376:tid 489828] [client 40.119.29.247:37314] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/actuator/health"] [unique_id "auQk5dpIRkzGal5KSXwthAAAAKw"]
show less
Port Scan
🇳🇱
159.223.229.31
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 159.223.229.31 (NL/The Netherlands/115930.fores ...
show more
(mod_security) mod_security (id:920350) triggered by 159.223.229.31 (NL/The Netherlands/115930.forestengine.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 00:41:07.764126 2026] [security2:error] [pid 489376:tid 489810] [client 159.223.229.31:55148] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auQf49pIRkzGal5KSXwsbAAAAKY"]
show less
Port Scan
🇧🇪
35.210.83.18
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 35.210.83.18 (BE/Belgium/18.83.210.35.bc.google ...
show more
(mod_security) mod_security (id:920350) triggered by 35.210.83.18 (BE/Belgium/18.83.210.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 00:30:56.929208 2026] [security2:error] [pid 489371:tid 489860] [client 35.210.83.18:59026] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auQdgNt1EWklP1xNLijtXAAAAA0"]
show less
Port Scan
🇧🇪
35.210.93.127
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 35.210.93.127 (BE/Belgium/127.93.210.35.bc.goog ...
show more
(mod_security) mod_security (id:920350) triggered by 35.210.93.127 (BE/Belgium/127.93.210.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 00:30:50.481193 2026] [security2:error] [pid 489376:tid 489774] [client 35.210.93.127:50346] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auQdetpIRkzGal5KSXwr6AAAAIQ"]
show less
Port Scan
🇺🇸
74.249.178.68
30 Oct 2026
(mod_security) mod_security (id:913100) triggered by 74.249.178.68 (US/United States/-): 1 in the la ...
show more
(mod_security) mod_security (id:913100) triggered by 74.249.178.68 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 00:24:06.358449 2026] [security2:error] [pid 489376:tid 489840] [client 74.249.178.68:38874] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/manager/html"] [unique_id "auQb5tpIRkzGal5KSXwrkgAAALM"]
show less
Port Scan
🇺🇸
18.97.26.7
30 Oct 2026
(sshd) Failed SSH login from 18.97.26.7 (US/United States/scanner-18-97-26-7.reposify.net): 1 in the ...
show more
(sshd) Failed SSH login from 18.97.26.7 (US/United States/scanner-18-97-26-7.reposify.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 30 00:17:17 web sshd[514193]: Invalid user from 18.97.26.7 port 58080
show less
Port Scan
🇳🇱
195.178.110.159
30 Oct 2026
(mod_security) mod_security (id:930130) triggered by 195.178.110.159 (AD/Andorra/-): 1 in the last 3 ...
show more
(mod_security) mod_security (id:930130) triggered by 195.178.110.159 (AD/Andorra/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 00:04:27.771053 2026] [security2:error] [pid 3223328:tid 3223430] [client 195.178.110.159:48272] ModSecurity: Access denied with code 406 (phase 1). Matched phrase ".git/" at REQUEST_FILENAME. [file "/etc/modsecurity.d/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "150"] [id "930130"] [msg "Restricted File Access Attempt"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-LFI"] [tag "capec/1000/255/153/126"] [redacted] [uri "/.git/config"] [unique_id "auQXS38K8oDonOpIoUAlPgAAABM"]
show less
Port Scan
🇨🇦
85.217.149.41
30 Oct 2026
(eximsyntax) Exim syntax errors from 85.217.149.41 (CA/Canada/o041.scanner.modat.io): 1 in the last ...
show more
(eximsyntax) Exim syntax errors from 85.217.149.41 (CA/Canada/o041.scanner.modat.io): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2026-10-29 23:24:58 SMTP call from o041.scanner.modat.io [85.217.149.41] dropped: too many syntax or protocol errors (last command was "?", NULL)
show less
Port Scan
🇳🇱
159.65.201.166
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 159.65.201.166 (NL/The Netherlands/-): 1 in the ...
show more
(mod_security) mod_security (id:920350) triggered by 159.65.201.166 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 23:08:43.273225 2026] [security2:error] [pid 3223328:tid 3223469] [client 159.65.201.166:51606] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auQKO38K8oDonOpIoUAfAgAAADo"]
show less
Port Scan
🇨🇳
110.152.23.202
30 Oct 2026
(ftpd) Failed FTP login from 110.152.23.202 (CN/China/-): 1 in the last 3600 secs; Ports: *; Directi ...
show more
(ftpd) Failed FTP login from 110.152.23.202 (CN/China/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 29 22:40:21 web pure-ftpd: ([email protected] ) [WARNING] Authentication failed for user [Admin]
show less
Port Scan
🇺🇸
184.105.139.67
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 184.105.139.67 (CA/Canada/67.64-26.139.105.184. ...
show more
(mod_security) mod_security (id:920350) triggered by 184.105.139.67 (CA/Canada/67.64-26.139.105.184.in-addr.arpa): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 22:26:58.086050 2026] [security2:error] [pid 3223328:tid 3223460] [client 184.105.139.67:29730] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auQAcn8K8oDonOpIoUAZ-gAAADE"]
show less
Port Scan
🇺🇸
49.51.180.2
30 Oct 2026
(mod_security) mod_security (id:920210) triggered by 49.51.180.2 (US/United States/-): 1 in the last ...
show more
(mod_security) mod_security (id:920210) triggered by 49.51.180.2 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 22:22:24.736416 2026] [security2:error] [pid 3223328:tid 3223436] [client 49.51.180.2:59542] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auP_YH8K8oDonOpIoUAZiwAAABk"]
show less
Port Scan