🇱🇻
194.165.16.19
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 194.165.16.19 (LT/Lithuania/-): 1 in the last 3 ...
show more
(mod_security) mod_security (id:920350) triggered by 194.165.16.19 (LT/Lithuania/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 22:11:54.612872 2026] [security2:error] [pid 3223328:tid 3223420] [client 194.165.16.19:37210] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/OA_HTML/AppsTCFServer"] [unique_id "auP86n8K8oDonOpIoUAYdQAAAAk"]
show less
Port Scan
🇺🇸
172.190.114.167
30 Oct 2026
(mod_security) mod_security (id:913100) triggered by 172.190.114.167 (US/United States/azpdescbyhrh. ...
show more
(mod_security) mod_security (id:913100) triggered by 172.190.114.167 (US/United States/azpdescbyhrh.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 21:52:18.804185 2026] [security2:error] [pid 3223328:tid 3223467] [client 172.190.114.167:39636] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/"] [unique_id "auP4Un8K8oDonOpIoUAVZQAAADg"]
show less
Port Scan
🇷🇴
193.32.162.76
30 Oct 2026
(mod_security) mod_security (id:930130) triggered by 193.32.162.76 (NL/The Netherlands/-): 1 in the ...
show more
(mod_security) mod_security (id:930130) triggered by 193.32.162.76 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 21:05:26.583350 2026] [security2:error] [pid 3223328:tid 3223459] [client 193.32.162.76:57326] ModSecurity: Access denied with code 406 (phase 1). Matched phrase ".git/" at REQUEST_FILENAME. [file "/etc/modsecurity.d/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "150"] [id "930130"] [msg "Restricted File Access Attempt"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-LFI"] [tag "capec/1000/255/153/126"] [redacted] [uri "/.git/HEAD"] [unique_id "auPtVn8K8oDonOpIoUAQZQAAADA"]
show less
Port Scan
🇫🇷
91.231.89.68
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 91.231.89.68 (FR/France/greer.probe.onyphe.net) ...
show more
(mod_security) mod_security (id:920350) triggered by 91.231.89.68 (FR/France/greer.probe.onyphe.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 20:47:35.589090 2026] [security2:error] [pid 3223328:tid 3223448] [client 91.231.89.68:51579] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auPpJ38K8oDonOpIoUAOmgAAACU"]
show less
Port Scan
🇺🇸
47.251.125.33
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 47.251.125.33 (US/United States/-): 1 in the la ...
show more
(mod_security) mod_security (id:920350) triggered by 47.251.125.33 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 20:28:50.209647 2026] [security2:error] [pid 3223328:tid 3223470] [client 47.251.125.33:11518] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auPkwn8K8oDonOpIoUAMngAAADs"]
show less
Port Scan
🇰🇷
43.155.129.131
30 Oct 2026
(mod_security) mod_security (id:920210) triggered by 43.155.129.131 (KR/South Korea/-): 1 in the las ...
show more
(mod_security) mod_security (id:920210) triggered by 43.155.129.131 (KR/South Korea/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 20:19:22.173626 2026] [security2:error] [pid 3223328:tid 3223449] [client 43.155.129.131:52662] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auPiin8K8oDonOpIoUALjQAAACY"]
show less
Port Scan
🇵🇰
223.123.71.210
30 Oct 2026
(mod_security) mod_security (id:920340) triggered by 223.123.71.210 (PK/Pakistan/-): 1 in the last 3 ...
show more
(mod_security) mod_security (id:920340) triggered by 223.123.71.210 (PK/Pakistan/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 20:15:28.927282 2026] [security2:error] [pid 3223328:tid 3223463] [client 223.123.71.210:3944] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "728"] [id "920340"] [msg "Content-Type header missing from request with non-zero Content-Length"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/GponForm/diag_Form"] [unique_id "auPhoH8K8oDonOpIoUALKgAAADQ"]
show less
Port Scan
🇺🇸
134.33.97.105
29 Oct 2026
(mod_security) mod_security (id:913100) triggered by 134.33.97.105 (US/United States/azpdwsomumvu.st ...
show more
(mod_security) mod_security (id:913100) triggered by 134.33.97.105 (US/United States/azpdwsomumvu.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 19:57:00.927039 2026] [security2:error] [pid 3223328:tid 3223458] [client 134.33.97.105:57460] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/portal/redlion"] [unique_id "auPdTH8K8oDonOpIoUAI9gAAAC8"]
show less
Port Scan
🇧🇪
34.78.7.72
29 Oct 2026
(mod_security) mod_security (id:920350) triggered by 34.78.7.72 (BE/Belgium/72.7.78.34.bc.googleuser ...
show more
(mod_security) mod_security (id:920350) triggered by 34.78.7.72 (BE/Belgium/72.7.78.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 19:18:01.873768 2026] [security2:error] [pid 3223328:tid 3223442] [client 34.78.7.72:48334] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auPUKX8K8oDonOpIoUAEsQAAAB8"]
show less
Port Scan
🇳🇱
159.223.2.237
29 Oct 2026
(mod_security) mod_security (id:920350) triggered by 159.223.2.237 (NL/The Netherlands/-): 1 in the ...
show more
(mod_security) mod_security (id:920350) triggered by 159.223.2.237 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 18:18:04.050495 2026] [security2:error] [pid 1544855:tid 1544969] [client 159.223.2.237:36532] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auPGHDDU0T7rBPu7khtCvQAAAF8"]
show less
Port Scan
🇹🇼
198.235.24.74
29 Oct 2026
(mod_security) mod_security (id:920280) triggered by 198.235.24.74 (US/United States/-): 1 in the la ...
show more
(mod_security) mod_security (id:920280) triggered by 198.235.24.74 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 18:01:31.195706 2026] [security2:error] [pid 1544855:tid 1544999] [client 198.235.24.74:55930] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auPCOzDU0T7rBPu7khtA-QAAAH0"]
show less
Port Scan
🇺🇸
43.153.123.4
29 Oct 2026
(mod_security) mod_security (id:920210) triggered by 43.153.123.4 (US/United States/-): 1 in the las ...
show more
(mod_security) mod_security (id:920210) triggered by 43.153.123.4 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 17:25:24.535119 2026] [security2:error] [pid 1544855:tid 1544987] [client 43.153.123.4:50992] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auO5xDDU0T7rBPu7khs8tQAAAHE"]
show less
Port Scan
🇺🇸
66.132.172.215
29 Oct 2026
(mod_security) mod_security (id:920350) triggered by 66.132.172.215 (US/United States/215.172.132.66 ...
show more
(mod_security) mod_security (id:920350) triggered by 66.132.172.215 (US/United States/215.172.132.66.censys-scanner.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 16:47:38.040244 2026] [security2:error] [pid 1544855:tid 1544975] [client 66.132.172.215:27792] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auOw6jDU0T7rBPu7khs4qAAAAGU"]
show less
Port Scan
🇹🇼
198.235.24.86
29 Oct 2026
(mod_security) mod_security (id:920350) triggered by 198.235.24.86 (US/United States/-): 1 in the la ...
show more
(mod_security) mod_security (id:920350) triggered by 198.235.24.86 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 15:14:03.402570 2026] [security2:error] [pid 1544855:tid 1544954] [client 198.235.24.86:59720] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auOa-zDU0T7rBPu7khsueQAAAFA"]
show less
Port Scan
🇫🇷
89.117.51.160
29 Oct 2026
(mod_security) mod_security (id:920350) triggered by 89.117.51.160 (US/United States/vmi1790462.cont ...
show more
(mod_security) mod_security (id:920350) triggered by 89.117.51.160 (US/United States/vmi1790462.contaboserver.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 14:53:42.057872 2026] [security2:error] [pid 1544855:tid 1544946] [client 89.117.51.160:35446] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/settings.php.save"] [unique_id "auOWNjDU0T7rBPu7khssRgAAAEg"]
show less
Port Scan
🇧🇪
35.195.79.129
29 Oct 2026
(ftpd) Failed FTP login from 35.195.79.129 (BE/Belgium/129.79.195.35.bc.googleusercontent.com): 1 in ...
show more
(ftpd) Failed FTP login from 35.195.79.129 (BE/Belgium/129.79.195.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 29 14:46:57 web pure-ftpd: ([email protected] ) [WARNING] Authentication failed for user [anonymous]
show less
Port Scan
🇨🇭
107.189.13.11
29 Oct 2026
(ftpd) Failed FTP login from 107.189.13.11 (LU/Luxembourg/-): 1 in the last 3600 secs; Ports: *; Dir ...
show more
(ftpd) Failed FTP login from 107.189.13.11 (LU/Luxembourg/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 29 14:34:46 web pure-ftpd: ([email protected] ) [WARNING] Authentication failed for user [polycomftp]
show less
Port Scan
🇺🇸
44.220.185.100
29 Oct 2026
(mod_security) mod_security (id:920350) triggered by 44.220.185.100 (US/United States/scanner-44-220 ...
show more
(mod_security) mod_security (id:920350) triggered by 44.220.185.100 (US/United States/scanner-44-220-185-100.reposify.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 13:10:41.807405 2026] [security2:error] [pid 1544855:tid 1545001] [client 44.220.185.100:35390] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auN-ETDU0T7rBPu7khshqwAAAH8"]
show less
Port Scan
🇿🇦
203.123.87.2
29 Oct 2026
(eximsyntax) Exim syntax errors from 203.123.87.2 (ZA/South Africa/ecs-203-123-87-2.compute.hwclouds ...
show more
(eximsyntax) Exim syntax errors from 203.123.87.2 (ZA/South Africa/ecs-203-123-87-2.compute.hwclouds-dns.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2026-10-29 12:13:54 SMTP call from ecs-203-123-87-2.compute.hwclouds-dns.com [203.123.87.2] dropped: too many syntax or protocol errors (last command was "?", NULL)
show less
Port Scan
🇺🇸
192.155.90.220
29 Oct 2026
(mod_security) mod_security (id:920350) triggered by 192.155.90.220 (US/United States/bern.scan.buff ...
show more
(mod_security) mod_security (id:920350) triggered by 192.155.90.220 (US/United States/bern.scan.bufferover.run): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 12:04:58.640526 2026] [security2:error] [pid 2295373:tid 2295718] [client 192.155.90.220:29368] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auNuqm0wqQMla56JUuaatgAAAAM"]
show less
Port Scan
🇺🇸
45.156.129.100
29 Oct 2026
(mod_security) mod_security (id:920350) triggered by 45.156.129.100 (US/United States/sh-chi-us-gp7- ...
show more
(mod_security) mod_security (id:920350) triggered by 45.156.129.100 (US/United States/sh-chi-us-gp7-wk142a.internet-census.org): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 11:38:46.016190 2026] [security2:error] [pid 2295373:tid 2295740] [client 45.156.129.100:15114] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auNohm0wqQMla56JUuaZfgAAAA0"]
show less
Port Scan
🇭🇰
124.156.179.141
29 Oct 2026
(mod_security) mod_security (id:920210) triggered by 124.156.179.141 (HK/Hong Kong/-): 1 in the last ...
show more
(mod_security) mod_security (id:920210) triggered by 124.156.179.141 (HK/Hong Kong/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 10:24:03.401208 2026] [security2:error] [pid 2295374:tid 2295875] [client 124.156.179.141:60134] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auNXAxoCKb-Ova9bb6VHFAAAAGc"]
show less
Port Scan
🇺🇸
107.21.135.85
29 Oct 2026
(mod_security) mod_security (id:920350) triggered by 107.21.135.85 (US/United States/ec2-107-21-135- ...
show more
(mod_security) mod_security (id:920350) triggered by 107.21.135.85 (US/United States/ec2-107-21-135-85.compute-1.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 10:04:09.098221 2026] [security2:error] [pid 2295373:tid 2295755] [client 107.21.135.85:64268] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auNSWW0wqQMla56JUuaU9gAAABc"]
show less
Port Scan
🇩🇪
2a01:4020:31:0:102::3b7
29 Oct 2026
(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::3b7 (Unknown): 1 in the las ...
show more
(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::3b7 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 10:02:55.170253 2026] [security2:error] [pid 2295373:tid 2295728] [client 2a01:4020:31:0:102::3b7:9284] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/sse"] [unique_id "auNSD20wqQMla56JUuaU5QAAAAg"]
show less
Port Scan
🇬🇧
2a01:4020:1:1:102::1d5
29 Oct 2026
(mod_security) mod_security (id:920350) triggered by 2a01:4020:1:1:102::1d5 (Unknown): 1 in the last ...
show more
(mod_security) mod_security (id:920350) triggered by 2a01:4020:1:1:102::1d5 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Thu Oct 29 10:02:42.060773 2026] [security2:error] [pid 2295373:tid 2295828] [client 2a01:4020:1:1:102::1d5:16413] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auNSAm0wqQMla56JUuaU3wAAADk"]
show less
Port Scan