AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User itsnixk joined AbuseIPDB in April 2026 and has reported 7,957 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇺🇸 97.74.230.245	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 97.74.230.245 (US/United States/245.230.74.97.h ... show more (mod_security) mod_security (id:920350) triggered by 97.74.230.245 (US/United States/245.230.74.97.host.secureserver.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 15:21:38.538915 2026] [security2:error] [pid 3363996:tid 3364129] [client 97.74.230.245:59450] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.git/HEAD"] [unique_id "auJLQrzRNsFip_rbw7VQKgAAADI"] show less	Port Scan
🇺🇸 43.166.244.192	28 Oct 2026	(mod_security) mod_security (id:920210) triggered by 43.166.244.192 (US/United States/-): 1 in the l ... show more (mod_security) mod_security (id:920210) triggered by 43.166.244.192 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 14:40:12.862580 2026] [security2:error] [pid 3363996:tid 3364101] [client 43.166.244.192:59704] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive\|close),\\\\s?(?:keep-alive\|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auJBjLzRNsFip_rbw7VL4wAAABY"] show less	Port Scan
🇺🇸 104.30.167.164	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 104.30.167.164 (CA/Canada/-): 1 in the last 360 ... show more (mod_security) mod_security (id:920350) triggered by 104.30.167.164 (CA/Canada/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 14:08:11.042224 2026] [security2:error] [pid 3363996:tid 3364104] [client 104.30.167.164:58449] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auI6C7zRNsFip_rbw7VIYgAAABk"] show less	Port Scan
🇺🇸 2a09:bac0:1000:c48::2e9:8a	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 2a09:bac0:1000:c48::2e9:8a (Unknown): 1 in the ... show more (mod_security) mod_security (id:920350) triggered by 2a09:bac0:1000:c48::2e9:8a (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 14:08:11.042225 2026] [security2:error] [pid 3363996:tid 3364102] [client 2a09:bac0:1000:c48::2e9:8a:23860] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auI6C7zRNsFip_rbw7VIYQAAABc"] show less	Port Scan
🇺🇸 20.80.92.173	28 Oct 2026	(eximsyntax) Exim syntax errors from 20.80.92.173 (US/United States/-): 1 in the last 3600 secs; Por ... show more (eximsyntax) Exim syntax errors from 20.80.92.173 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2026-10-28 13:40:21 SMTP call from [20.80.92.173] dropped: too many syntax or protocol errors (last command was "?", NULL) show less	Port Scan
🇹🇼 198.235.24.83	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 198.235.24.83 (US/United States/-): 1 in the la ... show more (mod_security) mod_security (id:920350) triggered by 198.235.24.83 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 12:42:37.208277 2026] [security2:error] [pid 4099497:tid 4099886] [client 198.235.24.83:59562] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auIl_XrK48MFtZtZLgUJZQAAAHk"] show less	Port Scan
🇬🇧 2a06:4884:3000::29	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 2a06:4884:3000::29 (r5-41-29.monitoring.interne ... show more (mod_security) mod_security (id:920350) triggered by 2a06:4884:3000::29 (r5-41-29.monitoring.internet-measurement.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 12:28:56.890795 2026] [security2:error] [pid 4099497:tid 4099861] [client 2a06:4884:3000::29:54651] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auIiyHrK48MFtZtZLgUH9AAAAGA"] show less	Port Scan
🇺🇸 64.94.85.37	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 64.94.85.37 (US/United States/-): 1 in the last ... show more (mod_security) mod_security (id:920350) triggered by 64.94.85.37 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 12:00:21.971504 2026] [security2:error] [pid 4099497:tid 4099851] [client 64.94.85.37:43684] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/api/metrics/run"] [unique_id "auIcFXrK48MFtZtZLgUEYAAAAFY"] show less	Port Scan
🇺🇸 109.105.209.35	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 109.105.209.35 (US/United States/zl-laxk-us-gp7 ... show more (mod_security) mod_security (id:920350) triggered by 109.105.209.35 (US/United States/zl-laxk-us-gp7-wk141d.internet-census.org): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 11:50:43.407047 2026] [security2:error] [pid 4099497:tid 4099876] [client 109.105.209.35:30848] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auIZ03rK48MFtZtZLgUDcQAAAG8"] show less	Port Scan
🇸🇬 124.156.206.145	28 Oct 2026	(mod_security) mod_security (id:920210) triggered by 124.156.206.145 (SG/Singapore/-): 1 in the last ... show more (mod_security) mod_security (id:920210) triggered by 124.156.206.145 (SG/Singapore/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 11:18:53.314410 2026] [security2:error] [pid 4099497:tid 4099883] [client 124.156.206.145:50548] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive\|close),\\\\s?(?:keep-alive\|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auISXXrK48MFtZtZLgUBlgAAAHY"] show less	Port Scan
🇺🇸 172.236.228.111	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 172.236.228.111 (US/United States/172-236-228-1 ... show more (mod_security) mod_security (id:920350) triggered by 172.236.228.111 (US/United States/172-236-228-111.ip.linodeusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 10:51:33.683050 2026] [security2:error] [pid 4099565:tid 4099980] [client 172.236.228.111:40796] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auIL9dHKcIRnIXxCPtp4gwAAAVU"] show less	Port Scan
🇧🇷 201.148.118.8	28 Oct 2026	(eximsyntax) Exim syntax errors from 201.148.118.8 (BR/Brazil/201-148-118-8.tvactelecom.com.br): 1 i ... show more (eximsyntax) Exim syntax errors from 201.148.118.8 (BR/Brazil/201-148-118-8.tvactelecom.com.br): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_TRIGGER; Logs: 2026-10-28 10:37:59 SMTP call from [201.148.118.8] dropped: too many syntax or protocol errors (last command was "ÅaüÆzfQ:Ë\027¡\¿5¦)/\025\016Ù\v¦ÑÊ¶{ºÑÛ§FRÖª\004ú\"ÏÙñ¦/ÈO\002}\017M£:qÆ\\004Ó¯X/ÂV\033áz\031 9É¶Ø¸\020ÜÍµ'âAf+ZÌaÃ\023\024\002ÿâ4¯kÑXÐ ø}hy$Éç\022Ü«-Hz\030\025ëÅËW>ZTxuIjñÓ\007p\005\024È{SÛ\003\0366ÿ´RÉp ÐQXÊ\035.9h\007´h'Qûòï\027Ë\"&n{Ihgm>\007\033ú\bqÒÄa!~i/mýø:\027õrâÝ£»5\032xyeà·Êª\023ÿ\017IèiSõ\034¸x9o³Ó>õZÐÙ'ã", NULL) show less	Port Scan
🇳🇱 188.166.39.44	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 188.166.39.44 (NL/The Netherlands/-): 1 in the ... show more (mod_security) mod_security (id:920350) triggered by 188.166.39.44 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 10:29:09.623617 2026] [security2:error] [pid 4099497:tid 4099853] [client 188.166.39.44:47664] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auIGtXrK48MFtZtZLgX_MwAAAFg"] show less	Port Scan
🇺🇸 44.203.143.87	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 44.203.143.87 (US/United States/ec2-44-203-143- ... show more (mod_security) mod_security (id:920350) triggered by 44.203.143.87 (US/United States/ec2-44-203-143-87.compute-1.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 10:07:25.812720 2026] [security2:error] [pid 4099497:tid 4099876] [client 44.203.143.87:41436] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auIBnXrK48MFtZtZLgX-OQAAAG8"] show less	Port Scan
🇩🇪 2a01:4020:31:0:102::688	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::688 (Unknown): 1 in the las ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::688 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 10:01:36.486296 2026] [security2:error] [pid 4099497:tid 4099886] [client 2a01:4020:31:0:102::688:9252] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/sse"] [unique_id "auIAQHrK48MFtZtZLgX9-wAAAHk"] show less	Port Scan
🇺🇸 18.116.101.220	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 18.116.101.220 (US/United States/scan.visionhei ... show more (mod_security) mod_security (id:920350) triggered by 18.116.101.220 (US/United States/scan.visionheight.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 10:01:34.171730 2026] [security2:error] [pid 4099565:tid 4099990] [client 18.116.101.220:49478] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auIAPtHKcIRnIXxCPtp1xAAAAV8"] show less	Port Scan
🇩🇪 2a01:4020:31:0:102::110	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::110 (Unknown): 1 in the las ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::110 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 10:01:36.149732 2026] [security2:error] [pid 4099565:tid 4099997] [client 2a01:4020:31:0:102::110:9956] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/favicon.ico"] [unique_id "auIAQNHKcIRnIXxCPtp1xgAAAWY"] show less	Port Scan
🇩🇪 2a01:4020:31:0:102::152	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::152 (Unknown): 1 in the las ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::152 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 10:01:35.981037 2026] [security2:error] [pid 4099565:tid 4099994] [client 2a01:4020:31:0:102::152:1586] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auIAP9HKcIRnIXxCPtp1xQAAAWM"] show less	Port Scan
🇩🇪 2a01:4020:31:0:102::21d	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::21d (Unknown): 1 in the las ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::21d (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 10:01:36.318872 2026] [security2:error] [pid 4099497:tid 4099879] [client 2a01:4020:31:0:102::21d:4068] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/api/mcp"] [unique_id "auIAQHrK48MFtZtZLgX9-QAAAHI"] show less	Port Scan
🇩🇪 2a01:4020:31:0:102::4bf	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::4bf (Unknown): 1 in the las ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::4bf (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 10:01:36.319009 2026] [security2:error] [pid 4099497:tid 4099878] [client 2a01:4020:31:0:102::4bf:6730] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/mcp"] [unique_id "auIAQHrK48MFtZtZLgX9-gAAAHE"] show less	Port Scan
🇩🇪 2a01:4020:31:0:102::633	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::633 (Unknown): 1 in the las ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::633 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 10:01:36.317921 2026] [security2:error] [pid 4099497:tid 4099879] [client 2a01:4020:31:0:102::633:2912] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auIAQHrK48MFtZtZLgX9-AAAAHI"] show less	Port Scan
🇩🇪 2a01:4020:31:0:102::684	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::684 (Unknown): 1 in the las ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::684 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 10:01:36.317504 2026] [security2:error] [pid 4099497:tid 4099882] [client 2a01:4020:31:0:102::684:11350] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/mcp/"] [unique_id "auIAQHrK48MFtZtZLgX99wAAAHU"] show less	Port Scan
🇬🇧 2a01:4020:1:1:101::717	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:1:1:101::717 (Unknown): 1 in the last ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:1:1:101::717 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 10:01:32.946463 2026] [security2:error] [pid 4099497:tid 4099877] [client 2a01:4020:1:1:101::717:34001] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auIAPHrK48MFtZtZLgX99gAAAHA"] show less	Port Scan
🇨🇴 181.51.198.230	28 Oct 2026	(mod_security) mod_security (id:920350) triggered by 181.51.198.230 (CO/Colombia/static-ip-181510198 ... show more (mod_security) mod_security (id:920350) triggered by 181.51.198.230 (CO/Colombia/static-ip-181510198230.cable.net.co): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 09:59:22.036953 2026] [security2:error] [pid 4099497:tid 4099869] [client 181.51.198.230:52398] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auH_unrK48MFtZtZLgX92QAAAGg"] show less	Port Scan
🇺🇸 34.60.172.248	28 Oct 2026	(mod_security) mod_security (id:911100) triggered by 34.60.172.248 (US/United States/248.172.60.34.b ... show more (mod_security) mod_security (id:911100) triggered by 34.60.172.248 (US/United States/248.172.60.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 08:10:24.422206 2026] [security2:error] [pid 4099565:tid 4100003] [client 34.60.172.248:42524] ModSecurity: Access denied with code 406 (phase 1). Match of "within %{tx.allowed_methods}" against "REQUEST_METHOD" required. [file "/etc/modsecurity.d/REQUEST-911-METHOD-ENFORCEMENT.conf"] [line "44"] [id "911100"] [msg "Method is not allowed by policy"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/METHOD-ENFORCEMENT"] [tag "capec/1000/210/272/220/274"] [redacted] [uri "/"] [unique_id "auHmMNHKcIRnIXxCPtpvjgAAAWw"] show less	Port Scan