🇨🇳
106.75.139.54
14 hours ago
(mod_security) mod_security (id:920350) triggered by 106.75.139.54 (CN/China/-): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920350) triggered by 106.75.139.54 (CN/China/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 18:45:55.429911 2026] [security2:error] [pid 452602:tid 452710] [client 106.75.139.54:30938] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at6Go_gYXYk-U9_zzNTSugAAABM"]
show less
Port Scan
🇨🇳
106.75.5.165
14 hours ago
(mod_security) mod_security (id:920350) triggered by 106.75.5.165 (CN/China/qdlhvgg.cn): 1 in the la ...
show more
(mod_security) mod_security (id:920350) triggered by 106.75.5.165 (CN/China/qdlhvgg.cn): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 18:45:14.418781 2026] [security2:error] [pid 452602:tid 452754] [client 106.75.5.165:46022] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/version"] [unique_id "at6GevgYXYk-U9_zzNTSpgAAAD8"]
show less
Port Scan
🇺🇸
71.6.199.23
15 hours ago
(eximsyntax) Exim syntax errors from 71.6.199.23 (US/United States/einstein.census.shodan.io): 1 in ...
show more
(eximsyntax) Exim syntax errors from 71.6.199.23 (US/United States/einstein.census.shodan.io): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2026-10-25 17:46:17 SMTP call from einstein.census.shodan.io [71.6.199.23] dropped: too many syntax or protocol errors (last command was "?", NULL)
show less
Port Scan
🇺🇸
49.51.36.179
15 hours ago
(mod_security) mod_security (id:920210) triggered by 49.51.36.179 (US/United States/-): 1 in the las ...
show more
(mod_security) mod_security (id:920210) triggered by 49.51.36.179 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 17:19:09.118772 2026] [security2:error] [pid 452602:tid 452743] [client 49.51.36.179:39212] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at5yTfgYXYk-U9_zzNTHBwAAADQ"]
show less
Port Scan
🇺🇸
198.211.98.172
17 hours ago
(mod_security) mod_security (id:920350) triggered by 198.211.98.172 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920350) triggered by 198.211.98.172 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 16:04:17.036071 2026] [security2:error] [pid 452602:tid 452735] [client 198.211.98.172:34854] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at5gwfgYXYk-U9_zzNS_XQAAACw"]
show less
Port Scan
🇬🇧
2a06:4883:d000::da
17 hours ago
(mod_security) mod_security (id:920350) triggered by 2a06:4883:d000::da (r4-218-da.monitoring.intern ...
show more
(mod_security) mod_security (id:920350) triggered by 2a06:4883:d000::da (r4-218-da.monitoring.internet-measurement.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 15:44:08.239312 2026] [security2:error] [pid 452602:tid 452737] [client 2a06:4883:d000::da:49649] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at5cCPgYXYk-U9_zzNS9RQAAAC4"]
show less
Port Scan
🇲🇾
47.250.178.39
17 hours ago
(mod_security) mod_security (id:920350) triggered by 47.250.178.39 (MY/Malaysia/-): 1 in the last 36 ...
show more
(mod_security) mod_security (id:920350) triggered by 47.250.178.39 (MY/Malaysia/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 15:27:53.317823 2026] [security2:error] [pid 452602:tid 452727] [client 47.250.178.39:45886] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at5YOfgYXYk-U9_zzNS7ngAAACQ"]
show less
Port Scan
🇨🇳
59.63.214.38
17 hours ago
(mod_security) mod_security (id:920350) triggered by 59.63.214.38 (CN/China/-): 1 in the last 3600 s ...
show more
(mod_security) mod_security (id:920350) triggered by 59.63.214.38 (CN/China/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 15:22:20.926080 2026] [security2:error] [pid 452602:tid 452717] [client 59.63.214.38:55682] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at5W7PgYXYk-U9_zzNS7DgAAABo"]
show less
Port Scan
🇧🇪
198.235.24.198
18 hours ago
(mod_security) mod_security (id:920280) triggered by 198.235.24.198 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920280) triggered by 198.235.24.198 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 14:42:32.381030 2026] [security2:error] [pid 452602:tid 452683] [client 198.235.24.198:54280] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at5NmPgYXYk-U9_zzNS21QAAAAo"]
show less
Port Scan
🇳🇱
185.196.220.132
18 hours ago
(mod_security) mod_security (id:930130) triggered by 185.196.220.132 (DE/Germany/-): 1 in the last 3 ...
show more
(mod_security) mod_security (id:930130) triggered by 185.196.220.132 (DE/Germany/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 14:39:35.360283 2026] [security2:error] [pid 452602:tid 452686] [client 185.196.220.132:5974] ModSecurity: Access denied with code 406 (phase 1). Matched phrase ".env" at REQUEST_FILENAME. [file "/etc/modsecurity.d/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "150"] [id "930130"] [msg "Restricted File Access Attempt"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-LFI"] [tag "capec/1000/255/153/126"] [redacted] [uri "/.env.local"] [unique_id "at5M5_gYXYk-U9_zzNS2QgAAAA0"]
show less
Port Scan
🇹🇭
43.164.0.96
19 hours ago
(mod_security) mod_security (id:920210) triggered by 43.164.0.96 (TH/Thailand/-): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920210) triggered by 43.164.0.96 (TH/Thailand/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 13:57:46.977983 2026] [security2:error] [pid 452602:tid 452735] [client 43.164.0.96:54500] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at5DGvgYXYk-U9_zzNSxygAAACw"]
show less
Port Scan
🇸🇬
47.245.105.222
19 hours ago
(sshd) Failed SSH login from 47.245.105.222 (SG/Singapore/-): 1 in the last 3600 secs; Ports: *; Dir ...
show more
(sshd) Failed SSH login from 47.245.105.222 (SG/Singapore/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 25 13:56:07 web sshd[704816]: Invalid user from 47.245.105.222 port 56304
show less
Port Scan
🇺🇸
66.228.62.150
19 hours ago
(mod_security) mod_security (id:913100) triggered by 66.228.62.150 (US/United States/66-228-62-150.i ...
show more
(mod_security) mod_security (id:913100) triggered by 66.228.62.150 (US/United States/66-228-62-150.ip.linodeusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 13:34:15.067906 2026] [security2:error] [pid 452602:tid 452712] [client 66.228.62.150:48221] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/"] [unique_id "at49l_gYXYk-U9_zzNSvaQAAABU"]
show less
Port Scan
🇩🇪
167.94.146.59
19 hours ago
(mod_security) mod_security (id:920350) triggered by 167.94.146.59 (DE/Germany/59.146.94.167.censys- ...
show more
(mod_security) mod_security (id:920350) triggered by 167.94.146.59 (DE/Germany/59.146.94.167.censys-scanner.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 13:33:05.928721 2026] [security2:error] [pid 452602:tid 452726] [client 167.94.146.59:23838] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at49UfgYXYk-U9_zzNSvQwAAACM"]
show less
Port Scan
🇺🇸
147.185.132.40
20 hours ago
(mod_security) mod_security (id:920350) triggered by 147.185.132.40 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920350) triggered by 147.185.132.40 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 12:34:26.017184 2026] [security2:error] [pid 1131863:tid 1132362] [client 147.185.132.40:57520] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at4vkgKLsZgJNB9ix_WT5AAAAP4"]
show less
Port Scan
🇸🇪
93.158.90.69
20 hours ago
(mod_security) mod_security (id:920350) triggered by 93.158.90.69 (SE/Sweden/-): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920350) triggered by 93.158.90.69 (SE/Sweden/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 12:33:05.518659 2026] [security2:error] [pid 1131863:tid 1132270] [client 93.158.90.69:43003] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at4vQQKLsZgJNB9ix_WS7QAAAM0"]
show less
Port Scan
🇺🇸
20.40.252.29
21 hours ago
(mod_security) mod_security (id:913100) triggered by 20.40.252.29 (US/United States/-): 1 in the las ...
show more
(mod_security) mod_security (id:913100) triggered by 20.40.252.29 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 12:13:14.482734 2026] [security2:error] [pid 1131863:tid 1132341] [client 20.40.252.29:49468] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/developmentserver/metadatauploader"] [unique_id "at4qmgKLsZgJNB9ix_WQeAAAAPM"]
show less
Port Scan
🇧🇪
35.195.36.41
22 hours ago
(mod_security) mod_security (id:920350) triggered by 35.195.36.41 (BE/Belgium/41.36.195.35.bc.google ...
show more
(mod_security) mod_security (id:920350) triggered by 35.195.36.41 (BE/Belgium/41.36.195.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 10:42:42.690946 2026] [security2:error] [pid 1131861:tid 1132295] [client 35.195.36.41:58532] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at4VYkLaED5ePaIkf6iIGQAAAEg"]
show less
Port Scan
🇺🇸
49.51.72.76
22 hours ago
(mod_security) mod_security (id:920210) triggered by 49.51.72.76 (US/United States/-): 1 in the last ...
show more
(mod_security) mod_security (id:920210) triggered by 49.51.72.76 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 10:40:35.073698 2026] [security2:error] [pid 1131861:tid 1132288] [client 49.51.72.76:50606] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at4U40LaED5ePaIkf6iH9wAAAEQ"]
show less
Port Scan
🇳🇱
209.38.33.62
22 hours ago
(mod_security) mod_security (id:920350) triggered by 209.38.33.62 (NL/The Netherlands/109923.foreste ...
show more
(mod_security) mod_security (id:920350) triggered by 209.38.33.62 (NL/The Netherlands/109923.forestengine.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 10:26:04.409304 2026] [security2:error] [pid 1131863:tid 1132275] [client 209.38.33.62:52144] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at4RfAKLsZgJNB9ix_WLHwAAANI"]
show less
Port Scan
🇳🇱
159.65.206.123
22 hours ago
(mod_security) mod_security (id:920350) triggered by 159.65.206.123 (NL/The Netherlands/-): 1 in the ...
show more
(mod_security) mod_security (id:920350) triggered by 159.65.206.123 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 10:24:53.933198 2026] [security2:error] [pid 1131861:tid 1132382] [client 159.65.206.123:59384] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.git/config"] [unique_id "at4RNULaED5ePaIkf6iHGgAAAHs"]
show less
Port Scan
🇨🇳
124.88.113.97
23 hours ago
(mod_security) mod_security (id:920350) triggered by 124.88.113.97 (CN/China/-): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920350) triggered by 124.88.113.97 (CN/China/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 10:07:30.891931 2026] [security2:error] [pid 1131861:tid 1132313] [client 124.88.113.97:17268] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at4NIkLaED5ePaIkf6iGDQAAAFE"]
show less
Port Scan
🇺🇸
54.166.203.225
23 hours ago
(mod_security) mod_security (id:920350) triggered by 54.166.203.225 (US/United States/ec2-54-166-203 ...
show more
(mod_security) mod_security (id:920350) triggered by 54.166.203.225 (US/United States/ec2-54-166-203-225.compute-1.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 10:03:24.684882 2026] [security2:error] [pid 1131861:tid 1132378] [client 54.166.203.225:54408] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "at4MLELaED5ePaIkf6iFywAAAHc"]
show less
Port Scan
🇩🇪
2a01:4020:31:0:102::2ec
23 hours ago
(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::2ec (Unknown): 1 in the las ...
show more
(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::2ec (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 10:01:19.862813 2026] [security2:error] [pid 1131861:tid 1132340] [client 2a01:4020:31:0:102::2ec:14826] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/mcp"] [unique_id "at4Lr0LaED5ePaIkf6iFqgAAAF8"]
show less
Port Scan
🇩🇪
2a01:4020:31:0:102::62e
23 hours ago
(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::62e (Unknown): 1 in the las ...
show more
(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::62e (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Oct 25 10:01:20.030323 2026] [security2:error] [pid 1131861:tid 1132349] [client 2a01:4020:31:0:102::62e:13266] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/sse"] [unique_id "at4LsELaED5ePaIkf6iFrAAAAGM"]
show less
Port Scan