🇨🇴
181.51.198.230
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 181.51.198.230 (CO/Colombia/static-ip-181510198 ...
show more
(mod_security) mod_security (id:920350) triggered by 181.51.198.230 (CO/Colombia/static-ip-181510198230.cable.net.co): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 09:59:22.036953 2026] [security2:error] [pid 4099497:tid 4099869] [client 181.51.198.230:52398] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auH_unrK48MFtZtZLgX92QAAAGg"]
show less
Port Scan
🇺🇸
34.60.172.248
28 Oct 2026
(mod_security) mod_security (id:911100) triggered by 34.60.172.248 (US/United States/248.172.60.34.b ...
show more
(mod_security) mod_security (id:911100) triggered by 34.60.172.248 (US/United States/248.172.60.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 08:10:24.422206 2026] [security2:error] [pid 4099565:tid 4100003] [client 34.60.172.248:42524] ModSecurity: Access denied with code 406 (phase 1). Match of "within %{tx.allowed_methods}" against "REQUEST_METHOD" required. [file "/etc/modsecurity.d/REQUEST-911-METHOD-ENFORCEMENT.conf"] [line "44"] [id "911100"] [msg "Method is not allowed by policy"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/METHOD-ENFORCEMENT"] [tag "capec/1000/210/272/220/274"] [redacted] [uri "/"] [unique_id "auHmMNHKcIRnIXxCPtpvjgAAAWw"]
show less
Port Scan
🇯🇵
8.216.4.69
28 Oct 2026
(eximsyntax) Exim syntax errors from 8.216.4.69 (JP/Japan/-): 1 in the last 3600 secs; Ports: *; Dir ...
show more
(eximsyntax) Exim syntax errors from 8.216.4.69 (JP/Japan/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2026-10-28 07:26:27 SMTP call from [8.216.4.69] dropped: too many syntax or protocol errors (last command was "?", NULL)
show less
Port Scan
🇹🇼
34.81.129.88
28 Oct 2026
(mod_security) mod_security (id:911100) triggered by 34.81.129.88 (TW/Taiwan/88.129.81.34.bc.googleu ...
show more
(mod_security) mod_security (id:911100) triggered by 34.81.129.88 (TW/Taiwan/88.129.81.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 07:15:07.286485 2026] [security2:error] [pid 4099565:tid 4099984] [client 34.81.129.88:52318] ModSecurity: Access denied with code 406 (phase 1). Match of "within %{tx.allowed_methods}" against "REQUEST_METHOD" required. [file "/etc/modsecurity.d/REQUEST-911-METHOD-ENFORCEMENT.conf"] [line "44"] [id "911100"] [msg "Method is not allowed by policy"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/METHOD-ENFORCEMENT"] [tag "capec/1000/210/272/220/274"] [redacted] [uri "/"] [unique_id "auHZO9HKcIRnIXxCPtpsVwAAAVk"]
show less
Port Scan
🇺🇸
104.30.167.174
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 104.30.167.174 (CA/Canada/-): 1 in the last 360 ...
show more
(mod_security) mod_security (id:920350) triggered by 104.30.167.174 (CA/Canada/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 07:14:38.541868 2026] [security2:error] [pid 4099565:tid 4099964] [client 104.30.167.174:43604] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auHZHtHKcIRnIXxCPtpsUQAAAUU"]
show less
Port Scan
🇩🇪
47.245.142.92
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 47.245.142.92 (DE/Germany/-): 1 in the last 360 ...
show more
(mod_security) mod_security (id:920350) triggered by 47.245.142.92 (DE/Germany/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 05:43:47.559476 2026] [security2:error] [pid 4099497:tid 4099829] [client 47.245.142.92:54272] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auHD03rK48MFtZtZLgXx5QAAAEE"]
show less
Port Scan
🇳🇱
86.54.31.38
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 86.54.31.38 (NL/The Netherlands/blue2.census.sh ...
show more
(mod_security) mod_security (id:920350) triggered by 86.54.31.38 (NL/The Netherlands/blue2.census.shodan.io): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 05:28:11.716252 2026] [security2:error] [pid 4099565:tid 4099989] [client 86.54.31.38:47752] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auHAK9HKcIRnIXxCPtpmWQAAAV4"]
show less
Port Scan
🇺🇸
170.106.180.246
28 Oct 2026
(mod_security) mod_security (id:920210) triggered by 170.106.180.246 (US/United States/-): 1 in the ...
show more
(mod_security) mod_security (id:920210) triggered by 170.106.180.246 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 04:23:19.106437 2026] [security2:error] [pid 4099497:tid 4099833] [client 170.106.180.246:54538] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auGw93rK48MFtZtZLgXtqQAAAEU"]
show less
Port Scan
🇬🇧
193.32.209.236
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 193.32.209.236 (GB/United Kingdom/193-32-209-23 ...
show more
(mod_security) mod_security (id:920350) triggered by 193.32.209.236 (GB/United Kingdom/193-32-209-236.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 03:43:41.123347 2026] [security2:error] [pid 4099497:tid 4099834] [client 193.32.209.236:7838] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/sse"] [unique_id "auGnrXrK48MFtZtZLgXrxwAAAEY"]
show less
Port Scan
🇬🇧
37.10.113.219
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 37.10.113.219 (GB/United Kingdom/37-10-113-219. ...
show more
(mod_security) mod_security (id:920350) triggered by 37.10.113.219 (GB/United Kingdom/37-10-113-219.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 03:43:31.115200 2026] [security2:error] [pid 4099565:tid 4100005] [client 37.10.113.219:10172] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/mcp"] [unique_id "auGno9HKcIRnIXxCPtpgCgAAAW4"]
show less
Port Scan
🇬🇧
81.19.219.212
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 81.19.219.212 (GB/United Kingdom/81-19-219-212. ...
show more
(mod_security) mod_security (id:920350) triggered by 81.19.219.212 (GB/United Kingdom/81-19-219-212.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 03:43:31.114357 2026] [security2:error] [pid 4099497:tid 4099831] [client 81.19.219.212:1648] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/mcp/"] [unique_id "auGno3rK48MFtZtZLgXrxgAAAEM"]
show less
Port Scan
🇬🇧
89.37.172.142
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 89.37.172.142 (GB/United Kingdom/89-37-172-142. ...
show more
(mod_security) mod_security (id:920350) triggered by 89.37.172.142 (GB/United Kingdom/89-37-172-142.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 03:43:31.115142 2026] [security2:error] [pid 4099565:tid 4100004] [client 89.37.172.142:16188] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auGno9HKcIRnIXxCPtpgCwAAAW0"]
show less
Port Scan
🇬🇧
193.32.209.231
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 193.32.209.231 (GB/United Kingdom/193-32-209-23 ...
show more
(mod_security) mod_security (id:920350) triggered by 193.32.209.231 (GB/United Kingdom/193-32-209-231.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 03:43:30.831639 2026] [security2:error] [pid 4099565:tid 4099994] [client 193.32.209.231:13612] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auGnotHKcIRnIXxCPtpgCAAAAWM"]
show less
Port Scan
🇬🇧
37.10.113.222
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 37.10.113.222 (GB/United Kingdom/37-10-113-222. ...
show more
(mod_security) mod_security (id:920350) triggered by 37.10.113.222 (GB/United Kingdom/37-10-113-222.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 03:43:30.973193 2026] [security2:error] [pid 4099565:tid 4099997] [client 37.10.113.222:8260] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/favicon.ico"] [unique_id "auGnotHKcIRnIXxCPtpgCQAAAWY"]
show less
Port Scan
🇬🇧
89.37.172.145
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 89.37.172.145 (GB/United Kingdom/89-37-172-145. ...
show more
(mod_security) mod_security (id:920350) triggered by 89.37.172.145 (GB/United Kingdom/89-37-172-145.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 03:43:03.142837 2026] [security2:error] [pid 4099565:tid 4099972] [client 89.37.172.145:62676] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auGnh9HKcIRnIXxCPtpgAAAAAU0"]
show less
Port Scan
🇧🇪
34.79.161.206
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 34.79.161.206 (BE/Belgium/206.161.79.34.bc.goog ...
show more
(mod_security) mod_security (id:920350) triggered by 34.79.161.206 (BE/Belgium/206.161.79.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 02:51:20.189044 2026] [security2:error] [pid 4099565:tid 4099985] [client 34.79.161.206:28740] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auGbaNHKcIRnIXxCPtpc_QAAAVo"]
show less
Port Scan
🇺🇸
216.25.90.68
28 Oct 2026
(mod_security) mod_security (id:920280) triggered by 216.25.90.68 (US/United States/-): 1 in the las ...
show more
(mod_security) mod_security (id:920280) triggered by 216.25.90.68 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 02:35:50.390867 2026] [security2:error] [pid 4099497:tid 4099839] [client 216.25.90.68:54558] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auGXxnrK48MFtZtZLgXoqwAAAEs"]
show less
Port Scan
🇺🇸
2602:80d:1008::6e
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 2602:80d:1008::6e (Unknown): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920350) triggered by 2602:80d:1008::6e (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 01:50:04.223886 2026] [security2:error] [pid 4099497:tid 4099862] [client 2602:80d:1008::6e:45512] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auGNDHrK48MFtZtZLgXmGgAAAGE"]
show less
Port Scan
🇩🇪
43.157.95.131
28 Oct 2026
(mod_security) mod_security (id:920210) triggered by 43.157.95.131 (DE/Germany/-): 1 in the last 360 ...
show more
(mod_security) mod_security (id:920210) triggered by 43.157.95.131 (DE/Germany/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 01:42:21.149571 2026] [security2:error] [pid 4099565:tid 4099967] [client 43.157.95.131:49828] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auGLPdHKcIRnIXxCPtpYxAAAAUg"]
show less
Port Scan
🇺🇸
74.82.47.4
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 74.82.47.4 (US/United States/4.0-26.47.82.74.in ...
show more
(mod_security) mod_security (id:920350) triggered by 74.82.47.4 (US/United States/4.0-26.47.82.74.in-addr.arpa): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Wed Oct 28 00:54:24.570767 2026] [security2:error] [pid 4099565:tid 4099999] [client 74.82.47.4:46740] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auGAANHKcIRnIXxCPtpWMwAAAWg"]
show less
Port Scan
🇺🇸
216.180.246.123
28 Oct 2026
(mod_security) mod_security (id:920280) triggered by 216.180.246.123 (FR/France/crawler123.deepfield ...
show more
(mod_security) mod_security (id:920280) triggered by 216.180.246.123 (FR/France/crawler123.deepfield.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Oct 27 23:49:58.586569 2026] [security2:error] [pid 2785579:tid 2785680] [client 216.180.246.123:21000] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auFw5hYaenSOnAU9I2sUdQAAABI"]
show less
Port Scan
🇺🇸
43.159.148.221
28 Oct 2026
(mod_security) mod_security (id:920210) triggered by 43.159.148.221 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920210) triggered by 43.159.148.221 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Oct 27 23:39:03.937787 2026] [security2:error] [pid 2785579:tid 2785676] [client 43.159.148.221:51408] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auFuVxYaenSOnAU9I2sTVwAAAA4"]
show less
Port Scan
🇺🇸
159.65.178.73
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 159.65.178.73 (US/United States/-): 1 in the la ...
show more
(mod_security) mod_security (id:920350) triggered by 159.65.178.73 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Oct 27 22:55:55.910386 2026] [security2:error] [pid 2785579:tid 2785717] [client 159.65.178.73:33670] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auFkOxYaenSOnAU9I2sO8QAAADc"]
show less
Port Scan
🇧🇪
34.38.173.204
28 Oct 2026
(ftpd) Failed FTP login from 34.38.173.204 (BE/Belgium/204.173.38.34.bc.googleusercontent.com): 1 in ...
show more
(ftpd) Failed FTP login from 34.38.173.204 (BE/Belgium/204.173.38.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 27 22:41:30 web pure-ftpd: ([email protected] ) [WARNING] Authentication failed for user [anonymous]
show less
Port Scan
🇳🇱
178.62.224.152
28 Oct 2026
(mod_security) mod_security (id:920350) triggered by 178.62.224.152 (NL/The Netherlands/113533.fores ...
show more
(mod_security) mod_security (id:920350) triggered by 178.62.224.152 (NL/The Netherlands/113533.forestengine.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Tue Oct 27 22:28:06.986465 2026] [security2:error] [pid 2785579:tid 2785667] [client 178.62.224.152:57896] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auFdthYaenSOnAU9I2sMHQAAAAU"]
show less
Port Scan