🇬🇧
5.226.140.5
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 5.226.140.5 (GB/United Kingdom/5-226-140-5.infr ...
show more
(mod_security) mod_security (id:920350) triggered by 5.226.140.5 (GB/United Kingdom/5-226-140-5.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 12:30:55.296291 2026] [security2:error] [pid 2574362:tid 2574467] [client 5.226.140.5:2896] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/api/mcp"] [unique_id "aujIz4ugpUKal_wWru4xnQAAABY"]
show less
Port Scan
🇬🇧
5.226.140.2
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 5.226.140.2 (GB/United Kingdom/5-226-140-2.infr ...
show more
(mod_security) mod_security (id:920350) triggered by 5.226.140.2 (GB/United Kingdom/5-226-140-2.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 12:30:55.153400 2026] [security2:error] [pid 2574362:tid 2574451] [client 5.226.140.2:10614] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/favicon.ico"] [unique_id "aujIz4ugpUKal_wWru4xmgAAAAY"]
show less
Port Scan
🇳🇱
64.205.72.128
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 64.205.72.128 (US/United States/-): 1 in the la ...
show more
(mod_security) mod_security (id:920350) triggered by 64.205.72.128 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 12:30:51.290103 2026] [security2:error] [pid 2574362:tid 2574499] [client 64.205.72.128:28513] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aujIy4ugpUKal_wWru4xlgAAADY"]
show less
Port Scan
🇬🇧
193.32.209.237
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 193.32.209.237 (GB/United Kingdom/193-32-209-23 ...
show more
(mod_security) mod_security (id:920350) triggered by 193.32.209.237 (GB/United Kingdom/193-32-209-237.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 12:30:54.989564 2026] [security2:error] [pid 2574362:tid 2574493] [client 193.32.209.237:15186] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aujIzougpUKal_wWru4xmQAAADA"]
show less
Port Scan
🇬🇧
87.236.176.2
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 87.236.176.2 (GB/United Kingdom/r3-2-2.monitori ...
show more
(mod_security) mod_security (id:920350) triggered by 87.236.176.2 (GB/United Kingdom/r3-2-2.monitoring.internet-measurement.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 12:05:02.509723 2026] [security2:error] [pid 2574362:tid 2574502] [client 87.236.176.2:57833] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aujCvougpUKal_wWru4uYAAAADk"]
show less
Port Scan
🇺🇸
45.156.131.20
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 45.156.131.20 (US/United States/zl-laxd-us-gp7- ...
show more
(mod_security) mod_security (id:920350) triggered by 45.156.131.20 (US/United States/zl-laxd-us-gp7-wk134d.internet-census.org): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 11:49:45.357865 2026] [security2:error] [pid 2574362:tid 2574447] [client 45.156.131.20:57596] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aui_KYugpUKal_wWru4sMQAAAAI"]
show less
Port Scan
🇺🇸
45.79.128.205
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 45.79.128.205 (US/United States/lisbon.scan.buf ...
show more
(mod_security) mod_security (id:920350) triggered by 45.79.128.205 (US/United States/lisbon.scan.bufferover.run): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 11:46:58.097015 2026] [security2:error] [pid 2574362:tid 2574495] [client 45.79.128.205:35954] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aui-gougpUKal_wWru4r3QAAADI"]
show less
Port Scan
🇹🇼
128.14.227.89
02 Nov 2026
(eximsyntax) Exim syntax errors from 128.14.227.89 (TW/Taiwan/-): 1 in the last 3600 secs; Ports: *; ...
show more
(eximsyntax) Exim syntax errors from 128.14.227.89 (TW/Taiwan/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2026-11-02 11:11:12 SMTP call from [128.14.227.89] dropped: too many syntax or protocol errors (last command was "?", NULL)
show less
Port Scan
🇫🇷
80.87.206.25
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 80.87.206.25 (NL/The Netherlands/serv.179268284 ...
show more
(mod_security) mod_security (id:920350) triggered by 80.87.206.25 (NL/The Netherlands/serv.1792682844051.cc): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 10:56:59.535001 2026] [security2:error] [pid 3746617:tid 3746957] [client 80.87.206.25:59500] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/configFile"] [unique_id "auiyy2tZ24D7imyWNkBQTwAAAII"]
show less
Port Scan
🇯🇵
164.52.24.185
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 164.52.24.185 (JP/Japan/-): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920350) triggered by 164.52.24.185 (JP/Japan/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 10:50:27.426805 2026] [security2:error] [pid 3746617:tid 3747096] [client 164.52.24.185:51815] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auixQ2tZ24D7imyWNkBPqwAAALQ"]
show less
Port Scan
🇺🇸
20.80.75.45
02 Nov 2026
(mod_security) mod_security (id:913100) triggered by 20.80.75.45 (US/United States/-): 1 in the last ...
show more
(mod_security) mod_security (id:913100) triggered by 20.80.75.45 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 10:46:10.447552 2026] [security2:error] [pid 3746617:tid 3747103] [client 20.80.75.45:47608] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/"] [unique_id "auiwQmtZ24D7imyWNkBPOgAAALo"]
show less
Port Scan
🇬🇧
167.99.192.215
02 Nov 2026
(ftpd) Failed FTP login from 167.99.192.215 (GB/United Kingdom/-): 1 in the last 3600 secs; Ports: * ...
show more
(ftpd) Failed FTP login from 167.99.192.215 (GB/United Kingdom/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Nov 2 10:34:50 web pure-ftpd: ([email protected] ) [WARNING] Authentication failed for user [anonymous]
show less
Port Scan
🇬🇧
31.171.130.73
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 31.171.130.73 (GB/United Kingdom/-): 1 in the l ...
show more
(mod_security) mod_security (id:920350) triggered by 31.171.130.73 (GB/United Kingdom/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 10:22:33.496233 2026] [security2:error] [pid 3746617:tid 3747106] [client 31.171.130.73:29145] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/conf/.env"] [unique_id "auiquWtZ24D7imyWNkBNBQAAAL0"]
show less
Port Scan
🇬🇧
31.171.130.93
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 31.171.130.93 (GB/United Kingdom/-): 1 in the l ...
show more
(mod_security) mod_security (id:920350) triggered by 31.171.130.93 (GB/United Kingdom/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 10:22:33.337278 2026] [security2:error] [pid 3746617:tid 3746971] [client 31.171.130.93:32097] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.env"] [unique_id "auiquWtZ24D7imyWNkBNBAAAAJA"]
show less
Port Scan
🇳🇱
77.239.124.175
02 Nov 2026
(sshd) Failed SSH login from 77.239.124.175 (FR/France/-): 1 in the last 3600 secs; Ports: *; Direct ...
show more
(sshd) Failed SSH login from 77.239.124.175 (FR/France/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Nov 2 10:16:51 web sshd[2315215]: Invalid user docker from 77.239.124.175 port 36446
show less
Port Scan
🇹🇷
213.250.140.76
02 Nov 2026
(ftpd) Failed FTP login from 213.250.140.76 (TR/Turkey/ecs-213-250-140-76.compute.hwclouds-dns.com): ...
show more
(ftpd) Failed FTP login from 213.250.140.76 (TR/Turkey/ecs-213-250-140-76.compute.hwclouds-dns.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Nov 2 10:10:22 web pure-ftpd: ([email protected] ) [WARNING] Authentication failed for user [anonymous]
show less
Port Scan
🇭🇰
5.187.38.30
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 5.187.38.30 (HK/Hong Kong/-): 1 in the last 360 ...
show more
(mod_security) mod_security (id:920350) triggered by 5.187.38.30 (HK/Hong Kong/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 10:02:35.871916 2026] [security2:error] [pid 3746598:tid 3747119] [client 5.187.38.30:49778] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/SDK/webLanguage"] [unique_id "auimCzWkmEUqdVrhC_0nXAAAAFw"]
show less
Port Scan
🇳🇱
178.62.214.238
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 178.62.214.238 (NL/The Netherlands/119726.fores ...
show more
(mod_security) mod_security (id:920350) triggered by 178.62.214.238 (NL/The Netherlands/119726.forestengine.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 09:25:00.598958 2026] [security2:error] [pid 3746598:tid 3747063] [client 178.62.214.238:50662] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auidPDWkmEUqdVrhC_0lSwAAAEI"]
show less
Port Scan
🇺🇸
54.173.150.134
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 54.173.150.134 (US/United States/ec2-54-173-150 ...
show more
(mod_security) mod_security (id:920350) triggered by 54.173.150.134 (US/United States/ec2-54-173-150-134.compute-1.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 09:04:45.154164 2026] [security2:error] [pid 3746598:tid 3747148] [client 54.173.150.134:17178] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auiYfTWkmEUqdVrhC_0jTwAAAHY"]
show less
Port Scan
🇩🇪
2a01:4020:31:0:102::144
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::144 (Unknown): 1 in the las ...
show more
(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::144 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:59:44.527631 2026] [security2:error] [pid 3746617:tid 3747108] [client 2a01:4020:31:0:102::144:10740] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]:80"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/api/getData"] [unique_id "auiXUGtZ24D7imyWNkBIbAAAAL8"]
show less
Port Scan
🇳🇱
2a01:4020:2:b:101::ef
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 2a01:4020:2:b:101::ef (Unknown): 1 in the last ...
show more
(mod_security) mod_security (id:920350) triggered by 2a01:4020:2:b:101::ef (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:59:29.167366 2026] [security2:error] [pid 3746617:tid 3747107] [client 2a01:4020:2:b:101::ef:27402] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auiXQWtZ24D7imyWNkBIaQAAAL4"]
show less
Port Scan
🇧🇷
177.10.89.105
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 177.10.89.105 (BR/Brazil/static-105.89.10.177.v ...
show more
(mod_security) mod_security (id:920350) triggered by 177.10.89.105 (BR/Brazil/static-105.89.10.177.vm.lgs.dc.atplus.com.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:59:25.786666 2026] [security2:error] [pid 3746598:tid 3747080] [client 177.10.89.105:50132] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auiXPTWkmEUqdVrhC_0jCwAAAFM"]
show less
Port Scan
🇺🇸
170.106.72.178
02 Nov 2026
(mod_security) mod_security (id:920210) triggered by 170.106.72.178 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920210) triggered by 170.106.72.178 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:25:31.513450 2026] [security2:error] [pid 3746617:tid 3747105] [client 170.106.72.178:46974] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auiPS2tZ24D7imyWNkBFvAAAALw"]
show less
Port Scan
🇨🇭
91.90.122.155
02 Nov 2026
(mod_security) mod_security (id:920280) triggered by 91.90.122.155 (LI/Liechtenstein/-): 1 in the la ...
show more
(mod_security) mod_security (id:920280) triggered by 91.90.122.155 (LI/Liechtenstein/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:02:03.296921 2026] [security2:error] [pid 3746598:tid 3747157] [client 91.90.122.155:14056] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/nice%20ports%2C/Tri%6Eity.txt%2ebak"] [unique_id "auiJyzWkmEUqdVrhC_0ewAAAAH8"]
show less
Port Scan
🇺🇸
2602:80d:1008::15
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 2602:80d:1008::15 (Unknown): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920350) triggered by 2602:80d:1008::15 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 05:53:47.956664 2026] [security2:error] [pid 3746617:tid 3747081] [client 2602:80d:1008::15:62070] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auhru2tZ24D7imyWNkA3FwAAAKc"]
show less
Port Scan