🇺🇸
54.173.150.134
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 54.173.150.134 (US/United States/ec2-54-173-150 ...
show more
(mod_security) mod_security (id:920350) triggered by 54.173.150.134 (US/United States/ec2-54-173-150-134.compute-1.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 09:04:45.154164 2026] [security2:error] [pid 3746598:tid 3747148] [client 54.173.150.134:17178] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auiYfTWkmEUqdVrhC_0jTwAAAHY"]
show less
Port Scan
🇩🇪
2a01:4020:31:0:102::144
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::144 (Unknown): 1 in the las ...
show more
(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::144 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:59:44.527631 2026] [security2:error] [pid 3746617:tid 3747108] [client 2a01:4020:31:0:102::144:10740] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]:80"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/api/getData"] [unique_id "auiXUGtZ24D7imyWNkBIbAAAAL8"]
show less
Port Scan
🇳🇱
2a01:4020:2:b:101::ef
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 2a01:4020:2:b:101::ef (Unknown): 1 in the last ...
show more
(mod_security) mod_security (id:920350) triggered by 2a01:4020:2:b:101::ef (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:59:29.167366 2026] [security2:error] [pid 3746617:tid 3747107] [client 2a01:4020:2:b:101::ef:27402] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auiXQWtZ24D7imyWNkBIaQAAAL4"]
show less
Port Scan
🇧🇷
177.10.89.105
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 177.10.89.105 (BR/Brazil/static-105.89.10.177.v ...
show more
(mod_security) mod_security (id:920350) triggered by 177.10.89.105 (BR/Brazil/static-105.89.10.177.vm.lgs.dc.atplus.com.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:59:25.786666 2026] [security2:error] [pid 3746598:tid 3747080] [client 177.10.89.105:50132] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auiXPTWkmEUqdVrhC_0jCwAAAFM"]
show less
Port Scan
🇺🇸
170.106.72.178
02 Nov 2026
(mod_security) mod_security (id:920210) triggered by 170.106.72.178 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920210) triggered by 170.106.72.178 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:25:31.513450 2026] [security2:error] [pid 3746617:tid 3747105] [client 170.106.72.178:46974] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auiPS2tZ24D7imyWNkBFvAAAALw"]
show less
Port Scan
🇨🇭
91.90.122.155
02 Nov 2026
(mod_security) mod_security (id:920280) triggered by 91.90.122.155 (LI/Liechtenstein/-): 1 in the la ...
show more
(mod_security) mod_security (id:920280) triggered by 91.90.122.155 (LI/Liechtenstein/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:02:03.296921 2026] [security2:error] [pid 3746598:tid 3747157] [client 91.90.122.155:14056] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/nice%20ports%2C/Tri%6Eity.txt%2ebak"] [unique_id "auiJyzWkmEUqdVrhC_0ewAAAAH8"]
show less
Port Scan
🇺🇸
2602:80d:1008::15
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 2602:80d:1008::15 (Unknown): 1 in the last 3600 ...
show more
(mod_security) mod_security (id:920350) triggered by 2602:80d:1008::15 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 05:53:47.956664 2026] [security2:error] [pid 3746617:tid 3747081] [client 2602:80d:1008::15:62070] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auhru2tZ24D7imyWNkA3FwAAAKc"]
show less
Port Scan
🇸🇬
43.156.232.154
02 Nov 2026
(mod_security) mod_security (id:920210) triggered by 43.156.232.154 (SG/Singapore/-): 1 in the last ...
show more
(mod_security) mod_security (id:920210) triggered by 43.156.232.154 (SG/Singapore/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 05:50:40.394214 2026] [security2:error] [pid 3746598:tid 3747131] [client 43.156.232.154:40814] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auhrADWkmEUqdVrhC_0ONAAAAGY"]
show less
Port Scan
🇺🇸
34.94.86.158
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 34.94.86.158 (US/United States/158.86.94.34.bc. ...
show more
(mod_security) mod_security (id:920350) triggered by 34.94.86.158 (US/United States/158.86.94.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 05:01:53.289040 2026] [security2:error] [pid 3746598:tid 3747150] [client 34.94.86.158:9394] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auhfkTWkmEUqdVrhC_0KTgAAAHg"]
show less
Port Scan
🇲🇾
47.250.82.134
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 47.250.82.134 (MY/Malaysia/-): 1 in the last 36 ...
show more
(mod_security) mod_security (id:920350) triggered by 47.250.82.134 (MY/Malaysia/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 04:34:29.084904 2026] [security2:error] [pid 3746617:tid 3747100] [client 47.250.82.134:58586] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auhZJWtZ24D7imyWNkAxMwAAALc"]
show less
Port Scan
🇺🇸
43.153.48.240
02 Nov 2026
(mod_security) mod_security (id:920210) triggered by 43.153.48.240 (US/United States/-): 1 in the la ...
show more
(mod_security) mod_security (id:920210) triggered by 43.153.48.240 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 04:07:55.772831 2026] [security2:error] [pid 3746617:tid 3747082] [client 43.153.48.240:42324] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auhS62tZ24D7imyWNkAvogAAAKg"]
show less
Port Scan
🇺🇸
20.65.146.34
02 Nov 2026
(mod_security) mod_security (id:913100) triggered by 20.65.146.34 (US/United States/azpdsgay27l9.str ...
show more
(mod_security) mod_security (id:913100) triggered by 20.65.146.34 (US/United States/azpdsgay27l9.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 03:37:31.067567 2026] [security2:error] [pid 3746617:tid 3747082] [client 20.65.146.34:33064] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/developmentserver/metadatauploader"] [unique_id "auhLy2tZ24D7imyWNkAs1QAAAKg"]
show less
Port Scan
🇩🇪
47.254.177.97
02 Nov 2026
(sshd) Failed SSH login from 47.254.177.97 (DE/Germany/-): 1 in the last 3600 secs; Ports: *; Direct ...
show more
(sshd) Failed SSH login from 47.254.177.97 (DE/Germany/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Nov 2 02:30:55 web sshd[188493]: Invalid user from 47.254.177.97 port 15100
show less
Port Scan
🇧🇪
35.210.138.136
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 35.210.138.136 (BE/Belgium/136.138.210.35.bc.go ...
show more
(mod_security) mod_security (id:920350) triggered by 35.210.138.136 (BE/Belgium/136.138.210.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 02:09:52.114100 2026] [security2:error] [pid 3746598:tid 3747132] [client 35.210.138.136:21616] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aug3QDWkmEUqdVrhC_39iAAAAGc"]
show less
Port Scan
🇺🇸
37.19.197.153
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 37.19.197.153 (US/United States/unn-37-19-197-1 ...
show more
(mod_security) mod_security (id:920350) triggered by 37.19.197.153 (US/United States/unn-37-19-197-153.datapacket.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 02:02:26.328570 2026] [security2:error] [pid 3746617:tid 3747081] [client 37.19.197.153:30225] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aug1gmtZ24D7imyWNkAnvwAAAKc"]
show less
Port Scan
🇧🇷
205.210.31.214
02 Nov 2026
(mod_security) mod_security (id:920280) triggered by 205.210.31.214 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920280) triggered by 205.210.31.214 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 01:30:10.843600 2026] [security2:error] [pid 3746617:tid 3747082] [client 205.210.31.214:55841] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "augt8mtZ24D7imyWNkAmIgAAAKg"]
show less
Port Scan
🇳🇱
85.11.167.214
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 85.11.167.214 (NL/The Netherlands/-): 1 in the ...
show more
(mod_security) mod_security (id:920350) triggered by 85.11.167.214 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 01:15:40.446800 2026] [security2:error] [pid 3746617:tid 3747107] [client 85.11.167.214:47788] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "augqjGtZ24D7imyWNkAlhAAAAL4"], referer: http://23.92.16.203:80/cgi-bin/index2.asp
show less
Port Scan
🇳🇱
185.242.226.80
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 185.242.226.80 (NL/The Netherlands/security.cri ...
show more
(mod_security) mod_security (id:920350) triggered by 185.242.226.80 (NL/The Netherlands/security.criminalip.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 01:04:59.975327 2026] [security2:error] [pid 3746598:tid 3747138] [client 185.242.226.80:37926] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "augoCzWkmEUqdVrhC_352AAAAG0"]
show less
Port Scan
🇧🇪
35.210.200.212
02 Nov 2026
(ftpd) Failed FTP login from 35.210.200.212 (BE/Belgium/212.200.210.35.bc.googleusercontent.com): 1 ...
show more
(ftpd) Failed FTP login from 35.210.200.212 (BE/Belgium/212.200.210.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Nov 2 01:00:38 web pure-ftpd: ([email protected] ) [WARNING] Authentication failed for user [anonymous]
show less
Port Scan
🇺🇸
216.180.246.169
02 Nov 2026
(mod_security) mod_security (id:920280) triggered by 216.180.246.169 (FR/France/crawler169.deepfield ...
show more
(mod_security) mod_security (id:920280) triggered by 216.180.246.169 (FR/France/crawler169.deepfield.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 00:57:17.598726 2026] [security2:error] [pid 3746617:tid 3746968] [client 216.180.246.169:21418] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "augmPWtZ24D7imyWNkAkeQAAAI0"]
show less
Port Scan
🇺🇸
40.124.117.21
02 Nov 2026
(mod_security) mod_security (id:913100) triggered by 40.124.117.21 (US/United States/azpdsg34frk4.st ...
show more
(mod_security) mod_security (id:913100) triggered by 40.124.117.21 (US/United States/azpdsg34frk4.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 00:11:42.734358 2026] [security2:error] [pid 3741258:tid 3741713] [client 40.124.117.21:53284] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/druid/index.html"] [unique_id "augbjmitFewLzFip4VOyZwAAAWk"]
show less
Port Scan
🇺🇸
172.234.217.129
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 172.234.217.129 (US/United States/172-234-217-1 ...
show more
(mod_security) mod_security (id:920350) triggered by 172.234.217.129 (US/United States/172-234-217-129.ip.linodeusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 23:09:05.288693 2026] [security2:error] [pid 3418860:tid 3419000] [client 172.234.217.129:59762] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "augM4T8izaNp_evWQTuQ3AAAADk"]
show less
Port Scan
🇺🇸
20.169.84.56
02 Nov 2026
(mod_security) mod_security (id:913100) triggered by 20.169.84.56 (US/United States/azpdwsm7gm4t.str ...
show more
(mod_security) mod_security (id:913100) triggered by 20.169.84.56 (US/United States/azpdwsm7gm4t.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 21:53:34.593556 2026] [security2:error] [pid 2001244:tid 2001333] [client 20.169.84.56:60270] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/hudson"] [unique_id "auf7LiFsKVnhSx-YJ6_8mwAAAEY"]
show less
Port Scan
🇯🇵
172.237.7.18
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 172.237.7.18 (JP/Japan/d0ee6ad5.scanners.onlysc ...
show more
(mod_security) mod_security (id:920350) triggered by 172.237.7.18 (JP/Japan/d0ee6ad5.scanners.onlyscans.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 21:43:19.443514 2026] [security2:error] [pid 2001244:tid 2001368] [client 172.237.7.18:52496] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.env"] [unique_id "auf4xyFsKVnhSx-YJ6_7jAAAAGk"]
show less
Port Scan
🇳🇱
152.42.132.252
02 Nov 2026
(mod_security) mod_security (id:920350) triggered by 152.42.132.252 (NL/The Netherlands/119150.fores ...
show more
(mod_security) mod_security (id:920350) triggered by 152.42.132.252 (NL/The Netherlands/119150.forestengine.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 21:29:12.929816 2026] [security2:error] [pid 2001244:tid 2001335] [client 152.42.132.252:42700] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auf1eCFsKVnhSx-YJ6_6EAAAAEg"]
show less
Port Scan