AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User itsnixk joined AbuseIPDB in April 2026 and has reported 7,898 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇩🇪 2a01:4020:31:0:102::144	02 Nov 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::144 (Unknown): 1 in the las ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::144 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:59:44.527631 2026] [security2:error] [pid 3746617:tid 3747108] [client 2a01:4020:31:0:102::144:10740] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]:80"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/api/getData"] [unique_id "auiXUGtZ24D7imyWNkBIbAAAAL8"] show less	Port Scan
🇳🇱 2a01:4020:2:b:101::ef	02 Nov 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:2:b:101::ef (Unknown): 1 in the last ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:2:b:101::ef (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:59:29.167366 2026] [security2:error] [pid 3746617:tid 3747107] [client 2a01:4020:2:b:101::ef:27402] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auiXQWtZ24D7imyWNkBIaQAAAL4"] show less	Port Scan
🇧🇷 177.10.89.105	02 Nov 2026	(mod_security) mod_security (id:920350) triggered by 177.10.89.105 (BR/Brazil/static-105.89.10.177.v ... show more (mod_security) mod_security (id:920350) triggered by 177.10.89.105 (BR/Brazil/static-105.89.10.177.vm.lgs.dc.atplus.com.br): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:59:25.786666 2026] [security2:error] [pid 3746598:tid 3747080] [client 177.10.89.105:50132] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auiXPTWkmEUqdVrhC_0jCwAAAFM"] show less	Port Scan
🇺🇸 170.106.72.178	02 Nov 2026	(mod_security) mod_security (id:920210) triggered by 170.106.72.178 (US/United States/-): 1 in the l ... show more (mod_security) mod_security (id:920210) triggered by 170.106.72.178 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:25:31.513450 2026] [security2:error] [pid 3746617:tid 3747105] [client 170.106.72.178:46974] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive\|close),\\\\s?(?:keep-alive\|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auiPS2tZ24D7imyWNkBFvAAAALw"] show less	Port Scan
🇨🇭 91.90.122.155	02 Nov 2026	(mod_security) mod_security (id:920280) triggered by 91.90.122.155 (LI/Liechtenstein/-): 1 in the la ... show more (mod_security) mod_security (id:920280) triggered by 91.90.122.155 (LI/Liechtenstein/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 08:02:03.296921 2026] [security2:error] [pid 3746598:tid 3747157] [client 91.90.122.155:14056] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/nice%20ports%2C/Tri%6Eity.txt%2ebak"] [unique_id "auiJyzWkmEUqdVrhC_0ewAAAAH8"] show less	Port Scan
🇺🇸 2602:80d:1008::15	02 Nov 2026	(mod_security) mod_security (id:920350) triggered by 2602:80d:1008::15 (Unknown): 1 in the last 3600 ... show more (mod_security) mod_security (id:920350) triggered by 2602:80d:1008::15 (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 05:53:47.956664 2026] [security2:error] [pid 3746617:tid 3747081] [client 2602:80d:1008::15:62070] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auhru2tZ24D7imyWNkA3FwAAAKc"] show less	Port Scan
🇸🇬 43.156.232.154	02 Nov 2026	(mod_security) mod_security (id:920210) triggered by 43.156.232.154 (SG/Singapore/-): 1 in the last ... show more (mod_security) mod_security (id:920210) triggered by 43.156.232.154 (SG/Singapore/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 05:50:40.394214 2026] [security2:error] [pid 3746598:tid 3747131] [client 43.156.232.154:40814] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive\|close),\\\\s?(?:keep-alive\|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auhrADWkmEUqdVrhC_0ONAAAAGY"] show less	Port Scan
🇺🇸 34.94.86.158	02 Nov 2026	(mod_security) mod_security (id:920350) triggered by 34.94.86.158 (US/United States/158.86.94.34.bc. ... show more (mod_security) mod_security (id:920350) triggered by 34.94.86.158 (US/United States/158.86.94.34.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 05:01:53.289040 2026] [security2:error] [pid 3746598:tid 3747150] [client 34.94.86.158:9394] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auhfkTWkmEUqdVrhC_0KTgAAAHg"] show less	Port Scan
🇲🇾 47.250.82.134	02 Nov 2026	(mod_security) mod_security (id:920350) triggered by 47.250.82.134 (MY/Malaysia/-): 1 in the last 36 ... show more (mod_security) mod_security (id:920350) triggered by 47.250.82.134 (MY/Malaysia/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 04:34:29.084904 2026] [security2:error] [pid 3746617:tid 3747100] [client 47.250.82.134:58586] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auhZJWtZ24D7imyWNkAxMwAAALc"] show less	Port Scan
🇺🇸 43.153.48.240	02 Nov 2026	(mod_security) mod_security (id:920210) triggered by 43.153.48.240 (US/United States/-): 1 in the la ... show more (mod_security) mod_security (id:920210) triggered by 43.153.48.240 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 04:07:55.772831 2026] [security2:error] [pid 3746617:tid 3747082] [client 43.153.48.240:42324] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive\|close),\\\\s?(?:keep-alive\|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auhS62tZ24D7imyWNkAvogAAAKg"] show less	Port Scan
🇺🇸 20.65.146.34	02 Nov 2026	(mod_security) mod_security (id:913100) triggered by 20.65.146.34 (US/United States/azpdsgay27l9.str ... show more (mod_security) mod_security (id:913100) triggered by 20.65.146.34 (US/United States/azpdsgay27l9.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 03:37:31.067567 2026] [security2:error] [pid 3746617:tid 3747082] [client 20.65.146.34:33064] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/developmentserver/metadatauploader"] [unique_id "auhLy2tZ24D7imyWNkAs1QAAAKg"] show less	Port Scan
🇩🇪 47.254.177.97	02 Nov 2026	(sshd) Failed SSH login from 47.254.177.97 (DE/Germany/-): 1 in the last 3600 secs; Ports: ; Direct ... show more (sshd) Failed SSH login from 47.254.177.97 (DE/Germany/-): 1 in the last 3600 secs; Ports: ; Direction: inout; Trigger: LF_TRIGGER; Logs: Nov 2 02:30:55 web sshd[188493]: Invalid user from 47.254.177.97 port 15100 show less	Port Scan
🇧🇪 35.210.138.136	02 Nov 2026	(mod_security) mod_security (id:920350) triggered by 35.210.138.136 (BE/Belgium/136.138.210.35.bc.go ... show more (mod_security) mod_security (id:920350) triggered by 35.210.138.136 (BE/Belgium/136.138.210.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 02:09:52.114100 2026] [security2:error] [pid 3746598:tid 3747132] [client 35.210.138.136:21616] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aug3QDWkmEUqdVrhC_39iAAAAGc"] show less	Port Scan
🇺🇸 37.19.197.153	02 Nov 2026	(mod_security) mod_security (id:920350) triggered by 37.19.197.153 (US/United States/unn-37-19-197-1 ... show more (mod_security) mod_security (id:920350) triggered by 37.19.197.153 (US/United States/unn-37-19-197-153.datapacket.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 02:02:26.328570 2026] [security2:error] [pid 3746617:tid 3747081] [client 37.19.197.153:30225] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aug1gmtZ24D7imyWNkAnvwAAAKc"] show less	Port Scan
🇧🇷 205.210.31.214	02 Nov 2026	(mod_security) mod_security (id:920280) triggered by 205.210.31.214 (US/United States/-): 1 in the l ... show more (mod_security) mod_security (id:920280) triggered by 205.210.31.214 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 01:30:10.843600 2026] [security2:error] [pid 3746617:tid 3747082] [client 205.210.31.214:55841] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "augt8mtZ24D7imyWNkAmIgAAAKg"] show less	Port Scan
🇳🇱 85.11.167.214	02 Nov 2026	(mod_security) mod_security (id:920350) triggered by 85.11.167.214 (NL/The Netherlands/-): 1 in the ... show more (mod_security) mod_security (id:920350) triggered by 85.11.167.214 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 01:15:40.446800 2026] [security2:error] [pid 3746617:tid 3747107] [client 85.11.167.214:47788] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "augqjGtZ24D7imyWNkAlhAAAAL4"], referer: http://23.92.16.203:80/cgi-bin/index2.asp show less	Port Scan
🇳🇱 185.242.226.80	02 Nov 2026	(mod_security) mod_security (id:920350) triggered by 185.242.226.80 (NL/The Netherlands/security.cri ... show more (mod_security) mod_security (id:920350) triggered by 185.242.226.80 (NL/The Netherlands/security.criminalip.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 01:04:59.975327 2026] [security2:error] [pid 3746598:tid 3747138] [client 185.242.226.80:37926] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "augoCzWkmEUqdVrhC_352AAAAG0"] show less	Port Scan
🇧🇪 35.210.200.212	02 Nov 2026	(ftpd) Failed FTP login from 35.210.200.212 (BE/Belgium/212.200.210.35.bc.googleusercontent.com): 1 ... show more (ftpd) Failed FTP login from 35.210.200.212 (BE/Belgium/212.200.210.35.bc.googleusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Nov 2 01:00:38 web pure-ftpd: ([email protected]) [WARNING] Authentication failed for user [anonymous] show less	Port Scan
🇺🇸 216.180.246.169	02 Nov 2026	(mod_security) mod_security (id:920280) triggered by 216.180.246.169 (FR/France/crawler169.deepfield ... show more (mod_security) mod_security (id:920280) triggered by 216.180.246.169 (FR/France/crawler169.deepfield.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 00:57:17.598726 2026] [security2:error] [pid 3746617:tid 3746968] [client 216.180.246.169:21418] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "augmPWtZ24D7imyWNkAkeQAAAI0"] show less	Port Scan
🇺🇸 40.124.117.21	02 Nov 2026	(mod_security) mod_security (id:913100) triggered by 40.124.117.21 (US/United States/azpdsg34frk4.st ... show more (mod_security) mod_security (id:913100) triggered by 40.124.117.21 (US/United States/azpdsg34frk4.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Mon Nov 02 00:11:42.734358 2026] [security2:error] [pid 3741258:tid 3741713] [client 40.124.117.21:53284] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/druid/index.html"] [unique_id "augbjmitFewLzFip4VOyZwAAAWk"] show less	Port Scan
🇺🇸 172.234.217.129	02 Nov 2026	(mod_security) mod_security (id:920350) triggered by 172.234.217.129 (US/United States/172-234-217-1 ... show more (mod_security) mod_security (id:920350) triggered by 172.234.217.129 (US/United States/172-234-217-129.ip.linodeusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 23:09:05.288693 2026] [security2:error] [pid 3418860:tid 3419000] [client 172.234.217.129:59762] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "augM4T8izaNp_evWQTuQ3AAAADk"] show less	Port Scan
🇺🇸 20.169.84.56	02 Nov 2026	(mod_security) mod_security (id:913100) triggered by 20.169.84.56 (US/United States/azpdwsm7gm4t.str ... show more (mod_security) mod_security (id:913100) triggered by 20.169.84.56 (US/United States/azpdwsm7gm4t.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 21:53:34.593556 2026] [security2:error] [pid 2001244:tid 2001333] [client 20.169.84.56:60270] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/hudson"] [unique_id "auf7LiFsKVnhSx-YJ6_8mwAAAEY"] show less	Port Scan
🇯🇵 172.237.7.18	02 Nov 2026	(mod_security) mod_security (id:920350) triggered by 172.237.7.18 (JP/Japan/d0ee6ad5.scanners.onlysc ... show more (mod_security) mod_security (id:920350) triggered by 172.237.7.18 (JP/Japan/d0ee6ad5.scanners.onlyscans.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 21:43:19.443514 2026] [security2:error] [pid 2001244:tid 2001368] [client 172.237.7.18:52496] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.env"] [unique_id "auf4xyFsKVnhSx-YJ6_7jAAAAGk"] show less	Port Scan
🇳🇱 152.42.132.252	02 Nov 2026	(mod_security) mod_security (id:920350) triggered by 152.42.132.252 (NL/The Netherlands/119150.fores ... show more (mod_security) mod_security (id:920350) triggered by 152.42.132.252 (NL/The Netherlands/119150.forestengine.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 21:29:12.929816 2026] [security2:error] [pid 2001244:tid 2001335] [client 152.42.132.252:42700] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auf1eCFsKVnhSx-YJ6_6EAAAAEg"] show less	Port Scan
🇺🇸 172.171.4.27	02 Nov 2026	(mod_security) mod_security (id:920350) triggered by 172.171.4.27 (US/United States/-): 1 in the las ... show more (mod_security) mod_security (id:920350) triggered by 172.171.4.27 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 20:55:50.115908 2026] [security2:error] [pid 2001244:tid 2001360] [client 172.171.4.27:38431] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.env.swp"] [unique_id "auftpiFsKVnhSx-YJ6_2dQAAAGE"], referer: https://23.92.16.203/ show less	Port Scan