AbuseIPDB

JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

User itsnixk joined AbuseIPDB in April 2026 and has reported 7,890 IP addresses.

Standing (weight) is good.

ACTIVE USER WEBMASTER

IP	Date	Comment	Categories
🇩🇪 2a01:4020:31:0:102::1cc	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::1cc (Unknown): 1 in the las ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::1cc (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 09:08:18.434206 2026] [security2:error] [pid 2502896:tid 2503148] [client 2a01:4020:31:0:102::1cc:1026] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/mcp/"] [unique_id "audH0k_3ieHo3sUbMhfa1AAAAEA"] show less	Port Scan
🇩🇪 2a01:4020:31:0:102::54f	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::54f (Unknown): 1 in the las ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::54f (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 09:08:18.433393 2026] [security2:error] [pid 2502896:tid 2503152] [client 2a01:4020:31:0:102::54f:8934] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "audH0k_3ieHo3sUbMhfa0QAAAEI"] show less	Port Scan
🇩🇪 2a01:4020:31:0:102::6da	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::6da (Unknown): 1 in the las ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::6da (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 09:08:18.601228 2026] [security2:error] [pid 2502896:tid 2503181] [client 2a01:4020:31:0:102::6da:12170] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/sse"] [unique_id "audH0k_3ieHo3sUbMhfa1QAAAE8"] show less	Port Scan
🇩🇪 2a01:4020:31:0:102::7ce	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::7ce (Unknown): 1 in the las ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:31:0:102::7ce (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 09:08:18.433984 2026] [security2:error] [pid 2502896:tid 2503152] [client 2a01:4020:31:0:102::7ce:1684] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/api/mcp"] [unique_id "audH0k_3ieHo3sUbMhfa0wAAAEI"] show less	Port Scan
🇳🇱 2a01:4020:2:b:101::69a	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 2a01:4020:2:b:101::69a (Unknown): 1 in the last ... show more (mod_security) mod_security (id:920350) triggered by 2a01:4020:2:b:101::69a (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 09:08:13.417748 2026] [security2:error] [pid 2502896:tid 2503162] [client 2a01:4020:2:b:101::69a:35752] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "audHzU_3ieHo3sUbMhfazwAAAEY"] show less	Port Scan
🇺🇸 100.26.98.21	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 100.26.98.21 (US/United States/ec2-100-26-98-21 ... show more (mod_security) mod_security (id:920350) triggered by 100.26.98.21 (US/United States/ec2-100-26-98-21.compute-1.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 09:06:46.782522 2026] [security2:error] [pid 2502896:tid 2503212] [client 100.26.98.21:33002] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "audHdk_3ieHo3sUbMhfawQAAAF0"] show less	Port Scan
🇩🇪 162.62.213.165	01 Nov 2026	(mod_security) mod_security (id:920210) triggered by 162.62.213.165 (DE/Germany/-): 1 in the last 36 ... show more (mod_security) mod_security (id:920210) triggered by 162.62.213.165 (DE/Germany/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 07:41:17.601856 2026] [security2:error] [pid 2502897:tid 2503394] [client 162.62.213.165:36416] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive\|close),\\\\s?(?:keep-alive\|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auczbYCWZ81ICb7UEm-m1QAAAKQ"] show less	Port Scan
🇬🇧 101.36.97.70	01 Nov 2026	(eximsyntax) Exim syntax errors from 101.36.97.70 (GB/United Kingdom/-): 1 in the last 3600 secs; Po ... show more (eximsyntax) Exim syntax errors from 101.36.97.70 (GB/United Kingdom/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2026-11-01 07:37:35 SMTP call from [101.36.97.70] dropped: too many syntax or protocol errors (last command was "?", NULL) show less	Port Scan
🇲🇳 180.149.125.167	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 180.149.125.167 (MN/Mongolia/-): 1 in the last ... show more (mod_security) mod_security (id:920350) triggered by 180.149.125.167 (MN/Mongolia/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 07:01:17.944565 2026] [security2:error] [pid 2502896:tid 2503252] [client 180.149.125.167:10138] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aucqDU_3ieHo3sUbMhfSwQAAAHA"] show less	Port Scan
🇬🇧 5.226.140.12	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 5.226.140.12 (GB/United Kingdom/5-226-140-12.in ... show more (mod_security) mod_security (id:920350) triggered by 5.226.140.12 (GB/United Kingdom/5-226-140-12.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 06:43:38.670352 2026] [security2:error] [pid 2502896:tid 2503247] [client 5.226.140.12:10088] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/favicon.ico"] [unique_id "aucl6k_3ieHo3sUbMhfRZAAAAG0"] show less	Port Scan
🇬🇧 31.14.254.62	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 31.14.254.62 (GB/United Kingdom/31-14-254-62.in ... show more (mod_security) mod_security (id:920350) triggered by 31.14.254.62 (GB/United Kingdom/31-14-254-62.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 06:43:38.811437 2026] [security2:error] [pid 2502897:tid 2503394] [client 31.14.254.62:10398] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/mcp"] [unique_id "aucl6oCWZ81ICb7UEm-iugAAAKQ"] show less	Port Scan
🇬🇧 37.10.113.216	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 37.10.113.216 (GB/United Kingdom/37-10-113-216. ... show more (mod_security) mod_security (id:920350) triggered by 37.10.113.216 (GB/United Kingdom/37-10-113-216.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 06:43:38.812130 2026] [security2:error] [pid 2502896:tid 2503243] [client 37.10.113.216:15648] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/api/mcp"] [unique_id "aucl6k_3ieHo3sUbMhfRZQAAAGs"] show less	Port Scan
🇬🇧 185.216.145.168	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 185.216.145.168 (GB/United Kingdom/185-216-145- ... show more (mod_security) mod_security (id:920350) triggered by 185.216.145.168 (GB/United Kingdom/185-216-145-168.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 06:43:38.811425 2026] [security2:error] [pid 2502897:tid 2503393] [client 185.216.145.168:8816] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aucl6oCWZ81ICb7UEm-iuQAAAKM"] show less	Port Scan
🇬🇧 188.240.59.12	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 188.240.59.12 (GB/United Kingdom/188-240-59-12. ... show more (mod_security) mod_security (id:920350) triggered by 188.240.59.12 (GB/United Kingdom/188-240-59-12.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 06:43:38.817579 2026] [security2:error] [pid 2502897:tid 2503392] [client 188.240.59.12:1864] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/mcp/"] [unique_id "aucl6oCWZ81ICb7UEm-iuwAAAKI"] show less	Port Scan
🇬🇧 213.166.84.46	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 213.166.84.46 (GB/United Kingdom/213-166-84-46. ... show more (mod_security) mod_security (id:920350) triggered by 213.166.84.46 (GB/United Kingdom/213-166-84-46.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 06:43:38.528513 2026] [security2:error] [pid 2502897:tid 2503388] [client 213.166.84.46:15586] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aucl6oCWZ81ICb7UEm-iuAAAAJ4"] show less	Port Scan
🇬🇧 31.14.254.42	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 31.14.254.42 (GB/United Kingdom/31-14-254-42.in ... show more (mod_security) mod_security (id:920350) triggered by 31.14.254.42 (GB/United Kingdom/31-14-254-42.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 06:43:38.965082 2026] [security2:error] [pid 2502897:tid 2503399] [client 31.14.254.42:2836] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/sse"] [unique_id "aucl6oCWZ81ICb7UEm-ivAAAAKk"] show less	Port Scan
🇩🇪 194.88.98.112	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 194.88.98.112 (DE/Germany/194-88-98-112.infrawa ... show more (mod_security) mod_security (id:920350) triggered by 194.88.98.112 (DE/Germany/194-88-98-112.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 06:42:34.589031 2026] [security2:error] [pid 2502897:tid 2503413] [client 194.88.98.112:21509] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auclqoCWZ81ICb7UEm-iqgAAALc"] show less	Port Scan
🇹🇷 156.229.60.162	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 156.229.60.162 (TR/Turkey/static.onlinehosting. ... show more (mod_security) mod_security (id:920350) triggered by 156.229.60.162 (TR/Turkey/static.onlinehosting.com.tr): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 06:38:03.304662 2026] [security2:error] [pid 2502897:tid 2503413] [client 156.229.60.162:59956] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auckm4CWZ81ICb7UEm-iaQAAALc"] show less	Port Scan
🇹🇭 43.164.1.211	01 Nov 2026	(mod_security) mod_security (id:920210) triggered by 43.164.1.211 (TH/Thailand/-): 1 in the last 360 ... show more (mod_security) mod_security (id:920210) triggered by 43.164.1.211 (TH/Thailand/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 06:06:40.536474 2026] [security2:error] [pid 2502897:tid 2503396] [client 43.164.1.211:34836] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive\|close),\\\\s?(?:keep-alive\|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aucdQICWZ81ICb7UEm-gogAAAKY"] show less	Port Scan
🇺🇸 172.206.242.255	01 Nov 2026	(mod_security) mod_security (id:913100) triggered by 172.206.242.255 (US/United States/-): 1 in the ... show more (mod_security) mod_security (id:913100) triggered by 172.206.242.255 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 06:05:10.253453 2026] [security2:error] [pid 2502896:tid 2503219] [client 172.206.242.255:47764] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/developmentserver/metadatauploader"] [unique_id "aucc5k_3ieHo3sUbMhfPUgAAAGA"] show less	Port Scan
🇺🇸 212.56.54.191	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 212.56.54.191 (US/United States/-): 1 in the la ... show more (mod_security) mod_security (id:920350) triggered by 212.56.54.191 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 05:45:10.749861 2026] [security2:error] [pid 2502897:tid 2503399] [client 212.56.54.191:14224] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aucYNoCWZ81ICb7UEm-fOwAAAKk"] show less	Port Scan
🇺🇸 146.190.134.221	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 146.190.134.221 (US/United States/-): 1 in the ... show more (mod_security) mod_security (id:920350) triggered by 146.190.134.221 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 05:35:25.721991 2026] [security2:error] [pid 2502897:tid 2503397] [client 146.190.134.221:47942] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aucV7YCWZ81ICb7UEm-epQAAAKc"] show less	Port Scan
🇺🇸 143.198.116.111	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 143.198.116.111 (US/United States/-): 1 in the ... show more (mod_security) mod_security (id:920350) triggered by 143.198.116.111 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 04:54:23.805298 2026] [security2:error] [pid 2502897:tid 2503408] [client 143.198.116.111:57208] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aucMT4CWZ81ICb7UEm-cKgAAALI"] show less	Port Scan
🇺🇸 2602:80d:1008::3c	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 2602:80d:1008::3c (Unknown): 1 in the last 3600 ... show more (mod_security) mod_security (id:920350) triggered by 2602:80d:1008::3c (Unknown): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 04:47:39.189845 2026] [security2:error] [pid 2502896:tid 2503152] [client 2602:80d:1008::3c:21190] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted]"] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "aucKu0_3ieHo3sUbMhfLEQAAAEI"] show less	Port Scan
🇧🇩 45.114.84.126	01 Nov 2026	(mod_security) mod_security (id:920350) triggered by 45.114.84.126 (BD/Bangladesh/-): 1 in the last ... show more (mod_security) mod_security (id:920350) triggered by 45.114.84.126 (BD/Bangladesh/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Sun Nov 01 04:29:49.743275 2026] [security2:error] [pid 2502897:tid 2503418] [client 45.114.84.126:39198] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+\|\\\\[[\\\\da-f:]+\\\\]\|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/.git/config"] [unique_id "aucGjYCWZ81ICb7UEm-aagAAALw"] show less	Port Scan