🇺🇸
4.236.164.36
30 Oct 2026
(mod_security) mod_security (id:913100) triggered by 4.236.164.36 (US/United States/azpdesqrgeg1.str ...
show more
(mod_security) mod_security (id:913100) triggered by 4.236.164.36 (US/United States/azpdesqrgeg1.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 19:43:03.385275 2026] [security2:error] [pid 1241691:tid 1241802] [client 4.236.164.36:35040] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/"] [unique_id "auUrh93bj7BT4tGd5urE-AAAAFw"]
show less
Port Scan
🇦🇺
170.64.154.131
30 Oct 2026
(mod_security) mod_security (id:913100) triggered by 170.64.154.131 (AU/Australia/-): 1 in the last ...
show more
(mod_security) mod_security (id:913100) triggered by 170.64.154.131 (AU/Australia/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 19:37:36.530315 2026] [security2:error] [pid 1241691:tid 1241779] [client 170.64.154.131:48878] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/"] [unique_id "auUqQN3bj7BT4tGd5urEKwAAAEU"]
show less
Port Scan
🇺🇸
216.25.90.19
30 Oct 2026
(mod_security) mod_security (id:920280) triggered by 216.25.90.19 (US/United States/-): 1 in the las ...
show more
(mod_security) mod_security (id:920280) triggered by 216.25.90.19 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 18:45:48.545613 2026] [security2:error] [pid 1241691:tid 1241801] [client 216.25.90.19:50174] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auUeHN3bj7BT4tGd5uq-YgAAAFs"]
show less
Port Scan
🇲🇾
47.250.155.102
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 47.250.155.102 (MY/Malaysia/-): 1 in the last 3 ...
show more
(mod_security) mod_security (id:920350) triggered by 47.250.155.102 (MY/Malaysia/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 18:07:59.056095 2026] [security2:error] [pid 3762865:tid 3762993] [client 47.250.155.102:53756] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auUVP7Fh5-zlXcrpcSBsFgAAAC0"]
show less
Port Scan
🇮🇳
172.232.108.36
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 172.232.108.36 (IN/India/172-232-108-36.ip.lino ...
show more
(mod_security) mod_security (id:920350) triggered by 172.232.108.36 (IN/India/172-232-108-36.ip.linodeusercontent.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 18:03:20.637469 2026] [security2:error] [pid 3762865:tid 3762991] [client 172.232.108.36:40536] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auUUKLFh5-zlXcrpcSBrlgAAACs"]
show less
Port Scan
🇬🇧
144.126.229.200
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 144.126.229.200 (GB/United Kingdom/-): 1 in the ...
show more
(mod_security) mod_security (id:920350) triggered by 144.126.229.200 (GB/United Kingdom/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 17:38:26.085879 2026] [security2:error] [pid 3762865:tid 3763011] [client 144.126.229.200:48296] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auUOUrFh5-zlXcrpcSBo1wAAAD8"]
show less
Port Scan
🇷🇴
92.118.39.18
30 Oct 2026
(mod_security) mod_security (id:930130) triggered by 92.118.39.18 (NL/The Netherlands/-): 1 in the l ...
show more
(mod_security) mod_security (id:930130) triggered by 92.118.39.18 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 17:19:36.166970 2026] [security2:error] [pid 3762865:tid 3762978] [client 92.118.39.18:44770] ModSecurity: Access denied with code 406 (phase 1). Matched phrase ".git/" at REQUEST_FILENAME. [file "/etc/modsecurity.d/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "150"] [id "930130"] [msg "Restricted File Access Attempt"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/ATTACK-LFI"] [tag "capec/1000/255/153/126"] [redacted] [uri "/.git/HEAD"] [unique_id "auUJ6LFh5-zlXcrpcSBm4QAAAB4"]
show less
Port Scan
🇫🇮
147.185.133.48
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 147.185.133.48 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920350) triggered by 147.185.133.48 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 15:40:12.486786 2026] [security2:error] [pid 3762865:tid 3762962] [client 147.185.133.48:60212] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auTynLFh5-zlXcrpcSBbVwAAAA4"]
show less
Port Scan
🇵🇰
175.107.228.210
30 Oct 2026
(mod_security) mod_security (id:920280) triggered by 175.107.228.210 (PK/Pakistan/-): 1 in the last ...
show more
(mod_security) mod_security (id:920280) triggered by 175.107.228.210 (PK/Pakistan/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 14:58:21.423366 2026] [security2:error] [pid 3762865:tid 3762962] [client 175.107.228.210:50058] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/boaform/admin/formLogin"] [unique_id "auTozbFh5-zlXcrpcSBWqgAAAA4"]
show less
Port Scan
🇸🇬
43.106.106.108
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 43.106.106.108 (SG/Singapore/-): 1 in the last ...
show more
(mod_security) mod_security (id:920350) triggered by 43.106.106.108 (SG/Singapore/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 14:34:27.448002 2026] [security2:error] [pid 3762865:tid 3762967] [client 43.106.106.108:40592] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auTjM7Fh5-zlXcrpcSBULAAAABM"]
show less
Port Scan
🇭🇰
103.203.56.2
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 103.203.56.2 (CN/China/scan-56-2.security.ipip. ...
show more
(mod_security) mod_security (id:920350) triggered by 103.203.56.2 (CN/China/scan-56-2.security.ipip.net): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 14:25:02.797329 2026] [security2:error] [pid 3762865:tid 3762979] [client 103.203.56.2:54296] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auTg_rFh5-zlXcrpcSBTEQAAAB8"]
show less
Port Scan
🇳🇱
151.245.151.231
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 151.245.151.231 (AE/United Arab Emirates/-): 1 ...
show more
(mod_security) mod_security (id:920350) triggered by 151.245.151.231 (AE/United Arab Emirates/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 13:34:33.740537 2026] [security2:error] [pid 3762865:tid 3762972] [client 151.245.151.231:52024] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auTVKbFh5-zlXcrpcSBNtAAAABg"]
show less
Port Scan
🇺🇸
109.105.209.57
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 109.105.209.57 (US/United States/zl-laxk-us-gp7 ...
show more
(mod_security) mod_security (id:920350) triggered by 109.105.209.57 (US/United States/zl-laxk-us-gp7-wk118a.internet-census.org): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 12:26:42.154890 2026] [security2:error] [pid 3762865:tid 3762948] [client 109.105.209.57:56550] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auTFQrFh5-zlXcrpcSBFBAAAAAA"]
show less
Port Scan
🇺🇸
43.166.129.247
30 Oct 2026
(mod_security) mod_security (id:920210) triggered by 43.166.129.247 (US/United States/-): 1 in the l ...
show more
(mod_security) mod_security (id:920210) triggered by 43.166.129.247 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 11:47:29.222182 2026] [security2:error] [pid 489376:tid 489844] [client 43.166.129.247:44046] ModSecurity: Access denied with code 406 (phase 1). Pattern match "\\\\b(?:keep-alive|close),\\\\s?(?:keep-alive|close)\\\\b" at REQUEST_HEADERS:Connection. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "402"] [id "920210"] [msg "Multiple/Conflicting Connection Header Data Found"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auS8EdpIRkzGal5KSXxSrAAAALU"]
show less
Port Scan
🇰🇷
152.32.139.228
30 Oct 2026
(ftpd) Failed FTP login from 152.32.139.228 (KR/South Korea/-): 1 in the last 3600 secs; Ports: *; D ...
show more
(ftpd) Failed FTP login from 152.32.139.228 (KR/South Korea/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: Oct 30 11:20:42 web pure-ftpd: ([email protected] ) [WARNING] Authentication failed for user [anonymous]
show less
Port Scan
🇺🇸
47.251.71.112
30 Oct 2026
(eximsyntax) Exim syntax errors from 47.251.71.112 (US/United States/-): 1 in the last 3600 secs; Po ...
show more
(eximsyntax) Exim syntax errors from 47.251.71.112 (US/United States/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: 2026-10-30 11:14:51 SMTP call from [47.251.71.112] dropped: too many syntax or protocol errors (last command was "?", NULL)
show less
Port Scan
🇳🇱
188.166.68.30
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 188.166.68.30 (NL/The Netherlands/-): 1 in the ...
show more
(mod_security) mod_security (id:920350) triggered by 188.166.68.30 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 10:25:20.728229 2026] [security2:error] [pid 489371:tid 489900] [client 188.166.68.30:60606] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auSo0Nt1EWklP1xNLigS_QAAADA"]
show less
Port Scan
🇺🇸
54.166.249.45
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 54.166.249.45 (US/United States/ec2-54-166-249- ...
show more
(mod_security) mod_security (id:920350) triggered by 54.166.249.45 (US/United States/ec2-54-166-249-45.compute-1.amazonaws.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 10:04:32.709994 2026] [security2:error] [pid 489371:tid 489875] [client 54.166.249.45:59526] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auSj8Nt1EWklP1xNLigR1AAAABo"]
show less
Port Scan
🇵🇰
139.135.41.67
30 Oct 2026
(mod_security) mod_security (id:920280) triggered by 139.135.41.67 (PK/Pakistan/-): 1 in the last 36 ...
show more
(mod_security) mod_security (id:920280) triggered by 139.135.41.67 (PK/Pakistan/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 07:49:13.409722 2026] [security2:error] [pid 489376:tid 489783] [client 139.135.41.67:8837] ModSecurity: Access denied with code 406 (phase 1). Operator EQ matched 0 at REQUEST_HEADERS. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "566"] [id "920280"] [msg "Request Missing a Host Header"] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/boaform/admin/formLogin"] [unique_id "auSEOdpIRkzGal5KSXxEiAAAAI0"]
show less
Port Scan
🇺🇸
172.104.11.34
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 172.104.11.34 (US/United States/edinburgh.scan. ...
show more
(mod_security) mod_security (id:920350) triggered by 172.104.11.34 (US/United States/edinburgh.scan.bufferover.run): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 07:38:41.034042 2026] [security2:error] [pid 489371:tid 489915] [client 172.104.11.34:35640] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auSBwdt1EWklP1xNLigJpgAAAD8"]
show less
Port Scan
🇺🇸
149.165.154.76
30 Oct 2026
(mod_security) mod_security (id:913100) triggered by 149.165.154.76 (US/United States/worker4.cis250 ...
show more
(mod_security) mod_security (id:913100) triggered by 149.165.154.76 (US/United States/worker4.cis250324.projects.jetstream-cloud.org): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 07:21:54.917233 2026] [security2:error] [pid 489371:tid 489881] [client 149.165.154.76:17606] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/"] [unique_id "auR90tt1EWklP1xNLigIsQAAACA"]
show less
Port Scan
🇬🇧
84.32.41.99
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 84.32.41.99 (GB/United Kingdom/-): 1 in the las ...
show more
(mod_security) mod_security (id:920350) triggered by 84.32.41.99 (GB/United Kingdom/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 06:04:41.024327 2026] [security2:error] [pid 489371:tid 489909] [client 84.32.41.99:59704] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRrudt1EWklP1xNLigERwAAADk"]
show less
Port Scan
🇺🇸
20.169.91.1
30 Oct 2026
(mod_security) mod_security (id:913100) triggered by 20.169.91.1 (US/United States/azpdws8zty0m.stre ...
show more
(mod_security) mod_security (id:913100) triggered by 20.169.91.1 (US/United States/azpdws8zty0m.stretchoid.com): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 05:55:36.526045 2026] [security2:error] [pid 489371:tid 489860] [client 20.169.91.1:41480] ModSecurity: Access denied with code 406 (phase 1). Matched phrase "zgrab" at REQUEST_HEADERS:User-Agent. [file "/etc/modsecurity.d/REQUEST-913-SCANNER-DETECTION.conf"] [line "56"] [id "913100"] [msg "Found User-Agent associated with security scanner"] [redacted] [severity "CRITICAL"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-reputation-scanner"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/SCANNER-DETECTION"] [tag "capec/1000/118/224/541/310"] [redacted] [uri "/hudson"] [unique_id "auRpmNt1EWklP1xNLigDxQAAAA0"]
show less
Port Scan
🇷🇴
193.32.162.233
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 193.32.162.233 (NL/The Netherlands/-): 1 in the ...
show more
(mod_security) mod_security (id:920350) triggered by 193.32.162.233 (NL/The Netherlands/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 05:27:48.553532 2026] [security2:error] [pid 489376:tid 489811] [client 193.32.162.233:43354] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRjFNpIRkzGal5KSXw9eAAAAKc"]
show less
Port Scan
🇬🇧
5.226.140.16
30 Oct 2026
(mod_security) mod_security (id:920350) triggered by 5.226.140.16 (GB/United Kingdom/5-226-140-16.in ...
show more
(mod_security) mod_security (id:920350) triggered by 5.226.140.16 (GB/United Kingdom/5-226-140-16.infrawat.ch): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_TRIGGER; Logs: [Fri Oct 30 04:09:58.135228 2026] [security2:error] [pid 489371:tid 489860] [client 5.226.140.16:2486] ModSecurity: Access denied with code 406 (phase 1). Pattern match "(?:^([\\\\d.]+|\\\\[[\\\\da-f:]+\\\\]|[\\\\da-f:]+)(:[\\\\d]+)?$)" at REQUEST_HEADERS:Host. [file "/etc/modsecurity.d/REQUEST-920-PROTOCOL-ENFORCEMENT.conf"] [line "773"] [id "920350"] [msg "Host header is a numeric IP address"] [redacted] [severity "WARNING"] [ver "OWASP_CRS/4.28.0"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-protocol"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "OWASP_CRS/PROTOCOL-ENFORCEMENT"] [tag "capec/1000/210/272"] [redacted] [uri "/"] [unique_id "auRQ1tt1EWklP1xNLij82wAAAA0"]
show less
Port Scan