139.59.73.90

Web attack/malicious scanning detected

2026-05-12T23:24:02.571460+03:00 mummo kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:d6:a5:bc:00:00:5e:00:01:58:08:00 SRC=139.59.73.90 DST=83.148.240.21 LEN=44 TOS=0x00 PREC=0x00 TTL=234 ID=24930 PROTO=TCP SPT=61007 DPT=8090 WINDOW=1025 RES=0x00 S ... show more 2026-05-12T23:24:02.571460+03:00 mummo kernel: [UFW BLOCK] IN=enp0s25 OUT= MAC=6c:62:6d:d6:a5:bc:00:00:5e:00:01:58:08:00 SRC=139.59.73.90 DST=83.148.240.21 LEN=44 TOS=0x00 PREC=0x00 TTL=234 ID=24930 PROTO=TCP SPT=61007 DPT=8090 WINDOW=1025 RES=0x00 SYN URGP=0 ... show less

Blocked by UFW (TCP on 22) Source port: 61009 TTL: 241 Packet length: 44 TOS: 0x08 This report (for 139.59.73.90) was generated by: https://github.com/sefinek/UFW-AbuseIPDB-Reporter

ThreatBook Intelligence: Zombie,Spam more details on https://threatbook.io/ip/139.59.73.90 2025-05-23 11:57:43 /.env

Web Attack (\x00\x00\x00\x00\x00). 7d ban

(mod_security) mod_security (id:210492) triggered by 139.59.73.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 23 01:33:52.446542 2025] [security2:error] [pid 1729974:tid 1729974] [client 139.59.73.90:49478] ... show more (mod_security) mod_security (id:210492) triggered by 139.59.73.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 23 01:33:52.446542 2025] [security2:error] [pid 1729974:tid 1729974] [client 139.59.73.90:49478] [client 139.59.73.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "120"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.157"] [uri "/.env"] [unique_id "aDAIwJUwuMCJdulLx8-w8AAAAAk"] show less

VM1 Bad user agents ignoring web crawling rules. Draing bandwidth

Accessed trap at '/.env'

(mod_security) mod_security (id:210492) triggered by 139.59.73.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 23 00:20:50.096275 2025] [security2:error] [pid 1704176:tid 1704176] [client 139.59.73.90:53004] ... show more (mod_security) mod_security (id:210492) triggered by 139.59.73.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Fri May 23 00:20:50.096275 2025] [security2:error] [pid 1704176:tid 1704176] [client 139.59.73.90:53004] [client 139.59.73.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.48"] [uri "/.env"] [unique_id "aC_3ojMwFPl09DMAC__7-gAAABM"] show less

Try to connect to Port_Scan_443_tcp

Web app exploits

spam or other hacking activities reported by webbfabriken security servers Attack reported by Webbfabriken Security API - WFSecAPI

tcp/443 (2 or more attempts)

Port probe to tcp/443 (https) [srv134]

(mod_security) mod_security (id:210492) triggered by 139.59.73.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 22 23:57:36.219021 2025] [security2:error] [pid 1095763:tid 1095763] [client 139.59.73.90:35382] ... show more (mod_security) mod_security (id:210492) triggered by 139.59.73.90 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 22 23:57:36.219021 2025] [security2:error] [pid 1095763:tid 1095763] [client 139.59.73.90:35382] [client 139.59.73.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.165"] [uri "/.env"] [unique_id "aC_yMAeIjYF1BkfsIord-QAAAA4"] show less