|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 147.90.209.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 13:43:51.325240 2026] [security2:error] [pid 28517:tid 28517] [client 147.90.209.150:35751] ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.209.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 13:43:51.325240 2026] [security2:error] [pid 28517:tid 28517] [client 147.90.209.150:35751] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.16"] [uri "/.env"] [unique_id "arFs184JZBvs9FtPH7jpnwAAAAM"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
Starburst SysOp Team
|
|
Host header is a numeric IP address. Pattern match "(?:^( (920350-mnz6-3)
|
Hacking
Bad Web Bot
|
|
🇧🇷
Halux
|
|
147.90.209.150 Probing protected path or service
|
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 147.90.209.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 13:13:47.492532 2026] [security2:error] [pid 12748:tid 12748] [client 147.90.209.150:26741] ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.209.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 13:13:47.492532 2026] [security2:error] [pid 12748:tid 12748] [client 147.90.209.150:26741] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.251"] [uri "/.env"] [unique_id "arFly4s_zHYVNP6MXOLqWAAAACY"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇺🇸
TPI-Abuse
|
|
(mod_security) mod_security (id:210492) triggered by 147.90.209.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 12:56:23.216235 2026] [security2:error] [pid 6976:tid 7104] [client 147.90.209.150:31031] M ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.209.150 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Sep 21 12:56:23.216235 2026] [security2:error] [pid 6976:tid 7104] [client 147.90.209.150:31031] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "192.64.150.81"] [uri "/.env"] [unique_id "arFht8qOZL-5Ay32M9Y-0AAAAo4"]
show less
|
Brute-Force
Bad Web Bot
Web App Attack
|
|
🇬🇧
gurnip
|
|
Vulnerability probe of page /.env, not found on server.
|
Brute-Force
Web App Attack
|
|
🇧🇪
cmbplf
|
|
192 requests with user_agent.original Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1) Gecko/20021208 Debian/1.2.1-2
191 requests with user_agent.original Mozilla/5.0 (Linux; Android 9) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/119 ...
show more
192 requests with user_agent.original Mozilla/5.0 (X11; U; Linux i686; en-US; rv:1.2.1) Gecko/20021208 Debian/1.2.1-2
191 requests with user_agent.original Mozilla/5.0 (Linux; Android 9) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/119.0.6045.66 Mobile DuckDuckGo/1 Lilo/1.2.3 Safari/537.36
179 requests with user_agent.original Mozilla/5.0 (iPhone; CPU iPhone OS 15_6_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Mobile/19G82 Instagram 306.0.0.20.118 (iPhone12,1; iOS 15_6_1; en_GB; en; scale=2.00; 828x1792; 529083166) NW/3
174 requests with user_agent.original Mozilla/5.0 (Linux; Android 11; SM-A115M Build/RP1A.200720.012; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/102.0.5005.125 Mobile Safari/537.36 Instagram 306.0.0.35.109 Android (30/11; 280dpi; 720x1411; samsung; SM-A115M; a11q; qcom; pt_BR; 530130405)
173 requests with user_agent.original Mozilla/5.0 (Macintosh; U; PPC; en-US; rv:0.9.3) Gecko/20010802
170 requests with user_agent.original Mozilla/5.0 (X11;
show less
|
Brute-Force
Bad Web Bot
|
|
🇳🇿
Antinson
|
|
Scraping with a high error ratio and request rate
|
Bad Web Bot
|
|
🇫🇷
LRob
|
|
CrowdSec: crowdsecurity/http-bad-user-agent | req: ["/wp-content/themes/seotheme/db.php?u","/"] | UA: ["Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/ ...
show more
CrowdSec: crowdsecurity/http-bad-user-agent | req: ["/wp-content/themes/seotheme/db.php?u","/"] | UA: ["Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/53
show less
|
Bad Web Bot
|
|
🇫🇮
YF
|
|
WordPress content enumeration
|
Web App Attack
|
|
🇺🇸
Major Hostility
|
|
"GET /wp-content/themes/seotheme/db.php?u HTTP/1.1" 404
"GET /plugins/content/apismtp/apismtp.php.suspected?test=hello HTTP/1.1" 404
|
Web App Attack
|
|
🇦🇺
screwlooseit.com.au
|
|
Blocked by CSF 13 firewall - Rule: WPLOGIN
US/United States/-
|
Web App Attack
|
|
🇯🇵
S.O.B.A. Dev.
|
|
Web vulnerability scanning
|
Brute-Force
Web Spam
Web App Attack
|
|
🇩🇪
maxpower
|
|
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 147.90.209.150 (DE/Germany/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 147.90.209.150 - - [02/Jul/2026:15:25:57 +0200] "GET /wp-content/themes/seotheme/db. ...
show more
(backdoor_scan) REGOLA 7 - Backdoor Scan Attempt 147.90.209.150 (DE/Germany/-): 2 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 147.90.209.150 - - [02/Jul/2026:15:25:57 +0200] "GET /wp-content/themes/seotheme/db.php?u HTTP/2.0" 404 14191 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "147.90.209.150" host=villapardi.it
147.90.209.150 - - [02/Jul/2026:15:41:32 +0200] "GET /wp-content/themes/seotheme/db.php?u HTTP/2.0" 404 10911 "www.google.com" "Mozlila/5.0 (Linux; Android 7.0; SM-G892A Bulid/NRD90M; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/60.0.3112.107 Moblie Safari/537.36" "147.90.209.150" host=www.consorzioaet.it
show less
|
Port Scan
|
