🇿🇦
conure.sh
2026-08-25 17:35:05
(3 hours ago)
csagent: score 20.2: secrets grab x2, 404 noise floor x1; 1 domain(s) in 1s
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 17:27:45
(3 hours ago)
(mod_security) mod_security (id:210492) triggered by 147.90.209.229 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.209.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 13:27:39.844953 2026] [security2:error] [pid 7653:tid 7653] [client 147.90.209.229:51971] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "drgas.xyz"] [uri "/.git/config"] [unique_id "ao3Qi-3WEm2vFoSube635AAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇦
URAN Publishing Service
2026-08-25 17:03:02
(3 hours ago)
[25/Aug/2026:20:03:02 +0300] -- 147.90.209.229 Ban reason: User-Agent Go-http-client
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 16:01:58
(4 hours ago)
(mod_security) mod_security (id:210492) triggered by 147.90.209.229 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.209.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 12:01:51.423666 2026] [security2:error] [pid 25039:tid 25039] [client 147.90.209.229:22077] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "votefordave.org"] [uri "/.git/config"] [unique_id "ao28b12PKT-SGpos0GoEnwAAAAk"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 15:29:08
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 147.90.209.229 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.209.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 11:29:03.394139 2026] [security2:error] [pid 16884:tid 16884] [client 147.90.209.229:34995] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "mtbpv.org"] [uri "/.git/config"] [unique_id "ao20v_9CfTjGSWOOrLuP7wAAABM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 15:07:12
(5 hours ago)
(mod_security) mod_security (id:210492) triggered by 147.90.209.229 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.209.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 11:07:06.919412 2026] [security2:error] [pid 3820:tid 3820] [client 147.90.209.229:33373] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "adventiststoday.org"] [uri "/.git/config"] [unique_id "ao2vml_Dt-FGP1IEuxEcFwAAAAg"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇳🇱
e.fierstra
2026-08-25 15:05:10
(5 hours ago)
ModSecurity hits exceeded
Bad Web Bot
Web App Attack
🇨🇦
Anytech
2026-08-25 14:51:36
(5 hours ago)
Blocked by Conn-Monitor: http-bad-user-agent
Web App Attack
Bad Web Bot
2026-08-25 14:47:02
(5 hours ago)
Bot / scanning and/or hacking attempts: GET /.git/config HTTP/1.1
Hacking
Web App Attack
🇺🇸
cwytech
2026-08-25 14:24:49
(6 hours ago)
Fleet-wide ban from the Ghostfleet 👻. Triggered by scenario: cwy/tpot-web-crit.
Bad Web Bot
Web App Attack
🇺🇸
TPI-Abuse
2026-08-25 14:19:30
(6 hours ago)
(mod_security) mod_security (id:210492) triggered by 147.90.209.229 (-): 1 in the last 300 secs; Por ...
show more
(mod_security) mod_security (id:210492) triggered by 147.90.209.229 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 25 10:19:25.576671 2026] [security2:error] [pid 29501:tid 29501] [client 147.90.209.229:53101] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "juniperhills.net"] [uri "/.git/config"] [unique_id "ao2kba2ynHSRsAmjmzrPXwAAAAM"]
show less
Brute-Force
Bad Web Bot
Web App Attack
🇺🇸
anti-res
2026-07-22 08:58:53
(1 month ago)
Attempt of unauthorized access
Port Scan
Bad Web Bot
Web App Attack
🇧🇬
HighWay
2026-07-08 16:41:23
(1 month ago)
147.90.209.229 - - [08/Jul/2026:16:41:20 +0000] "GET /xmlrpc.php HTTP/1.1" 403 4348 "-" "Mozilla/5.0 ...
show more
147.90.209.229 - - [08/Jul/2026:16:41:20 +0000] "GET /xmlrpc.php HTTP/1.1" 403 4348 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 14_2_1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
147.90.209.229 - - [08/Jul/2026:16:41:20 +0000] "GET /xmlrpc.php HTTP/1.1" 403 421 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/120.0.2210.91"
147.90.209.229 - - [08/Jul/2026:16:41:21 +0000] "GET /xmlrpc.php HTTP/1.1" 403 4348 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0"
...
show less
Port Scan
Bad Web Bot
Web App Attack
🇫🇷
LRob
2026-07-08 14:20:26
(1 month ago)
CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc | req: ["/xmlrpc.php"] | UA: ["Mozilla/5.0 (Wind ...
show more
CrowdSec: crowdsecurity/http-bf-wordpress_bf_xmlrpc | req: ["/xmlrpc.php"] | UA: ["Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Edge/120.0.2210.91","Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/53
show less
Brute-Force
Web App Attack
2026-07-08 03:42:54
(1 month ago)
147.90.209.229 - - [08/Jul/2026:05:42:53 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Mozilla/5.0 ...
show more
147.90.209.229 - - [08/Jul/2026:05:42:53 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0"
147.90.209.229 - - [08/Jul/2026:05:42:53 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:121.0) Gecko/20100101 Firefox/121.0"
147.90.209.229 - - [08/Jul/2026:05:42:53 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
147.90.209.229 - - [08/Jul/2026:05:42:54 +0200] "POST /xmlrpc.php HTTP/1.1" 200 403 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/121.0.0.0 Safari/537.36"
147.90.209.229 - - [08/Jul/2026:05:42:54 +0200] "POST /xmlrpc.php HTTP/1.1" 200 593 "-" "Mozilla/5.0 (Windows NT 11.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36"
...
show less
Brute-Force
Web App Attack