64.137.99.50

[Fri Oct 23 06:49:14.819118 2026] [proxy_fcgi:error] [pid 3642771:tid 3642771] [client 64.137.99.50:53275] AH01071: Got error 'Primary script unknown' ...

bad-bot hacking for vulnerable links.

Web App Attack, Hacking

(mod_security) mod_security (id:210492) triggered by 64.137.99.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 07:30:16.012679 2026] [security2:error] [pid 23336:tid 23336] [client 64.137.99.50:55311] Mod ... show more (mod_security) mod_security (id:210492) triggered by 64.137.99.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jan 17 07:30:16.012679 2026] [security2:error] [pid 23336:tid 23336] [client 64.137.99.50:55311] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "cpcalendars.nbcnewsradio.com"] [uri "/.env.save"] [unique_id "aWuA2GdHkPEiNwyhVoLMwAAAAAU"] show less

(mod_security) mod_security (id:210730) triggered by 64.137.99.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 12:36:58.453887 2025] [security2:error] [pid 27849:tid 28210] [client 64.137.99.50:55237] Mod ... show more (mod_security) mod_security (id:210730) triggered by 64.137.99.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Mon Dec 29 12:36:58.453887 2025] [security2:error] [pid 27849:tid 28210] [client 64.137.99.50:55237] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.kettlehill.net|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.kettlehill.net"] [uri "/cslu/v1/var/logs/customer-cslu-lib-log.log"] [unique_id "aVK8OlQ7a22kNO2lY86fkwAAAMo"] show less

IP was involved in L7 DDoS attack.

(mod_security) mod_security (id:210492) triggered by 64.137.99.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 21:10:55.509482 2025] [security2:error] [pid 404369:tid 404491] [client 64.137.99.50:35185] M ... show more (mod_security) mod_security (id:210492) triggered by 64.137.99.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sat Jul 26 21:10:55.509482 2025] [security2:error] [pid 404369:tid 404491] [client 64.137.99.50:35185] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.kettlehill.kettlehill.com"] [uri "/.env"] [unique_id "aIV8n41ApCwrT9-Kn8W6XAAAAJY"] show less

(mod_security) mod_security (id:210492) triggered by 64.137.99.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 18:42:29.880952 2025] [security2:error] [pid 3673785:tid 3673785] [client 64.137.99.50:33609] ... show more (mod_security) mod_security (id:210492) triggered by 64.137.99.50 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Thu May 29 18:42:29.880952 2025] [security2:error] [pid 3673785:tid 3673785] [client 64.137.99.50:33609] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "webmail.farmers123.com"] [uri "/wp-config.php.dist"] [unique_id "aDji1RC9wWApIEniSddFLwAAAAA"] show less

VM1 Bad user agents ignoring web crawling rules. Draing bandwidth

Ports: 2077,2078,2082,2083,2086,2087,2095,2096; Direction: 0; Trigger: LF_DISTATTACK

[08/Feb/2025 08:33:56] Failed IMAP login from 64.137.99.50

| A web attack returned code 200 (success).

Intensive scraping: /web?s=%22Create%20new%20Useraccount%20here%22%20%22Language%22&scraper=wiby. User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36 OPR/89.0.4447.51.

Form spam

Form spam