This IP address has been reported a total of
26
times from
17 distinct
sources.
94.154.157.47 was first reported on
, and the most recent report was
.
Recent Reports:
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
(mod_security) mod_security (id:210492) triggered by 94.154.157.47 (-): 1 in the last 300 secs; Port ...
show more(mod_security) mod_security (id:210492) triggered by 94.154.157.47 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Sun Aug 23 19:56:20.465391 2026] [security2:error] [pid 16651:tid 16651] [client 94.154.157.47:47125] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.veneerdent.com"] [uri "/.env"] [unique_id "aouIpPw2dU4r10fsCC-UYgAAAAA"]
show less
Brute-Force
Bad Web Bot
Web App Attack
Anonymous
Bot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1, GET /xmlrpc.php HTTP/1.1, GET /.e ...
show moreBot / scanning and/or hacking attempts: POST /xmlrpc.php HTTP/1.1, GET /xmlrpc.php HTTP/1.1, GET /.env HTTP/1.1, GET /wp-json/wp/v2/users HTTP/1.1, GET / HTTP/1.1
show less
[SunAug2321:29:20.6143582026][security2:error][pid35567:tid35634][client94.154.157.47:0]ModSecurity: ...
show more[SunAug2321:29:20.6143582026][security2:error][pid35567:tid35634][client94.154.157.47:0]ModSecurity:Accessdeniedwithcode403\(phase1\).Patternmatch\"\(\?i\)\(curl\|wget\|python\|nikto\|sqlmap\|acunetix\|fimap\|dirbuster\|cmsmap\)\"atREQUEST_HEADERS:User-Agent.[file\"/etc/apache2/conf.d/modsec_custom_rules.conf\"][line\"217\"][id\"990210\"][msg\"Suspicioususer-agentblocked\"][hostname\"www.restaurantgandria.ch\"][uri\"/.env\"][unique_id\"aotKEL50QQHDlMaQd_fugwAAAcU\"]
show less
{"ClientAddr":"94.154.157.47:27487","ClientHost":"94.154.157.47","ClientPort":"27487","ClientUsernam ...
show more{"ClientAddr":"94.154.157.47:27487","ClientHost":"94.154.157.47","ClientPort":"27487","ClientUsername":"-","DownstreamContentSize":416,"DownstreamStatus":403,"Duration":117048601,"OriginContentSize":416,"OriginDuration":112238623,"OriginStatus":403,"Overhead":4809978,"RequestAddr":"www.cleveradmin.de","RequestContentSize":1160,"RequestCount":4496365,"RequestHost":"www.cleveradmin.de","RequestMethod":"POST","RequestPath":"/xmlrpc.php","RequestPort":"-","RequestProtocol":"HTTP/1.1","RequestScheme":"https","RetryAttempts":0,"RouterName":"cleveradmin-www-websecure@file","ServiceAddr":"172.16.80.10:80","ServiceName":"cleveradmin-www@file","ServiceURL":"http://172.16.80.10:80","StartLocal":"2026-08-21T15:26:38.694501137+02:00","StartUTC":"2026-08-21T13:26:38.694501137Z","TLSCipher":"TLS_AES_128_GCM_SHA256","TLSVersion":"1.3","entryPointName":"websecure","level":"info","msg":"","time":"2026-08-21T15:26:38+02:00"}
{"ClientAddr":"94.154.157.47:58427","ClientHost":"94.154.157.47","ClientPort":"5
...
show less
Blocked abusive HTTP application-layer DoS / botnet traffic from 94.154.157.47: traffic from this ad ...
show moreBlocked abusive HTTP application-layer DoS / botnet traffic from 94.154.157.47: traffic from this address continues high-cost dynamic page and feed requests at abusive rates via TCP/HTTPS despite edge block responses. Likely compromised end-user host.
show less
DDoS Attack
Bad Web Bot
Exploited Host
Showing 1 to
15
of 26 reports
Think this IP has been falsely reported? You may request to have the associated
reports reviewed and removed.
Request Takedown 🚩