JavaScript is disabled. Some features of this site may not work properly. For a smoother experience, please enable JavaScript in your browser settings.

AbuseIPDB » 147.90.209.148

147.90.209.148 was found in our database!

This IP was reported 49 times. Confidence of Abuse is 100%: ?

100%

ISP	VPN Consumer Frankfurt, Germany
Usage Type	Data Center/Web Hosting/Transit
ASN	AS212238
Domain Name	vpnconsumer.com
Country	🇩🇪 Germany
City	Frankfurt am Main, Hesse

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated weekly.

Report 147.90.209.148

Whois 147.90.209.148

IP Abuse Reports for 147.90.209.148:

This IP address has been reported a total of 49 times from 43 distinct sources. 147.90.209.148 was first reported on June 25th 2026, and the most recent report was 3 days ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp (UTC)	Comment	Categories
🇮🇳 evicky2002	2026-08-15 07:06:21 (3 days ago)	Confirmed malicious by STILWaters CTI platform (score=100, sources=1)	Hacking Brute-Force SSH
🇩🇪 klaus_ph	2026-08-14 13:26:35 (3 days ago)	...	Bad Web Bot
🇳🇱 MyGlobalFlowers	2026-08-12 07:31:06 (6 days ago)	Multiple WAF Violations	Web App Attack
🇫🇷 mail.avx.gr	2026-08-12 03:31:11 (6 days ago)	Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 147.90.209.148 - - [12/Aug/2026:06:31:10 +0300] " ... show more Plesk Fail2Ban jail: Plesk-Web-Exploits. Evidence: 147.90.209.148 - - [12/Aug/2026:06:31:10 +0300] "GET /vendor/phpunit/phpunit/phpunit.xsd HTTP/1.1" 403 6296 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0" show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-12 03:19:28 (6 days ago)	(mod_security) mod_security (id:210730) triggered by 147.90.209.148 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 147.90.209.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 23:19:25.019475 2026] [security2:error] [pid 289054:tid 289054] [client 147.90.209.148:46319] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|intelligencer.us\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "intelligencer.us"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "anvmPa9gDKYF2EyqRcqYbgAAAAI"] show less	Brute-Force Bad Web Bot Web App Attack
🇺🇸 WizardsToolkit	2026-08-12 03:18:01 (6 days ago)	attempted to access	Web App Attack
🇬🇧 kie	2026-08-12 02:54:34 (6 days ago)	12-08-2026:02:54:11UTC [Nginx Web Server] Suspicious web request: path:/vendor/ (1 request(s)).	Bad Web Bot Web App Attack
🇩🇪 maxpower	2026-08-12 02:43:55 (6 days ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 147.90.209.148 (DE/Germany/-): 1 in the ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 147.90.209.148 (DE/Germany/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 147.90.209.148 - - [12/Aug/2026:04:43:50 +0200] "GET /vendor/phpunit/phpunit/phpunit.xsd HTTP/2.0" 301 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0" "147.90.209.148" host=masterlabvideoproduzioni.it show less	Port Scan
Anonymous	2026-08-12 02:40:19 (6 days ago)	Automated abuse report (probe_vendor). Observed GET /vendor/phpunit/phpunit/phpunit.xsd hits=1 at 20 ... show more Automated abuse report (probe_vendor). Observed GET /vendor/phpunit/phpunit/phpunit.xsd hits=1 at 2026-08-12T02:39:11Z UTC. show less	Web App Attack
🇩🇪 maxpower	2026-08-12 02:22:09 (6 days ago)	(PERMBLOCK) 147.90.209.148 (DE/Germany/-) has had more than 4 temp blocks in the last 86400 secs; Po ... show more (PERMBLOCK) 147.90.209.148 (DE/Germany/-) has had more than 4 temp blocks in the last 86400 secs; Ports: *; Direction: inout; Trigger: LF_PERMBLOCK_COUNT; Logs: show less	Port Scan
🇺🇸 TPI-Abuse	2026-08-12 01:42:01 (6 days ago)	(mod_security) mod_security (id:210730) triggered by 147.90.209.148 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 147.90.209.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 21:41:57.716576 2026] [security2:error] [pid 2312522:tid 2312522] [client 147.90.209.148:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|chaitanyaconsult.in\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "chaitanyaconsult.in"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "anvPZWF4qGKrOqt7OAbwZAAAAAk"] show less	Brute-Force Bad Web Bot Web App Attack
🇵🇱 nakordoni.eu	2026-08-12 01:30:03 (6 days ago)	Blocked by nakordoni.eu automated security: nakordoni-probe-gate. Jail: nakordoni-probe-gate, 1 matc ... show more Blocked by nakordoni.eu automated security: nakordoni-probe-gate. Jail: nakordoni-probe-gate, 1 matches. ISP: VPN Consumer Frankfurt, Germany (DE), Usage: Data Center/Web Hosting/Transit. Prior AbuseIPDB score at ban time: 100/100. show less	Bad Web Bot Web App Attack
🇬🇧 Aetherweb Ark	2026-08-12 01:10:45 (6 days ago)	(mod_security) mod_security (id:949110) triggered by 147.90.209.148 (DE/Germany/-): N in the last X ... show more (mod_security) mod_security (id:949110) triggered by 147.90.209.148 (DE/Germany/-): N in the last X secs show less	Web App Attack
🇺🇸 TPI-Abuse	2026-08-12 01:05:25 (6 days ago)	(mod_security) mod_security (id:210730) triggered by 147.90.209.148 (-): 1 in the last 300 secs; Por ... show more (mod_security) mod_security (id:210730) triggered by 147.90.209.148 (-): 1 in the last 300 secs; Ports: *; Direction: 1; Trigger: LF_MODSEC; Logs: [Tue Aug 11 21:05:16.871735 2026] [security2:error] [pid 6539:tid 6539] [client 147.90.209.148:0] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/etc/apache2/conf.d/modsec_vendor_configs/comodo_apache/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "4"] [msg "COMODO WAF: URL file extension is restricted by policy\|\|yggdrasil.org\|F\|2"] [data ".xsd"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "yggdrasil.org"] [uri "/vendor/phpunit/phpunit/phpunit.xsd"] [unique_id "anvGzALq-sBRg489jl6iCAAAAAo"] show less	Brute-Force Bad Web Bot Web App Attack
🇩🇪 maxpower	2026-08-12 00:47:48 (6 days ago)	(exploit_critical) REGOLA 2 - Critical File Exploit Attempt 147.90.209.148 (DE/Germany/-): 1 in the ... show more (exploit_critical) REGOLA 2 - Critical File Exploit Attempt 147.90.209.148 (DE/Germany/-): 1 in the last 3600 secs; Ports: *; Direction: inout; Trigger: LF_CUSTOMTRIGGER; Logs: 147.90.209.148 - - [12/Aug/2026:02:47:46 +0200] "GET /vendor/phpunit/phpunit/phpunit.xsd HTTP/2.0" 301 0 "-" "Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0" "147.90.209.148" host=fdpimmobiliare.com show less	Port Scan

Showing 1 to 15 of 49 reports

Think this IP has been falsely reported? You may request to have the associated reports reviewed and removed. Request Takedown 🚩

Recently Reported IPs:

🇱🇹 213.176.26.23

🇯🇵 118.194.228.167

🇲🇽 68.155.155.23

🇱🇹 213.176.26.123

🇳🇱 195.178.110.30

🇧🇷 191.6.83.236

🇫🇷 172.71.118.142

🇺🇸 147.185.132.136

🇨🇳 113.238.73.97

🇺🇸 74.82.47.19

🇺🇸 70.127.76.196

🇩🇪 69.5.169.188

🇹🇼 60.199.224.55

🇬🇧 35.203.211.142

🇱🇹 213.176.26.63

🇺🇸 173.40.161.38

🇸🇬 167.172.89.254

🇯🇵 118.193.61.14

🇻🇳 113.173.121.88

🇨🇳 112.243.32.83