🇩🇪
Luhte
2026-07-11 17:51:37
(3 weeks ago)
Unsolicited TCP connection from 149.56.241.97 to port 0 at 2026-07-11T17:51:37Z. Source IP completed ...
show more
Unsolicited TCP connection from 149.56.241.97 to port 0 at 2026-07-11T17:51:37Z. Source IP completed three-way handshake to non-public service on this host. Detected by automated intrusion monitoring.
show less
Port Scan
Hacking
🇧🇷
KingHost
2026-07-10 05:31:11
(3 weeks ago)
Brute-Force
🇩🇪
McClay
2026-07-10 05:20:31
(3 weeks ago)
HTTP-404 spam:149.56.241.97 - - [10/Jul/2026:07:20:26 +0200] "GET /.env HTTP/1.1" 404 995 "-" "Mozil ...
show more
HTTP-404 spam:149.56.241.97 - - [10/Jul/2026:07:20:26 +0200] "GET /.env HTTP/1.1" 404 995 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
149.56.241.97 - - [10/Jul/2026:07:20:26 +0200] "GET /.env.local HTTP/1.1" 404 995 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
149.56.241.97 - - [10/Jul/2026:07:20:26 +0200] "GET /.env.production HTTP/1.1" 404 995 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
149.56.241.97 - - [10/Jul/2026:07:20:27 +0200] "GET /.env.staging HTTP/1.1" 404 995 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
149.56.241.97 - - [10/Jul/2026:07:20:27 +0200] "GET /.env.backup HTTP/1.1" 404 995 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
149.56.241.97 - - [10/Jul/2026:07:20:27 +0200] "GET /.env.old HTTP/1.1" 404 995 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
149.56.241.97 - - [10/Jul/2026:07:
...
show less
Web App Attack
🇩🇪
Tamsy
2026-07-10 02:02:27
(3 weeks ago)
HTTPD - Web Application scripting attack
Web App Attack
🇩🇪
McClay
2026-07-10 01:55:12
(3 weeks ago)
HTTP-404 spam:149.56.241.97 - - [10/Jul/2026:03:55:06 +0200] "GET /.env HTTP/1.1" 404 5006 "-" "Mozi ...
show more
HTTP-404 spam:149.56.241.97 - - [10/Jul/2026:03:55:06 +0200] "GET /.env HTTP/1.1" 404 5006 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
149.56.241.97 - - [10/Jul/2026:03:55:06 +0200] "GET /.env.local HTTP/1.1" 404 1017 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
149.56.241.97 - - [10/Jul/2026:03:55:07 +0200] "GET /.env.production HTTP/1.1" 404 1017 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
149.56.241.97 - - [10/Jul/2026:03:55:07 +0200] "GET /.env.staging HTTP/1.1" 404 1017 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
149.56.241.97 - - [10/Jul/2026:03:55:07 +0200] "GET /.env.backup HTTP/1.1" 404 1017 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
149.56.241.97 - - [10/Jul/2026:03:55:08 +0200] "GET /.env.old HTTP/1.1" 404 1017 "-" "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"
149.56.241.97 - - [10/Jul/20
...
show less
Web App Attack
🇩🇪
ut-addicted.com
2026-07-09 21:58:09
(3 weeks ago)
\[09/Jul/2026:23:58:06 +0200\] alAZbkqwZSdCO4KchCvCoQAAAI8 149.56.241.97 48066 78.46.187.162 80
\[09 ...
show more
\[09/Jul/2026:23:58:06 +0200\] alAZbkqwZSdCO4KchCvCoQAAAI8 149.56.241.97 48066 78.46.187.162 80
\[09/Jul/2026:23:58:07 +0200\] alAZb0qwZSdCO4KchCvCogAAAIA 149.56.241.97 48066 78.46.187.162 80
\[09/Jul/2026:23:58:08 +0200\] alAZcEqwZSdCO4KchCvCowAAAII 149.56.241.97 48066 78.46.187.162 80
show less
Brute-Force
Web App Attack
2026-07-09 19:16:30
(3 weeks ago)
"GET /.env HTTP/1.1"
Hacking
Web App Attack
🇩🇪
Hary74656
2026-07-09 19:11:38
(3 weeks ago)
[Thu Jul 09 21:11:25.912398 2026] [security2:error] [pid 165971:tid 166214] [client 149.56.241.97:46 ...
show more
[Thu Jul 09 21:11:25.912398 2026] [security2:error] [pid 165971:tid 166214] [client 149.56.241.97:46420] [client 149.56.241.97] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecurity-crs/rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.4"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "78.46.107.184"] [uri "/.env"] [unique_id "ak_yXRQyQAW7d4_JlJhU-AAAA6Y"]
[Thu Jul 09 21:11:26.311276 2026] [security2:error] [pid 165971:tid 166073] [client 149.56.241.97:46420] [client 149.56.241.97] ModSecurity: Access denied with code 403 (phase 2). Matched phrase "/.env" at REQUEST_FILENAME. [file "/usr/share/modsecur
...
show less
Web App Attack
🇩🇪
ut-addicted.com
2026-07-09 18:42:52
(3 weeks ago)
\[Thu Jul 09 20:42:50.702954 2026\] \[:error\] \[pid 25809:tid 139785874171648\] \[client 149.56.241 ...
show more
\[Thu Jul 09 20:42:50.702954 2026\] \[:error\] \[pid 25809:tid 139785874171648\] \[client 149.56.241.97:37186\] \[client 149.56.241.97\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 8\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "78.46.187.162"\] \[uri "/.env"\] \[unique_id "ak-rqkqwZSdCO4KchCutBwAAAIM"\]
show less
Brute-Force
Web App Attack
🇫🇷
ricardosantis
2026-07-09 18:21:42
(3 weeks ago)
Jul 09 15:21:27 auth: Info: passwd-file([email protected] ,149.56.241.97,<gIBBsTFWmJqVOPFh>): unknown ...
show more
Jul 09 15:21:27 auth: Info: passwd-file([email protected] ,149.56.241.97,<gIBBsTFWmJqVOPFh>): unknown user
Jul 09 15:21:29 imap-login: Info: Disconnected: Connection closed (auth failed, 1 attempts in 2 secs): user=<[email protected] >, method=PLAIN, rip=149.56.241.97, lip=13.140.180.76, TLS, session=<gIBBsTFWmJqVOPFh>
Jul 09 15:21:33 auth: Info: passwd-file([email protected] ,149.56.241.97,<I+tksTFW2seVOPFh>): unknown user
Jul 09 15:21:35 imap-login: Info: Disconnected: Connection closed (auth failed, 1 attempts in 6 secs): user=<[email protected] >, method=PLAIN, rip=149.56.241.97, lip=13.140.180.76, session=<I+tksTFW2seVOPFh>
Jul 09 15:21:41 auth: Info: passwd-file([email protected] ,149.56.241.97,<PDvUsTFW4t2VOPFh>): unknown user
...
show less
Brute-Force
Email Spam
🇩🇪
netclix.gr
2026-07-09 16:30:14
(3 weeks ago)
(mod_security) mod_security triggered on hostname [redacted] 149.56.241.97 (CA/Canada/ns534993.ip-14 ...
show more
(mod_security) mod_security triggered on hostname [redacted] 149.56.241.97 (CA/Canada/ns534993.ip-149-56-241.net): (CF_ENABLE)
show less
SQL Injection
🇩🇪
big-cloud.nl
2026-07-09 13:31:16
(3 weeks ago)
Try to access /.env
Web App Attack
🇫🇷
LRob
2026-07-09 13:08:50
(3 weeks ago)
CrowdSec: crowdsecurity/http-sensitive-files | req: ["/.env","/.env.local","/.env.staging","/.env.ba ...
show more
CrowdSec: crowdsecurity/http-sensitive-files | req: ["/.env","/.env.local","/.env.staging","/.env.backup","/.env.bak"] | UA: ["Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)"]
show less
Hacking
🇹🇭
Sawasdee
2026-07-08 14:00:07
(3 weeks ago)
Unwanted checking 80 or 443 port
...
Bad Web Bot
🇩🇪
Luhte
2026-07-08 13:31:44
(3 weeks ago)
Unsolicited TCP connection from 149.56.241.97 to port 0 at 2026-07-08T13:31:43Z. Source IP completed ...
show more
Unsolicited TCP connection from 149.56.241.97 to port 0 at 2026-07-08T13:31:43Z. Source IP completed three-way handshake to non-public service on this host. Detected by automated intrusion monitoring.
show less
Port Scan
Hacking