This IP address has been reported a total of
8
times from
8 distinct
sources.
149.28.41.63 was first reported on
October 25th 2026 , and the most recent report was
47 minutes ago Germany
with 5
reports;
Spain
with 1
report;
France
with 1
report.
The most common categories in these recent reports were:
Web App Attack
6
times;
Hacking
6
times;
Bad Web Bot
3
times;
Brute-Force
2
times.
Recent Reports
We have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Reporter
IoA Timestamp (UTC)
Comment
Categories
🇳🇱
0xffffffff
2026-10-25 09:52:19
(47 minutes ago)
[2026-10-25 11:52:18.185554] [authz_core:error] [pid 3205640:tid 135062217549504] [client 149.28.41. ...
show more
[2026-10-25 11:52:18.185554] [authz_core:error] [pid 3205640:tid 135062217549504] [client 149.28.41.63:53534] AH01630: client denied by server configuration: /var/www/*/.env.production , error_notes:wrong-host , URI:'/.env.production'
[2026-10-25 11:52:18.190489] [authz_core:error] [pid 3205641:tid 135061680678592] [client 149.28.41.63:53468] AH01630: client denied by server configuration: /var/www/*/info.php , error_notes:php_info , URI:'/info.php'
[2026-10-25 11:52:18.195230] [authz_core:error] [pid 3205641:tid 135062360626880] [client 149.28.41.63:53554] AH01630: client denied by server configuration: /var/www/*/.env.bak , error_notes:backup-files , URI:'/.env.bak'
[2026-10-25 11:52:18.274000] [authz_core:error] [pid 3205641:tid 135061638715072] [client 149.28.41.63:53468] AH01630: client denied by server configuration: /var/www/*/config , error_notes:config-files , URI:'/config/database.yml'
[2026-10-25 11:52:18.280027] [authz_core:error] [pid 3205641:tid 135061655500480] [client 149.28.41.63:53554] AH016
show less
Web App Attack
Bad Web Bot
🇩🇪
Bedios GmbH
2026-10-25 09:26:37
(1 hour ago)
Scanning for exposed credentials and private keys
Hacking
🇫🇷
LoneRider
2026-10-25 08:54:14
(1 hour ago)
[25/Oct/2026:09:54:14.607961 +0100] at3DthVCiyH5WrnhAERkRwAAABs 149.28.41.63 54664 127.0.0.1 7080
[2 ...
show more
[25/Oct/2026:09:54:14.607961 +0100] at3DthVCiyH5WrnhAERkRwAAABs 149.28.41.63 54664 127.0.0.1 7080
[25/Oct/2026:09:54:14.723797 +0100] at3DttGIGrvap5hwTSKLvAAAAAE 149.28.41.63 54678 127.0.0.1 7080
[25/Oct/2026:09:54:14.725480 +0100] at3Dtg_MZR6n5wj3EDxRFgAAABo 149.28.41.63 54688 127.0.0.1 7080
...
show less
Hacking
🇩🇪
Teufel100
2026-10-25 07:57:16
(2 hours ago)
ModSecurity rejected a query
Brute-Force
Hacking
Web App Attack
🇩🇪
filstal.org
2026-10-25 07:28:43
(3 hours ago)
Web reconnaissance detected: automated probing for sensitive files, backup archives, admin panels an ...
show more
Web reconnaissance detected: automated probing for sensitive files, backup archives, admin panels and known vulnerability paths.
show less
Hacking
Brute-Force
Web App Attack
🇪🇸
Yoeph
2026-10-25 07:02:24
(3 hours ago)
Malicious probe on /.env.bak (Permanently Banned) by TurnoControlPro Web Shield
Hacking
Bad Web Bot
Web App Attack
🇩🇪
Michel Wijnberg
2026-10-25 06:45:47
(3 hours ago)
149.28.41.63 - - [25/Oct/2026:06:45:47 +0000] "GET /server/.env HTTP/1.1" 404 146 "-" "Mozilla/5.0 ( ...
show more
149.28.41.63 - - [25/Oct/2026:06:45:47 +0000] "GET /server/.env HTTP/1.1" 404 146 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:126.0) Gecko/20100101 Firefox/126.0"
...
show less
Bad Web Bot
Web App Attack
🇩🇪
Melle
2026-10-25 05:10:01
(5 hours ago)
Blocked by CrowdSec | Scenario: crowdsecurity/http-probing | 149.28.41.63 triggered 11 events | Dete ...
show more
Blocked by CrowdSec | Scenario: crowdsecurity/http-probing | 149.28.41.63 triggered 11 events | Detected: 2026-10-25T05:09:59.820585661Z
show less
Web App Attack
Hacking
Showing 1 to
8
of 8 reports
