AbuseIPDB » 195.211.191.76

195.211.191.76 was found in our database!

This IP was reported 2,378 times. Confidence of Abuse is 100%: ?

100%

ISP	Pitline Ltd
Usage Type	Data Center/Web Hosting/Transit
ASN	AS214940
Domain Name	pitline.net
Country	Netherlands
City	Kerkrade, Limburg

IP info including ISP, Usage Type, and Location provided by IPInfo. Updated biweekly.

Report 195.211.191.76

Whois 195.211.191.76

IP Abuse Reports for 195.211.191.76:

This IP address has been reported a total of 2,378 times from 289 distinct sources. 195.211.191.76 was first reported on January 22nd 2025, and the most recent report was 1 hour ago.

Recent Reports: We have received reports of abusive activity from this IP address within the last week. It is potentially still actively engaged in abusive activities.

Reporter	IoA Timestamp in UTC	Comment	Categories
Anonymous	2025-04-21 09:53:56 (1 hour ago)	Reported from Nginx log analysis 11. Log: 195.211.191.76 - - [21/Apr/2025:xx:xx:xx 0200] "GET /.env ... show moreReported from Nginx log analysis 11. Log: 195.211.191.76 - - [21/Apr/2025:xx:xx:xx 0200] "GET /.env HTTP/1.1" xxx xxx "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_10_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/76.0.3809.100 Safari/537.36" "-" "NL The Netherlands Eygelshoven" "AS214940" "Kprohost LLC" show less	Port Scan Brute-Force SSH
sajmon0011	2025-04-21 08:21:19 (3 hours ago)	195.211.191.76 - - [21/Apr/2025:10:21:19 +0200] "GET /.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macin ... show more195.211.191.76 - - [21/Apr/2025:10:21:19 +0200] "GET /.env HTTP/1.1" 404 196 "-" "Mozilla/5.0 (Macintosh; U; PPC Mac OS X; fr-fr) AppleWebKit/312.5 (KHTML, like Gecko) Safari/312.3" ... show less	Web App Attack
Rene Hickersberger	2025-04-21 08:11:12 (3 hours ago)	[2025-04-21T08:11:12Z] Malicious request to /.env	Hacking Bad Web Bot Web App Attack
el-brujo	2025-04-21 08:05:29 (3 hours ago)	21/Apr/2025:10:05:28.634540 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client ... show more21/Apr/2025:10:05:28.634540 +0200Apache-Error: [file "apache2_util.c"] [line 271] [level 3] [client 195.211.191.76] ModSecurity: Warning. Matched phrase "/.env" at REQUEST_FILENAME. [file "/etc/httpd/modsecurity.d/activated_rules/REQUEST-930-APPLICATION-ATTACK-LFI.conf"] [line "125"] [id "930130"] [msg "Restricted File Access Attempt"] [data "Matched Data: /.env found within REQUEST_FILENAME: /.env"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.5"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-lfi"] [tag "paranoia-level/1"] [tag "OWASP_CRS"] [tag "capec/1000/255/153/126"] [tag "PCI/6.5.4"] [hostname "91.126.217.153"] [uri "/.env"] [unique_id "aAX8SNmBa6N0eUZWPJrhlAAAAcM"] ... show less	Hacking Web App Attack
MSZ	2025-04-21 08:00:04 (3 hours ago)	Blocked by Fail2Ban (plesk-modsecurity)	Hacking Brute-Force Web App Attack
hackthetime	2025-04-21 07:58:25 (3 hours ago)	Tried to access .env file (/.env) [which does not exist]	Web App Attack
tg_de	2025-04-21 07:37:31 (3 hours ago)	8 attempts since 14.04.2025 15:35:49 UTC - last search for: /.env	Web App Attack
ut-addicted.com	2025-04-21 07:36:10 (3 hours ago)	\[Mon Apr 21 09:36:09.894794 2025\] \[:error\] \[pid 28745:tid 140572006233856\] \[client 195.211.19 ... show more\[Mon Apr 21 09:36:09.894794 2025\] \[:error\] \[pid 28745:tid 140572006233856\] \[client 195.211.191.76:56362\] \[client 195.211.191.76\] ModSecurity: Access denied with code 403 \(phase 2\). Operator GE matched 5 at TX:anomaly_score. \[file "/usr/local/apache/modsecurity-owasp-latest/rules/REQUEST-949-BLOCKING-EVALUATION.conf"\] \[line "57"\] \[id "949110"\] \[msg "Inbound Anomaly Score Exceeded \(Total Score: 8\)"\] \[severity "CRITICAL"\] \[tag "application-multi"\] \[tag "language-multi"\] \[tag "platform-multi"\] \[tag "attack-generic"\] \[hostname "78.46.187.162"\] \[uri "/.env"\] \[unique_id "aAX1aaxsUpCSN4TR5JoqLwAAAM4"\] show less	Brute-Force Web App Attack
BSG Webmaster	2025-04-21 07:35:15 (3 hours ago)	Port scanning (Port 443)	Port Scan Hacking
kumiko	2025-04-21 07:19:53 (4 hours ago)	[2025-04-21 07:19:52] Probing for dotfiles "GET /.env HTTP/1.1" 403	Bad Web Bot Web App Attack
thefoofighter	2025-04-21 07:17:13 (4 hours ago)	[Mon Apr 21 07:14:25.255189 2025] [:error] [pid 2572009] [client 195.211.191.76:40230] [client 195.2 ... show more[Mon Apr 21 07:14:25.255189 2025] [:error] [pid 2572009] [client 195.211.191.76:40230] [client 195.211.191.76] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3.2"] [tag "application-multi"] [tag "language-multi"] [tag "platform-multi"] [tag "attack-generic"] [hostname "63.250.44.172"] [uri "/.env"] [unique_id "aAXwUSeR9wOvWEt1a7nNywAAABQ"] [Mon Apr 21 07:17:13.152532 2025] [:error] [pid 2572007] [client 195.211.191.76:39948] [client 195.211.191.76] ModSecurity: Access denied with code 403 (phase 2). Operator GE matched 5 at TX:anomaly_score. [file "/usr/share/modsecurity-crs/rules/REQUEST-949-BLOCKING-EVALUATION.conf"] [line "93"] [id "949110"] [msg "Inbound Anomaly Score Exceeded (Total Score: 8)"] [severity "CRITICAL"] [ver "OWASP_CRS/3.3. ... show less	Bad Web Bot Web App Attack
Study Bitcoin 🤗	2025-04-21 07:00:17 (4 hours ago)	Port probe to tcp/443 (https) [srv124]	Port Scan Brute-Force Bad Web Bot Web App Attack
Vaction	2025-04-21 06:58:17 (4 hours ago)	195.211.191.76 - - [21/Apr/2025:08:58:17 +0200] "GET /.env HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windo ... show more195.211.191.76 - - [21/Apr/2025:08:58:17 +0200] "GET /.env HTTP/1.1" 404 360 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:41.0) Gecko/20100101 Firefox/41.0" show less	Hacking Bad Web Bot Web App Attack
Security_Whaller	2025-04-21 06:58:12 (4 hours ago)	Malicious activity detected on Honeypot.	Hacking Brute-Force Web App Attack
PulseServers	2025-04-21 06:57:17 (4 hours ago)	Probing a honeypot for vulnerabilities. Ignored robots.txt - UK10 Honeypot ...	Hacking Web App Attack

Is this your IP? You may request to takedown any associated reports. We will attempt to verify your ownership. Request Takedown 🚩