SCARD

Suspicious activity by IP address 149.50.97.236

Below is a list of the last 500 suspicious interactions with this IP.

Last observed Sat, 18 Apr 2026 17:29:01 (Australia/Brisbane)

Back to main list

Summary of suspicious activity by IP address 149.50.97.236

Description Count
ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) 23
ET WEB_SERVER /etc/passwd Detected in URI 8
SERVER-OTHER Apache Log4j logging remote code execution attempt 6
ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M3 4
ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M2 4
ET EXPLOIT Apache log4j RCE Attempt - lower/upper TCP Bypass M2 (CVE-2021-44228) 4
ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability 4
ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 4 Prefix Set Inbound (CVE-2022-22965) 4
ET EXPLOIT Apache log4j RCE Attempt (tcp ldap) (CVE-2021-44228) 4
ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 3 Directory Set Inbound (CVE-2022-22965) 4
ET EXPLOIT Grafana 8.x Path Traversal (CVE-2021-43798) 4
ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 2 Suffix Set Inbound (CVE-2022-22965) 4
ET INFO Spring Boot Actuator Health Check Request 4
ET WEB_SERVER PHP tags in HTTP POST 4
ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 1 Pattern Set Inbound (CVE-2022-22965) 4
ET HUNTING .exec in HTTP URI Inbound - Possible Exploit Activity 4
ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M2 4
ET WEB_SERVER Possible SQL Injection (exec) in HTTP URI 4
ET EXPLOIT Apache log4j RCE Attempt (http ldap) (CVE-2021-44228) 4
ET EXPLOIT Apache Struts 2 REST Plugin Vulnerability (CVE-2017-9805) 4
ET WEB_SERVER SQL Injection Select Sleep Time Delay 4
SERVER-WEBAPP Facade Ignition remote code execution attempt 2
ET HUNTING Possible Apache log4j RCE Attempt - Any Protocol TCP (CVE-2021-44228) 2
SERVER-WEBAPP PHPUnit PHP remote code execution attempt 2
SERVER-WEBAPP Grafana getPluginAssets path traversal attempt 2
SERVER-APACHE Apache Struts remote code execution attempt 2

Detailed activity by IP address 149.50.97.236

Timestamp Description Protocol Destination Port
2026-04-18 17:29:01 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-18 17:29:01 ET EXPLOIT Apache log4j RCE Attempt (tcp ldap) (CVE-2021-44228) TCP 80
2026-04-18 17:29:01 ET EXPLOIT Apache log4j RCE Attempt (http ldap) (CVE-2021-44228) TCP 80
2026-04-18 17:29:01 ET EXPLOIT Apache log4j RCE Attempt - lower/upper TCP Bypass M2 (CVE-2021-44228) TCP 80
2026-04-18 16:29:00 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-18 16:28:33 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-18 16:28:20 ET EXPLOIT Apache Struts 2 REST Plugin Vulnerability (CVE-2017-9805) TCP 80
2026-04-18 16:28:20 ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M3 TCP 80
2026-04-18 16:28:20 ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M2 TCP 80
2026-04-18 16:28:20 ET WEB_SERVER PHP tags in HTTP POST TCP 80
2026-04-18 16:28:20 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-18 16:28:13 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-18 16:28:10 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-18 16:28:08 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-18 16:28:07 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-18 16:28:07 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-18 16:28:05 ET WEB_SERVER SQL Injection Select Sleep Time Delay TCP 80
2026-04-18 16:28:05 ET HUNTING .exec in HTTP URI Inbound - Possible Exploit Activity TCP 80
2026-04-18 16:28:05 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 1 Pattern Set Inbound (CVE-2022-22965) TCP 80
2026-04-18 16:28:05 ET INFO Spring Boot Actuator Health Check Request TCP 80
2026-04-18 16:28:05 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 4 Prefix Set Inbound (CVE-2022-22965) TCP 80
2026-04-18 16:28:05 ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability TCP 80
2026-04-18 16:28:05 ET EXPLOIT Grafana 8.x Path Traversal (CVE-2021-43798) TCP 80
2026-04-18 16:28:05 ET WEB_SERVER /etc/passwd Detected in URI TCP 80
2026-04-18 16:28:05 ET WEB_SERVER /etc/passwd Detected in URI TCP 80
2026-04-18 16:28:05 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 2 Suffix Set Inbound (CVE-2022-22965) TCP 80
2026-04-18 16:28:05 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 3 Directory Set Inbound (CVE-2022-22965) TCP 80
2026-04-18 16:28:05 ET WEB_SERVER Possible SQL Injection (exec) in HTTP URI TCP 80
2026-04-18 16:28:05 ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M2 TCP 80
2026-04-15 18:25:58 ET WEB_SERVER Possible SQL Injection (exec) in HTTP URI TCP 80
2026-04-15 18:25:58 ET INFO Spring Boot Actuator Health Check Request TCP 80
2026-04-15 18:25:58 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 1 Pattern Set Inbound (CVE-2022-22965) TCP 80
2026-04-15 18:25:58 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 2 Suffix Set Inbound (CVE-2022-22965) TCP 80
2026-04-15 18:25:58 ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M2 TCP 80
2026-04-15 18:25:58 ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M2 TCP 80
2026-04-15 18:25:58 ET WEB_SERVER Possible SQL Injection (exec) in HTTP URI TCP 80
2026-04-15 18:25:58 ET HUNTING .exec in HTTP URI Inbound - Possible Exploit Activity TCP 80
2026-04-15 18:25:58 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 2 Suffix Set Inbound (CVE-2022-22965) TCP 80
2026-04-15 18:25:58 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 4 Prefix Set Inbound (CVE-2022-22965) TCP 80
2026-04-15 18:25:58 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 3 Directory Set Inbound (CVE-2022-22965) TCP 80
2026-04-15 18:25:58 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 3 Directory Set Inbound (CVE-2022-22965) TCP 80
2026-04-15 18:25:58 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 1 Pattern Set Inbound (CVE-2022-22965) TCP 80
2026-04-15 18:25:58 ET INFO Spring Boot Actuator Health Check Request TCP 80
2026-04-15 18:25:58 ET HUNTING .exec in HTTP URI Inbound - Possible Exploit Activity TCP 80
2026-04-15 18:25:58 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 4 Prefix Set Inbound (CVE-2022-22965) TCP 80
2026-04-15 18:24:46 ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability TCP 80
2026-04-15 18:24:45 ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability TCP 80
2026-04-15 17:25:57 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-15 17:25:57 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-15 17:25:21 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-15 17:25:21 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-15 17:25:01 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-15 17:25:01 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-15 17:24:52 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-15 17:24:52 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-15 17:24:46 ET WEB_SERVER /etc/passwd Detected in URI TCP 80
2026-04-15 17:24:46 ET EXPLOIT Apache log4j RCE Attempt (http ldap) (CVE-2021-44228) TCP 80
2026-04-15 17:24:46 ET EXPLOIT Apache log4j RCE Attempt (http ldap) (CVE-2021-44228) TCP 80
2026-04-15 17:24:46 ET EXPLOIT Grafana 8.x Path Traversal (CVE-2021-43798) TCP 80
2026-04-15 17:24:46 SERVER-OTHER Apache Log4j logging remote code execution attempt TCP 80
2026-04-15 17:24:46 SERVER-WEBAPP Facade Ignition remote code execution attempt TCP 80
2026-04-15 17:24:46 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-15 17:24:46 ET EXPLOIT Grafana 8.x Path Traversal (CVE-2021-43798) TCP 80
2026-04-15 17:24:46 ET HUNTING Possible Apache log4j RCE Attempt - Any Protocol TCP (CVE-2021-44228) TCP 80
2026-04-15 17:24:46 SERVER-OTHER Apache Log4j logging remote code execution attempt TCP 80
2026-04-15 17:24:46 ET EXPLOIT Apache log4j RCE Attempt - lower/upper TCP Bypass M2 (CVE-2021-44228) TCP 80
2026-04-15 17:24:46 SERVER-OTHER Apache Log4j logging remote code execution attempt TCP 80
2026-04-15 17:24:46 ET WEB_SERVER /etc/passwd Detected in URI TCP 80
2026-04-15 17:24:46 SERVER-OTHER Apache Log4j logging remote code execution attempt TCP 80
2026-04-15 17:24:46 ET EXPLOIT Apache log4j RCE Attempt (tcp ldap) (CVE-2021-44228) TCP 80
2026-04-15 17:24:46 SERVER-WEBAPP Grafana getPluginAssets path traversal attempt TCP 80
2026-04-15 17:24:46 ET HUNTING Possible Apache log4j RCE Attempt - Any Protocol TCP (CVE-2021-44228) TCP 80
2026-04-15 17:24:46 SERVER-OTHER Apache Log4j logging remote code execution attempt TCP 80
2026-04-15 17:24:46 SERVER-WEBAPP Facade Ignition remote code execution attempt TCP 80
2026-04-15 17:24:46 SERVER-OTHER Apache Log4j logging remote code execution attempt TCP 80
2026-04-15 17:24:46 ET EXPLOIT Apache log4j RCE Attempt - lower/upper TCP Bypass M2 (CVE-2021-44228) TCP 80
2026-04-15 17:24:46 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-15 17:24:46 SERVER-WEBAPP Grafana getPluginAssets path traversal attempt TCP 80
2026-04-15 17:24:46 ET EXPLOIT Apache log4j RCE Attempt (tcp ldap) (CVE-2021-44228) TCP 80
2026-04-15 17:24:45 SERVER-WEBAPP PHPUnit PHP remote code execution attempt TCP 80
2026-04-15 17:24:45 ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M3 TCP 80
2026-04-15 17:24:45 ET EXPLOIT Apache Struts 2 REST Plugin Vulnerability (CVE-2017-9805) TCP 80
2026-04-15 17:24:45 ET WEB_SERVER PHP tags in HTTP POST TCP 80
2026-04-15 17:24:45 ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M3 TCP 80
2026-04-15 17:24:45 ET EXPLOIT Apache Struts 2 REST Plugin Vulnerability (CVE-2017-9805) TCP 80
2026-04-15 17:24:45 ET WEB_SERVER /etc/passwd Detected in URI TCP 80
2026-04-15 17:24:45 ET WEB_SERVER /etc/passwd Detected in URI TCP 80
2026-04-15 17:24:45 ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M2 TCP 80
2026-04-15 17:24:45 ET WEB_SERVER PHP tags in HTTP POST TCP 80
2026-04-15 17:24:45 SERVER-WEBAPP PHPUnit PHP remote code execution attempt TCP 80
2026-04-15 17:24:45 SERVER-APACHE Apache Struts remote code execution attempt TCP 80
2026-04-15 17:24:45 SERVER-APACHE Apache Struts remote code execution attempt TCP 80
2026-04-15 17:24:45 ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M2 TCP 80
2026-04-15 17:24:44 ET WEB_SERVER SQL Injection Select Sleep Time Delay TCP 80
2026-04-15 17:24:44 ET WEB_SERVER SQL Injection Select Sleep Time Delay TCP 80
2026-04-15 17:24:43 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-15 17:24:43 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-11 04:38:33 ET EXPLOIT Apache Struts 2 REST Plugin Vulnerability (CVE-2017-9805) TCP 80
2026-04-11 04:38:33 ET EXPLOIT Likely Struts S2-053-CVE-2017-12611 Exploit Attempt M2 TCP 80
2026-04-11 04:38:33 ET WEB_SERVER Possible SQL Injection (exec) in HTTP URI TCP 80
2026-04-11 04:38:33 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 3 Directory Set Inbound (CVE-2022-22965) TCP 80
2026-04-11 04:38:33 ET EXPLOIT Apache log4j RCE Attempt (tcp ldap) (CVE-2021-44228) TCP 80
2026-04-11 04:38:33 ET EXPLOIT Apache log4j RCE Attempt (http ldap) (CVE-2021-44228) TCP 80
2026-04-11 04:38:33 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 4 Prefix Set Inbound (CVE-2022-22965) TCP 80
2026-04-11 04:38:33 ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M2 TCP 80
2026-04-11 04:38:33 ET WEB_SERVER /etc/passwd Detected in URI TCP 80
2026-04-11 04:38:33 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80
2026-04-11 04:38:33 ET WEB_SPECIFIC_APPS Possible Apache Struts OGNL Expression Injection (CVE-2017-5638) M3 TCP 80
2026-04-11 04:38:33 ET WEB_SERVER SQL Injection Select Sleep Time Delay TCP 80
2026-04-11 04:38:33 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 1 Pattern Set Inbound (CVE-2022-22965) TCP 80
2026-04-11 04:38:33 ET EXPLOIT Possible SpringCore RCE/Spring4Shell Stage 2 Suffix Set Inbound (CVE-2022-22965) TCP 80
2026-04-11 04:38:33 ET EXPLOIT Apache log4j RCE Attempt - lower/upper TCP Bypass M2 (CVE-2021-44228) TCP 80
2026-04-11 04:38:33 ET INFO Spring Boot Actuator Health Check Request TCP 80
2026-04-11 04:38:33 ET WEB_SERVER PHP tags in HTTP POST TCP 80
2026-04-11 04:38:33 ET WEB_SERVER Tilde in URI - potential .php~ source disclosure vulnerability TCP 80
2026-04-11 04:38:33 ET HUNTING .exec in HTTP URI Inbound - Possible Exploit Activity TCP 80
2026-04-11 04:38:33 ET EXPLOIT Grafana 8.x Path Traversal (CVE-2021-43798) TCP 80
2026-04-11 04:38:33 ET WEB_SERVER /etc/passwd Detected in URI TCP 80
2026-04-11 04:38:32 ET EXPLOIT Possible Apache log4j RCE Attempt - 2021/12/12 Obfuscation Observed M2 (tcp) (CVE-2021-44228) TCP 80

 

Back to top