Check an IP Address, Domain Name, Subnet, or ASN

102.66.149.27 was found in our database!

$ whois 102.66.149.27

country·🇿🇦 South Africa

isp·Hero-Telecoms

asn·AS328471

network·Standard

$ sikker risk 102.66.149.27scoring →

confidence

55%Medium

first_seen·Feb 24, 2026

last_seen·26d ago

sessions·1

events·1

$ sikker protocols 102.66.149.27

HTTP

1 / 1

$ sikker summary 102.66.149.27

102.66.149.27 has a threat confidence score of 55%. This IP address from South Africa (AS328471, Hero-Telecoms) has been observed in 1 honeypot sessions targeting HTTP protocols. Detected attack patterns include http dotenv file exposure probe. First observed on February 24, 2026, most recently active February 24, 2026.

$ sikker behaviors 102.66.149.27catalog →

highHttp Dotenv File Exposure Probe1x

Identifies HTTP GET requests targeting the /.env file, indicating attempts to access exposed environment configuration files commonly containing application secrets such as database credentials, API keys, and service tokens.

$ sikker primitives 102.66.149.27

http_method_get2 http_path_dotenv1

$ sikker related 102.66.149.27

🇿🇦·More threats fromSouth Africa→AS·More threats fromHero-Telecoms→HTTP·More threats targetingHTTP→{ }·Browse allAttack Patterns→

Report IP WHOIS Lookup →

IP Address	Confidence	Events
196.216.134.34	27%	95
169.255.77.212	22%	55
102.66.152.207	35%	3
102.66.144.181	25%	10
102.66.145.145	35%	3

IP Address	Confidence	Events
196.251.137.80	46%	81
105.243.66.245	60%	39
102.33.152.138	99%	900
102.68.156.219	30%	2
168.76.20.229	78%	1,226