102.220.161.64
blockedRelentlessRegularToolkit
Case file
First seen on 2026-10-01T05:17:34Z, most recently active on 2026-10-04T12:07:43Z.
Recorded 40 attack-shaped requests across 3 separate days.
Its traffic requested a .env file, hoping to find API keys or database credentials; it also probed for an exposed .git directory to download the site's source history and config; it also requested the .git directory itself, hoping it is exposed and browsable.
Seen from 3 of our sensors: edge, nl4-web, s19-web.
Scored into the "Relentless" level, carrying the badges Regular, Toolkit.
Routed via AS197769 (VPS Dedicated LLC), an ASN we classify as hosting.
Blocked on every one of our hosts and at our edge since 2026-10-04T15:29:58Z, through 2027-10-04T15:29:58Z.
Enrichment
| rDNS | none |
|---|---|
| ASN | AS197769 — VPS Dedicated LLC |
| ASN type | hosting |
| Country | Slovenia (SI) |
| Flags | none observed |
Timeline
- 2026-10-0111
- 2026-10-0321
- 2026-10-048
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-04T10:33:52Z | s19-web | haived.com | probed for an exposed .git directory to download the site's source history and config | 301 | 102.220.161.64 - - [04/Oct/2026:10:33:52 +0000] "GET /.git/HEAD HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" rt=0.000 cf=<redacted>-FR… |
| 2026-10-04T10:33:52Z | s19-web | haived.com | requested a .env file, hoping to find API keys or database credentials | 301 | 102.220.161.64 - - [04/Oct/2026:10:33:52 +0000] "GET /.env HTTP/1.1" 301 162 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" rt=0.000 cf=<redacted>-FRA |
| 2026-10-04T12:07:43Z | edge | victorantonov.com | probed for an exposed .git directory to download the site's source history and config | {"ts":"2026-10-04T12:07:43Z","ip":"102.220.161.64","zone":"victorantonov.com","host":"victorantonov.com:443","path":"/.git/HEAD","method":"GET","query":"","ua":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://… | |
| 2026-10-04T12:07:43Z | edge | victorantonov.com | requested a .env file, hoping to find API keys or database credentials | {"ts":"2026-10-04T12:07:43Z","ip":"102.220.161.64","zone":"victorantonov.com","host":"victorantonov.com:443","path":"/.env","method":"GET","query":"","ua":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.i… | |
| 2026-10-04T09:23:35Z | nl4-web | urbanmoto.eu | fuzzed a short, random filename looking for a forgotten script that responds | 403 | [Sun Oct 04 12:23:35.848508 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-04T09:23:35Z | nl4-web | urbanmoto.eu | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Sun Oct 04 12:23:35.848476 2026] [access_compat:error] AH01797: client denied by server configuration: <path> |
| 2026-10-04T09:23:35Z | nl4-web | urbanmoto.eu | probed for an exposed .git directory to download the site's source history and config | 403 | 102.220.161.64 - - [04/Oct/2026:12:23:35 +0300] "GET /.git/HEAD HTTP/1.1" 403 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-04T09:23:35Z | nl4-web | urbanmoto.eu | requested a .env file, hoping to find API keys or database credentials | 404 | 102.220.161.64 - - [04/Oct/2026:12:23:35 +0300] "GET /.env HTTP/1.1" 404 1857 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-03T21:08:28Z | nl4-web | techwriters.eu | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Sun Oct 04 00:08:28.176358 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-03T21:08:28Z | nl4-web | techwriters.eu | probed for an exposed .git directory to download the site's source history and config | 403 | 102.220.161.64 - - [04/Oct/2026:00:08:28 +0300] "GET /.git/HEAD HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-03T21:08:28Z | nl4-web | techwriters.eu | requested a .env file, hoping to find API keys or database credentials | 403 | 102.220.161.64 - - [04/Oct/2026:00:08:28 +0300] "GET /.env HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-03T20:59:15Z | nl4-web | techauthors.eu | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Sat Oct 03 23:59:15.010494 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-03T20:59:15Z | nl4-web | techauthors.eu | probed for an exposed .git directory to download the site's source history and config | 403 | 102.220.161.64 - - [03/Oct/2026:23:59:15 +0300] "GET /.git/HEAD HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-03T20:59:14Z | nl4-web | techauthors.eu | requested a .env file, hoping to find API keys or database credentials | 403 | 102.220.161.64 - - [03/Oct/2026:23:59:14 +0300] "GET /.env HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-03T18:26:02Z | nl4-web | svestnik.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Sat Oct 03 21:26:02.082604 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-03T18:26:02Z | nl4-web | svestnik.com | probed for an exposed .git directory to download the site's source history and config | 403 | 102.220.161.64 - - [03/Oct/2026:21:26:02 +0300] "GET /.git/HEAD HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-03T18:26:01Z | nl4-web | svestnik.com | requested a .env file, hoping to find API keys or database credentials | 403 | 102.220.161.64 - - [03/Oct/2026:21:26:01 +0300] "GET /.env HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-03T15:36:45Z | nl4-web | stefanpetkov.day | matched a catalogue rule | 403 | [Sat Oct 03 18:36:45.696603 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-03T15:36:45Z | nl4-web | stefanpetkov.day | requested a .env file, hoping to find API keys or database credentials | 403 | [Sat Oct 03 18:36:45.638967 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-03T15:36:45Z | nl4-web | stefanpetkov.day | probed for an exposed .git directory to download the site's source history and config | 403 | 102.220.161.64 - - [03/Oct/2026:18:36:45 +0300] "GET /.git/HEAD HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-03T15:36:45Z | nl4-web | stefanpetkov.day | requested a .env file, hoping to find API keys or database credentials | 403 | 102.220.161.64 - - [03/Oct/2026:18:36:45 +0300] "GET /.env HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-03T03:43:14Z | nl4-web | servmoto.com | matched a catalogue rule | 403 | [Sat Oct 03 06:43:14.640290 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-03T03:43:13Z | nl4-web | servmoto.com | requested a .env file, hoping to find API keys or database credentials | 403 | [Sat Oct 03 06:43:13.105241 2026] [access_compat:error] AH01797: client denied by server configuration: <path> |
| 2026-10-03T03:43:14Z | nl4-web | servmoto.com | probed for an exposed .git directory to download the site's source history and config | 403 | 102.220.161.64 - - [03/Oct/2026:06:43:14 +0300] "GET /.git/HEAD HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-03T03:43:13Z | nl4-web | servmoto.com | requested a .env file, hoping to find API keys or database credentials | 403 | 102.220.161.64 - - [03/Oct/2026:06:43:13 +0300] "GET /.env HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-03T02:57:15Z | nl4-web | servbg.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Sat Oct 03 05:57:15.330222 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-03T02:57:15Z | nl4-web | servbg.com | probed for an exposed .git directory to download the site's source history and config | 403 | 102.220.161.64 - - [03/Oct/2026:05:57:15 +0300] "GET /.git/HEAD HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-03T02:57:15Z | nl4-web | servbg.com | requested a .env file, hoping to find API keys or database credentials | 403 | 102.220.161.64 - - [03/Oct/2026:05:57:15 +0300] "GET /.env HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-03T01:01:32Z | nl4-web | schetio.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Sat Oct 03 04:01:32.451585 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-03T01:01:32Z | nl4-web | schetio.com | probed for an exposed .git directory to download the site's source history and config | 403 | 102.220.161.64 - - [03/Oct/2026:04:01:32 +0300] "GET /.git/HEAD HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-03T01:01:32Z | nl4-web | schetio.com | requested a .env file, hoping to find API keys or database credentials | 403 | 102.220.161.64 - - [03/Oct/2026:04:01:32 +0300] "GET /.env HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-01T17:07:54Z | nl4-web | odor-ex.com | matched a catalogue rule | 403 | [Thu Oct 01 20:07:54.409854 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-01T17:07:54Z | nl4-web | odor-ex.com | requested a .env file, hoping to find API keys or database credentials | 403 | [Thu Oct 01 20:07:54.327582 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-01T16:46:04Z | nl4-web | obdebug.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Thu Oct 01 19:46:04.053177 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-01T12:29:19Z | nl4-web | neutralizatori.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Thu Oct 01 15:29:19.046429 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-01T17:07:54Z | nl4-web | odor-ex.com | probed for an exposed .git directory to download the site's source history and config | 403 | 102.220.161.64 - - [01/Oct/2026:20:07:54 +0300] "GET /.git/HEAD HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-01T17:07:54Z | nl4-web | odor-ex.com | requested a .env file, hoping to find API keys or database credentials | 403 | 102.220.161.64 - - [01/Oct/2026:20:07:54 +0300] "GET /.env HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-01T16:46:04Z | nl4-web | obdebug.com | probed for an exposed .git directory to download the site's source history and config | 403 | 102.220.161.64 - - [01/Oct/2026:19:46:04 +0300] "GET /.git/HEAD HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-01T16:46:03Z | nl4-web | obdebug.com | requested a .env file, hoping to find API keys or database credentials | 403 | 102.220.161.64 - - [01/Oct/2026:19:46:03 +0300] "GET /.env HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-01T12:29:19Z | nl4-web | neutralizatori.com | probed for an exposed .git directory to download the site's source history and config | 403 | 102.220.161.64 - - [01/Oct/2026:15:29:19 +0300] "GET /.git/HEAD HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-01T12:29:19Z | nl4-web | neutralizatori.com | requested a .env file, hoping to find API keys or database credentials | 403 | 102.220.161.64 - - [01/Oct/2026:15:29:19 +0300] "GET /.env HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-01T05:17:34Z | nl4-web | motoristi.eu | probed for an exposed .git directory to download the site's source history and config | 403 | 102.220.161.64 - - [01/Oct/2026:08:17:34 +0300] "GET /.git/HEAD HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
| 2026-10-01T05:17:34Z | nl4-web | motoristi.eu | requested a .env file, hoping to find API keys or database credentials | 403 | 102.220.161.64 - - [01/Oct/2026:08:17:34 +0300] "GET /.env HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36" |
Report history
No abuse report sent for this address yet.
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 102.220.161.64 (mailbox goes live with phase 3). See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
