130.12.180.117

blockedPersistentRegularToolkit

Case file

First seen on 2026-09-29T01:05:06Z, most recently active on 2026-10-04T09:12:34Z.

Recorded 1403 attack-shaped requests across 5 separate days.

Its traffic requested a .env file, hoping to find API keys or database credentials; it also probed for an exposed .git directory to download the site's source history and config; it also requested the .git directory itself, hoping it is exposed and browsable.

Seen from 1 of our sensors: nl4-web.

Scored into the "Persistent" level, carrying the badges Regular, Toolkit.

Routed via AS202412 (Omegatech LTD), an ASN we classify as hosting.

Blocked on every one of our hosts and at our edge since 2026-10-04T15:29:58Z, through 2027-10-04T15:29:58Z.

Enrichment

rDNSnone
ASNAS202412 — Omegatech LTD
ASN typehosting
CountryThe Netherlands (NL)
Flagsnone observed

External references: GreyNoise, Shodan, AbuseIPDB

Timeline

Evidence (newest first, up to 50)

Time (UTC)VantageSiteClassStatusEvidence
2026-09-30T05:25:59Znl4-webservbg.comrequested a .env file, hoping to find API keys or database credentials403130.12.180.117 - - [30/Sep/2026:08:25:59 +0300] "GET //.docker/.env.dev HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:11:55Z – 2026-10-04T09:11:56Z ×2nl4-webtechauthors.eu2 × requested the .git directory itself, hoping it is exposed and browsable403[Sun Oct 04 12:11:56.677526 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://techauthors.eu:80/.git/HEAD
2026-10-04T09:12:34Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:34 +0300] "GET /functions/.env HTTP/1.1" 404 236 "http://techauthors.eu:80/functions/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0…
2026-10-04T09:12:32Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:32 +0300] "GET /application/.env HTTP/1.1" 404 236 "http://techauthors.eu:80/application/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124…
2026-10-04T09:12:27Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:27 +0300] "GET /app/.env HTTP/1.1" 404 236 "http://techauthors.eu:80/app/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/53…
2026-10-04T09:12:22Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:22 +0300] "GET /.env.stage HTTP/1.1" 404 236 "http://techauthors.eu:80/.env.stage" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safar…
2026-10-04T09:12:20Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:20 +0300] "GET /.env.dev HTTP/1.1" 404 236 "http://techauthors.eu:80/.env.dev" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/53…
2026-10-04T09:12:18Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:18 +0300] "GET /.env.live HTTP/1.1" 404 236 "http://techauthors.eu:80/.env.live" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/…
2026-10-04T09:12:15Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:15 +0300] "GET /.env.local HTTP/1.1" 404 236 "http://techauthors.eu:80/.env.local" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safar…
2026-10-04T09:12:14Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:14 +0300] "GET /.env.staging HTTP/1.1" 404 236 "http://techauthors.eu:80/.env.staging" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 S…
2026-10-04T09:12:11Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:11 +0300] "GET /.env.production HTTP/1.1" 404 236 "http://techauthors.eu:80/.env.production" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0…
2026-10-04T09:12:09Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:09 +0300] "GET /.env.prod HTTP/1.1" 404 236 "http://techauthors.eu:80/.env.prod" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/…
2026-10-04T09:12:05Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:05 +0300] "GET /.env.bak HTTP/1.1" 404 236 "http://techauthors.eu:80/.env.bak" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/53…
2026-10-04T09:12:05Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:05 +0300] "GET /functions/.env HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:12:05Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:05 +0300] "GET /application/.env HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:12:05Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:05 +0300] "GET /api/.env HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:12:03Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:03 +0300] "GET /.env.save HTTP/1.1" 404 236 "http://techauthors.eu:80/.env.save" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/…
2026-10-04T09:12:03Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:03 +0300] "GET /backend/.env HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:12:01Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:01 +0300] "GET /app/.env HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:12:01Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:01 +0300] "GET /config/.env HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:12:01Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:12:01 +0300] "GET /.env.old HTTP/1.1" 404 236 "http://techauthors.eu:80/.env.old" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/53…
2026-10-04T09:11:59Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:11:59 +0300] "GET /.env.stage HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:11:59Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:11:59 +0300] "GET /.env.dev HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:11:59Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:11:59 +0300] "GET /.env.live HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:11:59Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:11:59 +0300] "GET /.env.backup HTTP/1.1" 404 236 "http://techauthors.eu:80/.env.backup" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Saf…
2026-10-04T09:11:58Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:11:58 +0300] "GET /.env.local HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:11:58Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:11:58 +0300] "GET /.env.staging HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:11:57Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:11:57 +0300] "GET /.env.production HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:11:57Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:11:57 +0300] "GET /.env.prod HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:11:56Znl4-webtechauthors.euprobed for an exposed .git directory to download the site's source history and config403130.12.180.117 - - [04/Oct/2026:12:11:56 +0300] "GET /.git/HEAD HTTP/1.1" 403 239 "http://techauthors.eu:80/.git/HEAD" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/…
2026-10-04T09:11:56Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:11:56 +0300] "GET /.env.bak HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:11:56Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:11:56 +0300] "GET /.env.save HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:11:55Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:11:55 +0300] "GET /.env.old HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:11:55Znl4-webtechauthors.eurequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:12:11:55 +0300] "GET /.env.backup HTTP/1.1" 404 236 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:11:55Znl4-webtechauthors.euprobed for an exposed .git directory to download the site's source history and config403130.12.180.117 - - [04/Oct/2026:12:11:55 +0300] "GET /.git/HEAD HTTP/1.1" 403 239 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T09:11:53Z – 2026-10-04T09:11:55Z ×2nl4-webtechauthors.eu2 × requested a .env file, hoping to find API keys or database credentials403130.12.180.117 - - [04/Oct/2026:12:11:55 +0300] "GET /.env HTTP/1.1" 403 239 "http://techauthors.eu:80/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.36"
2026-10-04T06:02:58Z – 2026-10-04T06:02:58Z ×3nl4-webschetio.com3 × requested the .git directory itself, hoping it is exposed and browsable403[Sun Oct 04 09:02:58.586259 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://schetio.com:8080/.git/HEAD
2026-10-04T06:03:35Znl4-webschetio.comrequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:09:03:35 +0300] "GET /functions/.env HTTP/1.1" 404 236 "http://schetio.com:8880/functions/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.…
2026-10-04T06:03:33Znl4-webschetio.comrequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:09:03:33 +0300] "GET /application/.env HTTP/1.1" 404 236 "http://schetio.com:8880/application/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.…
2026-10-04T06:03:31Z – 2026-10-04T06:03:32Z ×2nl4-webschetio.com2 × requested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:09:03:32 +0300] "GET /functions/.env HTTP/1.1" 404 236 "http://schetio.com:80/functions/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 …
2026-10-04T06:03:31Znl4-webschetio.comrequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:09:03:31 +0300] "GET /api/.env HTTP/1.1" 404 236 "http://schetio.com:8880/api/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537…
2026-10-04T06:03:28Znl4-webschetio.comrequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:09:03:28 +0300] "GET /app/.env HTTP/1.1" 404 236 "http://schetio.com:8880/app/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537…
2026-10-04T06:03:27Z – 2026-10-04T06:03:28Z ×2nl4-webschetio.com2 × requested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:09:03:28 +0300] "GET /api/.env HTTP/1.1" 404 236 "http://schetio.com:80/api/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safari/537.3…
2026-10-04T06:03:26Znl4-webschetio.comrequested a .env file, hoping to find API keys or database credentials404130.12.180.117 - - [04/Oct/2026:09:03:26 +0300] "GET /config/.env HTTP/1.1" 404 236 "http://schetio.com:8880/config/.env" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko, Yokohama Institute of Information Security https://www.iisec.ac.jp) Chrome/124.0.0.0 Safa…

Report history

No abuse report sent for this address yet.

Not currently correlated with any campaign.

Dispute or removal: [email protected] — reference 130.12.180.117 (mailbox goes live with phase 3). See /threats/about for the method and the 7-day review window.

card.svg (used as this page's og:image)