139.59.158.43
Case file
First seen on 2026-10-01T23:09:12Z, most recently active on 2026-10-04T18:21:34Z.
Recorded 4 attack-shaped requests across 2 separate days.
Its traffic requested the .git directory itself, hoping it is exposed and browsable; it also probed for an exposed .git directory to download the site's source history and config.
Seen from 1 of our sensors: nl4-web.
Scored into the "Scanner" level, carrying the badges Regular, Campaign member.
Routed via AS14061 (DigitalOcean, LLC), an ASN we classify as hosting.
Recorded internally; has not yet crossed the bar for a public listing.
Correlated with other addresses sharing the same signature under campaign "0059e2cea971dfef".
Enrichment
| rDNS | none |
|---|---|
| ASN | AS14061 — DigitalOcean, LLC |
| ASN type | hosting |
| Country | Germany (DE) |
| Flags | none observed |
Timeline
- 2026-10-012
- 2026-10-042
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-04T18:21:34Z | nl4-web | carrentvarna.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Sun Oct 04 21:21:34.764932 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-04T18:21:34Z | nl4-web | carrentvarna.com | probed for an exposed .git directory to download the site's source history and config | 403 | 139.59.158.43 - - [04/Oct/2026:21:21:34 +0300] "GET /.git/config HTTP/1.1" 403 239 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" |
| 2026-10-01T23:09:12Z | nl4-web | dubstard.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Fri Oct 02 02:09:12.699659 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-01T23:09:12Z | nl4-web | dubstard.com | probed for an exposed .git directory to download the site's source history and config | 403 | 139.59.158.43 - - [02/Oct/2026:02:09:12 +0300] "GET /.git/config HTTP/1.1" 403 239 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" |
Report history
No abuse report sent for this address yet.
Campaign membership: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36|/.git/config (8 addresses correlated) — no standalone campaign page yet.
Dispute or removal: [email protected] — reference 139.59.158.43 (mailbox goes live with phase 3). See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
