159.89.98.12
Case file
First seen on 2026-10-01T06:41:14Z, most recently active on 2026-10-04T06:48:38Z.
Recorded 8 attack-shaped requests across 3 separate days.
Its traffic requested the .git directory itself, hoping it is exposed and browsable; it also probed for an exposed .git directory to download the site's source history and config.
Seen from 1 of our sensors: nl4-web.
Scored into the "Brute" level, carrying the badges Regular, Campaign member.
Routed via AS14061 (DigitalOcean, LLC), an ASN we classify as hosting.
Publicly listed on this board, but not currently blocked on any of our hosts.
Correlated with other addresses sharing the same signature under campaign "0059e2cea971dfef".
Enrichment
| rDNS | none |
|---|---|
| ASN | AS14061 — DigitalOcean, LLC |
| ASN type | hosting |
| Country | Germany (DE) |
| Flags | none observed |
Timeline
- 2026-10-012
- 2026-10-034
- 2026-10-042
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-04T06:48:38Z | nl4-web | pribabadanche.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Sun Oct 04 09:48:38.291327 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-04T06:48:38Z | nl4-web | pribabadanche.com | probed for an exposed .git directory to download the site's source history and config | 403 | 159.89.98.12 - - [04/Oct/2026:09:48:38 +0300] "GET /.git/config HTTP/1.1" 403 239 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" |
| 2026-10-03T21:07:27Z | nl4-web | pribabadanche.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Sun Oct 04 00:07:27.112169 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-03T21:07:27Z | nl4-web | pribabadanche.com | probed for an exposed .git directory to download the site's source history and config | 403 | 159.89.98.12 - - [04/Oct/2026:00:07:27 +0300] "GET /.git/config HTTP/1.1" 403 239 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" |
| 2026-10-03T15:51:32Z | nl4-web | pribabadanche.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Sat Oct 03 18:51:32.771273 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-03T15:51:32Z | nl4-web | pribabadanche.com | probed for an exposed .git directory to download the site's source history and config | 403 | 159.89.98.12 - - [03/Oct/2026:18:51:32 +0300] "GET /.git/config HTTP/1.1" 403 239 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" |
| 2026-10-01T06:41:14Z | nl4-web | pribabadanche.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Thu Oct 01 09:41:14.314445 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-01T06:41:14Z | nl4-web | pribabadanche.com | probed for an exposed .git directory to download the site's source history and config | 403 | 159.89.98.12 - - [01/Oct/2026:09:41:14 +0300] "GET /.git/config HTTP/1.1" 403 239 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36" |
Report history
No abuse report sent for this address yet.
Campaign membership: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/81.0.4044.129 Safari/537.36|/.git/config (8 addresses correlated) — no standalone campaign page yet.
Dispute or removal: [email protected] — reference 159.89.98.12 (mailbox goes live with phase 3). See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
