172.86.81.110
blockedPersistentRegularToolkit
Case file
First seen on 2026-09-28T23:18:27Z, most recently active on 2026-10-03T07:04:32Z.
Recorded 36 attack-shaped requests across 5 separate days.
Its traffic probed for an exposed .git directory to download the site's source history and config; it also requested the .git directory itself, hoping it is exposed and browsable; it also requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot.
Seen from 2 of our sensors: edge, nl4-web.
Scored into the "Persistent" level, carrying the badges Regular, Toolkit.
Routed via AS14956 (RouterHosting LLC), an ASN we classify as hosting.
Blocked on every one of our hosts and at our edge since 2026-10-04T15:29:58Z, through 2027-10-04T15:29:58Z.
Enrichment
| rDNS | none |
|---|---|
| ASN | AS14956 — RouterHosting LLC |
| ASN type | hosting |
| Country | Singapore (SG) |
| Flags | none observed |
Timeline
- 2026-09-284
- 2026-09-297
- 2026-10-012
- 2026-10-0215
- 2026-10-038
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-02T21:05:25Z | nl4-web | bursukov.com | matched a catalogue rule | 403 | [Sat Oct 03 00:05:25.223536 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://bursukov.com/.config/git/config |
| 2026-10-02T21:05:24Z | nl4-web | bursukov.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Sat Oct 03 00:05:24.278730 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://bursukov.com/.git/config |
| 2026-10-02T21:05:25Z | nl4-web | bursukov.com | matched a catalogue rule | 403 | 172.86.81.110 - - [03/Oct/2026:00:05:25 +0300] "GET /.config/git/config HTTP/1.1" 403 239 "http://bursukov.com/.config/git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-02T21:05:24Z | nl4-web | bursukov.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 403 | 172.86.81.110 - - [03/Oct/2026:00:05:24 +0300] "GET /.git-credentials HTTP/1.1" 403 239 "http://bursukov.com/.git-credentials" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-02T21:05:24Z | nl4-web | bursukov.com | probed for an exposed .git directory to download the site's source history and config | 403 | 172.86.81.110 - - [03/Oct/2026:00:05:24 +0300] "GET /.git/config HTTP/1.1" 403 239 "http://bursukov.com/.git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-03T07:04:32Z | nl4-web | servbg.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Sat Oct 03 10:04:32.207827 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://servbg.com/.git/config |
| 2026-10-03T07:04:32Z | nl4-web | servbg.com | probed for an exposed .git directory to download the site's source history and config | 403 | 172.86.81.110 - - [03/Oct/2026:10:04:32 +0300] "GET /.git/config HTTP/1.1" 403 239 "http://servbg.com/.git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-03T06:02:50Z | edge | victorantonov.com | was blocked at the edge without matching any specific attack signature | {"ts":"2026-10-03T06:02:50Z","ip":"172.86.81.110","zone":"victorantonov.com","host":"victorantonov.com","path":"/.git-credentials","method":"GET","query":"","ua":"Mozilla/5.0 (X11; Linux x86_64)","action":"block","source":"firewallCustom","rule_id":"<redacted>","country":"SG","asn_org":"RouterHostin… | |
| 2026-10-03T06:02:50Z | edge | victorantonov.com | probed for an exposed .git directory to download the site's source history and config | {"ts":"2026-10-03T06:02:50Z","ip":"172.86.81.110","zone":"victorantonov.com","host":"victorantonov.com","path":"/.git/config","method":"GET","query":"","ua":"Mozilla/5.0 (X11; Linux x86_64)","action":"block","source":"firewallCustom","rule_id":"<redacted>","country":"SG","asn_org":"RouterHosting LLC… | |
| 2026-10-03T06:02:50Z | nl4-web | victorantonov.com | matched a catalogue rule | 404 | 172.86.81.110 - - [03/Oct/2026:09:02:50 +0300] "GET /.config/git/config HTTP/1.1" 404 236 "http://victorantonov.com/.config/git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-03T02:28:24Z | nl4-web | recmydays.com | fuzzed a short, random filename looking for a forgotten script that responds | 403 | [Sat Oct 03 05:28:24.473103 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://recmydays.com/.git/config |
| 2026-10-03T02:28:24Z | nl4-web | recmydays.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Sat Oct 03 05:28:24.473061 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://recmydays.com/.git/config |
| 2026-10-03T02:28:25Z | nl4-web | recmydays.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 403 | 172.86.81.110 - - [03/Oct/2026:05:28:25 +0300] "GET /.git-credentials HTTP/1.1" 403 1223 "http://recmydays.com/.git-credentials" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-03T02:28:24Z | nl4-web | recmydays.com | probed for an exposed .git directory to download the site's source history and config | 403 | 172.86.81.110 - - [03/Oct/2026:05:28:24 +0300] "GET /.git/config HTTP/1.1" 403 - "http://recmydays.com/.git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-09-28T23:18:29Z | nl4-web | urbanmoto.eu | matched a catalogue rule | 403 | [Tue Sep 29 02:18:29.153459 2026] [access_compat:error] AH01797: client denied by server configuration: <path> referer: http://urbanmoto.eu/.config/git/config |
| 2026-09-28T23:18:27Z | nl4-web | urbanmoto.eu | fuzzed a short, random filename looking for a forgotten script that responds | 403 | [Tue Sep 29 02:18:27.975211 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://urbanmoto.eu/.git/config |
| 2026-09-28T23:18:27Z | nl4-web | urbanmoto.eu | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Tue Sep 29 02:18:27.975167 2026] [access_compat:error] AH01797: client denied by server configuration: <path> referer: http://urbanmoto.eu/.git/config |
| 2026-10-02T10:28:34Z | nl4-web | stefanpetkov.day | matched a catalogue rule | 403 | [Fri Oct 02 13:28:34.006017 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://stefanpetkov.day/.git/config |
| 2026-10-02T04:43:18Z | nl4-web | schetio.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Fri Oct 02 07:43:18.714334 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://schetio.com/.git/config |
| 2026-10-01T17:25:33Z | nl4-web | recmydays.com | matched a catalogue rule | 403 | [Thu Oct 01 20:25:33.016767 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://www.recmydays.com/.config/git/config |
| 2026-09-29T20:54:27Z | nl4-web | homocontinum.org | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Tue Sep 29 23:54:27.903741 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://www.homocontinum.org/.git/config |
| 2026-10-02T18:44:38Z | nl4-web | homocontinum.net | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Fri Oct 02 21:44:38.401805 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://homocontinum.net/.git/config |
| 2026-09-29T01:26:37Z | nl4-web | homocontinum.net | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Tue Sep 29 04:26:37.417807 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://www.homocontinum.net/.git/config |
| 2026-10-02T07:34:02Z | nl4-web | homocontinum.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Fri Oct 02 10:34:02.707270 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://homocontinum.com/.git/config |
| 2026-10-01T12:49:59Z | nl4-web | homocontinum.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Thu Oct 01 15:49:59.485204 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://www.homocontinum.com/.git/config |
| 2026-09-29T15:49:33Z | nl4-web | comops.eu | matched a catalogue rule | 403 | [Tue Sep 29 18:49:33.953076 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://comops.eu/.config/git/config |
| 2026-09-29T15:49:32Z | nl4-web | comops.eu | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Tue Sep 29 18:49:32.017744 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://comops.eu/.git/config |
| 2026-10-02T02:22:06Z | nl4-web | bursukov.com | matched a catalogue rule | 403 | [Fri Oct 02 05:22:06.927377 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://www.bursukov.com/.config/git/config |
| 2026-10-02T02:22:05Z | nl4-web | bursukov.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | [Fri Oct 02 05:22:05.071371 2026] [authz_core:error] AH01630: client denied by server configuration: <path> referer: http://www.bursukov.com/.git/config |
| 2026-09-28T23:18:29Z | nl4-web | urbanmoto.eu | matched a catalogue rule | 404 | 172.86.81.110 - - [29/Sep/2026:02:18:29 +0300] "GET /.config/git/config HTTP/1.1" 404 1527 "http://urbanmoto.eu/.config/git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-09-28T23:18:28Z | nl4-web | urbanmoto.eu | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | 172.86.81.110 - - [29/Sep/2026:02:18:28 +0300] "GET /.git-credentials HTTP/1.1" 404 1527 "http://urbanmoto.eu/.git-credentials" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-09-28T23:18:27Z | nl4-web | urbanmoto.eu | probed for an exposed .git directory to download the site's source history and config | 403 | 172.86.81.110 - - [29/Sep/2026:02:18:27 +0300] "GET /.git/config HTTP/1.1" 403 - "http://urbanmoto.eu/.git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-02T10:28:34Z | nl4-web | stefanpetkov.day | matched a catalogue rule | 404 | 172.86.81.110 - - [02/Oct/2026:13:28:34 +0300] "GET /.config/git/config HTTP/1.1" 404 236 "http://stefanpetkov.day/.config/git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-02T10:28:34Z | nl4-web | stefanpetkov.day | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | 172.86.81.110 - - [02/Oct/2026:13:28:34 +0300] "GET /.git-credentials HTTP/1.1" 404 236 "http://stefanpetkov.day/.git-credentials" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-02T10:28:34Z | nl4-web | stefanpetkov.day | probed for an exposed .git directory to download the site's source history and config | 403 | 172.86.81.110 - - [02/Oct/2026:13:28:34 +0300] "GET /.git/config HTTP/1.1" 403 239 "http://stefanpetkov.day/.git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-02T04:43:20Z | nl4-web | schetio.com | matched a catalogue rule | 404 | 172.86.81.110 - - [02/Oct/2026:07:43:20 +0300] "GET /.config/git/config HTTP/1.1" 404 236 "http://schetio.com/.config/git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-02T04:43:19Z | nl4-web | schetio.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | 172.86.81.110 - - [02/Oct/2026:07:43:19 +0300] "GET /.git-credentials HTTP/1.1" 404 236 "http://schetio.com/.git-credentials" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-02T04:43:18Z | nl4-web | schetio.com | probed for an exposed .git directory to download the site's source history and config | 403 | 172.86.81.110 - - [02/Oct/2026:07:43:18 +0300] "GET /.git/config HTTP/1.1" 403 239 "http://schetio.com/.git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-01T17:25:33Z | nl4-web | recmydays.com | matched a catalogue rule | 403 | 172.86.81.110 - - [01/Oct/2026:20:25:33 +0300] "GET /.config/git/config HTTP/1.1" 403 1223 "http://www.recmydays.com/.config/git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-09-29T20:54:27Z | nl4-web | homocontinum.org | probed for an exposed .git directory to download the site's source history and config | 403 | 172.86.81.110 - - [29/Sep/2026:23:54:27 +0300] "GET /.git/config HTTP/1.1" 403 239 "http://www.homocontinum.org/.git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-02T18:44:38Z | nl4-web | homocontinum.net | probed for an exposed .git directory to download the site's source history and config | 403 | 172.86.81.110 - - [02/Oct/2026:21:44:38 +0300] "GET /.git/config HTTP/1.1" 403 239 "http://homocontinum.net/.git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-09-29T01:26:37Z | nl4-web | homocontinum.net | probed for an exposed .git directory to download the site's source history and config | 403 | 172.86.81.110 - - [29/Sep/2026:04:26:37 +0300] "GET /.git/config HTTP/1.1" 403 239 "http://www.homocontinum.net/.git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-02T07:34:02Z | nl4-web | homocontinum.com | probed for an exposed .git directory to download the site's source history and config | 403 | 172.86.81.110 - - [02/Oct/2026:10:34:02 +0300] "GET /.git/config HTTP/1.1" 403 239 "http://homocontinum.com/.git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-01T12:49:59Z | nl4-web | homocontinum.com | probed for an exposed .git directory to download the site's source history and config | 403 | 172.86.81.110 - - [01/Oct/2026:15:49:59 +0300] "GET /.git/config HTTP/1.1" 403 239 "http://www.homocontinum.com/.git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-09-29T15:49:33Z | nl4-web | comops.eu | matched a catalogue rule | 403 | 172.86.81.110 - - [29/Sep/2026:18:49:33 +0300] "GET /.config/git/config HTTP/1.1" 403 239 "http://comops.eu/.config/git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-09-29T15:49:33Z | nl4-web | comops.eu | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 403 | 172.86.81.110 - - [29/Sep/2026:18:49:33 +0300] "GET /.git-credentials HTTP/1.1" 403 239 "http://comops.eu/.git-credentials" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-09-29T15:49:32Z | nl4-web | comops.eu | probed for an exposed .git directory to download the site's source history and config | 403 | 172.86.81.110 - - [29/Sep/2026:18:49:32 +0300] "GET /.git/config HTTP/1.1" 403 239 "http://comops.eu/.git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-02T02:22:06Z | nl4-web | bursukov.com | matched a catalogue rule | 403 | 172.86.81.110 - - [02/Oct/2026:05:22:06 +0300] "GET /.config/git/config HTTP/1.1" 403 239 "http://www.bursukov.com/.config/git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-02T02:22:05Z | nl4-web | bursukov.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 403 | 172.86.81.110 - - [02/Oct/2026:05:22:05 +0300] "GET /.git-credentials HTTP/1.1" 403 239 "http://www.bursukov.com/.git-credentials" "Mozilla/5.0 (X11; Linux x86_64)" |
| 2026-10-02T02:22:05Z | nl4-web | bursukov.com | probed for an exposed .git directory to download the site's source history and config | 403 | 172.86.81.110 - - [02/Oct/2026:05:22:05 +0300] "GET /.git/config HTTP/1.1" 403 239 "http://www.bursukov.com/.git/config" "Mozilla/5.0 (X11; Linux x86_64)" |
Report history
No abuse report sent for this address yet.
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 172.86.81.110 (mailbox goes live with phase 3). See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
