195.178.110.159

recordedScanner

Case file

First seen on 2026-10-04T22:20:00Z, most recently active on 2026-10-04T22:52:24Z.

Recorded 4 attack-shaped requests across 1 separate day.

Its traffic probed for an exposed .svn directory to read the site's version-control metadata; it also requested the .git directory itself, hoping it is exposed and browsable; it also probed for an exposed .git directory to download the site's source history and config.

Seen on our web sensor.

Scored into the "Scanner" level.

Routed via AS48090 (Techoff Srv Limited), an ASN we classify as hosting.

Recorded internally; has not yet crossed the bar for a public listing.

Enrichment

rDNS	none
ASN	AS48090 — Techoff Srv Limited
ASN type	hosting
Country	Bulgaria (BG)
Flags	none observed

External references: GreyNoise, Shodan, AbuseIPDB

Timeline

2026-10-044

Evidence (newest first, up to 50)

Time (UTC)	Vantage	Site	Class	Status	Evidence
2026-10-04T22:52:24Z	web	bursukov.com	probed for an exposed .svn directory to read the site's version-control metadata	403	`/.svn -> 403`
2026-10-04T22:52:24Z	web	bursukov.com	probed for an exposed .svn directory to read the site's version-control metadata	403	`GET /.svn/wc.db -> 403`
2026-10-04T22:20:00Z	web	bursukov.com	requested the .git directory itself, hoping it is exposed and browsable	403	`/.git -> 403`
2026-10-04T22:20:00Z	web	bursukov.com	2 × made a request that matched no known pattern	403	`GET /frontend/.git/config -> 403` (2 distinct paths)
2026-10-04T22:20:00Z	web	bursukov.com	probed for an exposed .git directory to download the site's source history and config	403	`GET /.git/config -> 403`
2026-10-04T22:20:00Z	web	bursukov.com	10 × made a request that matched no known pattern	403	`GET /web/.git/config -> 403` (10 distinct paths)

Not currently correlated with any campaign.

Dispute or removal: [email protected] — reference 195.178.110.159. See /threats/about for the method and the 7-day review window.

card.svg (used as this page's og:image)