195.178.110.22
In feed.txt Persistent Regular Toolkit
Blocked indefinitely since UTC on our servers, including web requests through Cloudflare, and in feed.txt. A hosting-network block has no end date; it ends only through the delisting path.
Record
- Score
- 46/100each request counts half as much after 30 days
- Worst level
- Persistent
- Attack-shaped requests
- 767all time
- Active days
- 2UTC days
- First seen
- Last seen
- Servers hit
- 1
- Targets
- 2sites
- Times blocked
- 0by the evidence rules
Its traffic requested a database dump or site archive by its common backup filename; it also requested a .env file, hoping to find API keys or database credentials; it also requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated.
Surfaces: web-app. Attack types: hunting for secrets. Seen by: web.
Activity, last 90 days
Active on 2 of the last 90 UTC days. Current block: , with no end date.
Daily counts
| Day (UTC) | Requests |
|---|---|
| 278 | |
| 489 |
- At least 489 requests a minute at its peak ( UTC; identical requests in the same second are stored once).
- Methods: GET 779.
- The servers we watch answered: 403 770, 404 13 (totals only, from our web servers).
Evidence
Newest first, the latest 50 stored requests grouped into runs. Times are UTC. The user agent is shown as its family only.
| Time | Site | What happened | Request | User agent | Seen by |
|---|---|---|---|---|---|
| servbg.com | 50× requested a database dump or site archive by its common backup filename (50 distinct paths) | GET /december-2026.sql | none | web | |
Network
- ASN
- AS48090 Techoff Srv Limited
- Network type
- hosting
- Reverse DNS
- none
- Country
- Bulgaria BG
- Flags
- none observed
- Abuse contact
- found in the registry
- Checked
Delisting
This block has no end date. If the range now belongs to someone else, it can leave the list through the free delisting path; every decision is published on the delisting log.