213.209.159.223
blockedRelentlessRegularNight OwlToolkit
Case file
First seen on 2026-09-10T18:04:54Z, most recently active on 2026-09-30T22:41:31Z.
Recorded 265 attack-shaped requests across 11 separate days.
Its traffic requested a .env file, hoping to find API keys or database credentials; it also requested wp-config.php or a backup copy of it, hoping to read the database password in clear text; it also requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot.
Seen from 2 of our sensors: edge, nl4-web.
Scored into the "Relentless" level, carrying the badges Regular, Night Owl, Toolkit.
Routed via AS208137 (Feo Prest SRL), an ASN we classify as hosting.
Blocked on every one of our hosts and at our edge since 2026-10-04T15:29:58Z, through 2027-10-04T15:29:58Z.
Enrichment
| rDNS | none |
|---|---|
| ASN | AS208137 — Feo Prest SRL |
| ASN type | hosting |
| Country | Germany (DE) |
| Flags | none observed |
Timeline
- 2026-09-104
- 2026-09-1122
- 2026-09-124
- 2026-09-226
- 2026-09-244
- 2026-09-252
- 2026-09-2616
- 2026-09-2710
- 2026-09-282
- 2026-09-29194
- 2026-09-301
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-09-11T21:49:28Z | edge | zmey.eu | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-11T21:49:28Z","ip":"213.209.159.223","zone":"zmey.eu","host":"zmey.eu","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; .NET4.0E; MS-RTC LM 8)"… | |
| 2026-09-11T21:49:28Z | edge | zmey.eu | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-11T21:49:28Z","ip":"213.209.159.223","zone":"zmey.eu","host":"zmey.eu","path":"//wp-config.php","method":"GET","query":"","ua":"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0; SLCC1; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30618; .NET4.0C; .NET4.0E; MS-RTC LM 8)","acti… | |
| 2026-09-11T21:48:53Z | edge | zmey.eu | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-11T21:48:53Z","ip":"213.209.159.223","zone":"zmey.eu","host":"zmey.eu","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11","action":"block","source":"firewallManaged","rul… | |
| 2026-09-11T21:48:53Z | edge | zmey.eu | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-11T21:48:53Z","ip":"213.209.159.223","zone":"zmey.eu","host":"zmey.eu","path":"//wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.11 (KHTML, like Gecko) Chrome/23.0.1271.64 Safari/537.11","action":"block","source":"firewallManaged","rule_id":… | |
| 2026-09-26T16:16:33Z | edge | victorantonov.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-26T16:16:33Z","ip":"213.209.159.223","zone":"victorantonov.com","host":"victorantonov.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (iPad; CPU OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B101 Safari/604.1","act… | |
| 2026-09-26T16:16:28Z | edge | victorantonov.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-26T16:16:28Z","ip":"213.209.159.223","zone":"victorantonov.com","host":"victorantonov.com","path":"/wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (iPad; CPU OS 11_1 like Mac OS X) AppleWebKit/604.3.5 (KHTML, like Gecko) Version/11.0 Mobile/15B101 Safari/604.1","action":"b… | |
| 2026-09-26T20:27:15Z | edge | vaibed.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-26T20:27:15Z","ip":"213.209.159.223","zone":"vaibed.com","host":"vaibed.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; LG-C800 Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1 MMS/LG-A… | |
| 2026-09-26T20:27:11Z | edge | vaibed.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-26T20:27:11Z","ip":"213.209.159.223","zone":"vaibed.com","host":"vaibed.com","path":"/wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; LG-C800 Build/GRK39F) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1 MMS/LG-Android-… | |
| 2026-09-26T20:26:08Z | edge | vaibed.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-26T20:26:08Z","ip":"213.209.159.223","zone":"vaibed.com","host":"vaibed.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Opera/9.80 (X11; Linux i686; U; en-GB) Presto/2.5.24 Version/10.53","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":… | |
| 2026-09-26T20:26:04Z | edge | vaibed.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-26T20:26:04Z","ip":"213.209.159.223","zone":"vaibed.com","host":"vaibed.com","path":"/wp-config.php","method":"GET","query":"","ua":"Opera/9.80 (X11; Linux i686; U; en-GB) Presto/2.5.24 Version/10.53","action":"block","source":"firewallManaged","rule_id":"<redacted>","country":"DE","a… | |
| 2026-09-26T05:52:45Z | edge | vaibed.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-26T05:52:45Z","ip":"213.209.159.223","zone":"vaibed.com","host":"vaibed.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:42.0) Gecko/20100101 Firefox/42.0","action":"block","source":"firewallManaged","rule_id":"<redacted>"… | |
| 2026-09-26T05:52:45Z | edge | vaibed.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-26T05:52:45Z","ip":"213.209.159.223","zone":"vaibed.com","host":"vaibed.com","path":"/wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (Windows NT 6.3; Win64; x64; rv:42.0) Gecko/20100101 Firefox/42.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","count… | |
| 2026-09-11T12:41:12Z | edge | vaibed.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-11T12:41:12Z","ip":"213.209.159.223","zone":"vaibed.com","host":"vaibed.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Linux; Android 4.4.2; en-us; SAMSUNG SGH-M919 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/1.5 Chrome/28.0.1500.94 M… | |
| 2026-09-11T12:40:56Z – 2026-09-11T12:41:12Z ×2 | edge | vaibed.com | 2 × requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-11T12:41:12Z","ip":"213.209.159.223","zone":"vaibed.com","host":"vaibed.com","path":"//wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (Linux; Android 4.4.2; en-us; SAMSUNG SGH-M919 Build/KOT49H) AppleWebKit/537.36 (KHTML, like Gecko) Version/1.5 Chrome/28.0.1500.94 Mobile … | |
| 2026-09-11T12:40:56Z | edge | vaibed.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-11T12:40:56Z","ip":"213.209.159.223","zone":"vaibed.com","host":"vaibed.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Windows; U; Windows NT 6.1; es-ES; rv:1.9.2.15) Gecko/20110303 Firefox/3.6.15","action":"block","source":"firewallManaged","rule_id"… | |
| 2026-09-11T08:00:54Z | edge | vaibed.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-11T08:00:54Z","ip":"213.209.159.223","zone":"vaibed.com","host":"vaibed.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (X11; U; Linux i686; sv-SE; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3","action":"block","source":"firewallManage… | |
| 2026-09-11T08:00:38Z – 2026-09-11T08:00:54Z ×2 | edge | vaibed.com | 2 × requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-11T08:00:54Z","ip":"213.209.159.223","zone":"vaibed.com","host":"vaibed.com","path":"//wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (X11; U; Linux i686; sv-SE; rv:1.9.0.3) Gecko/2008092510 Ubuntu/8.04 (hardy) Firefox/3.0.3","action":"block","source":"firewallManaged","ru… | |
| 2026-09-11T08:00:38Z | edge | vaibed.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-11T08:00:38Z","ip":"213.209.159.223","zone":"vaibed.com","host":"vaibed.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Safari/602.1.50","action":"block","source":"f… | |
| 2026-09-24T09:03:29Z | edge | techwriters.eu | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-24T09:03:29Z","ip":"213.209.159.223","zone":"techwriters.eu","host":"techwriters.eu","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.6 Safari/532.0","action":"block","so… | |
| 2026-09-24T09:03:25Z | edge | techwriters.eu | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-24T09:03:25Z","ip":"213.209.159.223","zone":"techwriters.eu","host":"techwriters.eu","path":"/wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (Windows; U; Windows NT 6.0; en-US) AppleWebKit/532.0 (KHTML, like Gecko) Chrome/3.0.195.6 Safari/532.0","action":"block","source":"… | |
| 2026-09-24T09:02:24Z | edge | techwriters.eu | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-24T09:02:24Z","ip":"213.209.159.223","zone":"techwriters.eu","host":"techwriters.eu","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Windows NT 5.1; U; en; rv:1.8.0) Gecko/20060728 Firefox/1.5.0","action":"block","source":"firewallManaged","rule_id":"<redac… | |
| 2026-09-24T09:02:23Z | edge | techwriters.eu | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-24T09:02:23Z","ip":"213.209.159.223","zone":"techwriters.eu","host":"techwriters.eu","path":"/wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (Windows NT 5.1; U; en; rv:1.8.0) Gecko/20060728 Firefox/1.5.0","action":"block","source":"firewallManaged","rule_id":"<redacted>","… | |
| 2026-09-10T18:05:10Z | edge | techwriters.eu | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-10T18:05:10Z","ip":"213.209.159.223","zone":"techwriters.eu","host":"techwriters.eu","path":"//wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (iPhone; CPU iPhone OS 10_9_5 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A365 Safari/600.1.4","act… | |
| 2026-09-10T18:05:10Z | edge | techwriters.eu | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-10T18:05:10Z","ip":"213.209.159.223","zone":"techwriters.eu","host":"techwriters.eu","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (iPhone; CPU iPhone OS 10_9_5 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A365 Safari/600.1.4… | |
| 2026-09-10T18:04:54Z | edge | techwriters.eu | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-10T18:04:54Z","ip":"213.209.159.223","zone":"techwriters.eu","host":"techwriters.eu","path":"//wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; SCH-S720C Build/GINGERBREAD) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1… | |
| 2026-09-10T18:04:54Z | edge | techwriters.eu | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-10T18:04:54Z","ip":"213.209.159.223","zone":"techwriters.eu","host":"techwriters.eu","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Linux; U; Android 2.3.6; en-us; SCH-S720C Build/GINGERBREAD) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari… | |
| 2026-09-26T18:22:19Z | edge | servmoto.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-26T18:22:19Z","ip":"213.209.159.223","zone":"servmoto.com","host":"servmoto.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.75 Safari/537.36 OPR/36.0.2130.32","action":"bloc… | |
| 2026-09-26T18:22:14Z | edge | servmoto.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-26T18:22:14Z","ip":"213.209.159.223","zone":"servmoto.com","host":"servmoto.com","path":"/wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.75 Safari/537.36 OPR/36.0.2130.32","action":"block","sou… | |
| 2026-09-26T18:21:25Z | edge | servmoto.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-26T18:21:25Z","ip":"213.209.159.223","zone":"servmoto.com","host":"servmoto.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.110 Safari/537.36 OPR/36.2.2126.102826","action":"blo… | |
| 2026-09-26T18:21:24Z | edge | servmoto.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-26T18:21:24Z","ip":"213.209.159.223","zone":"servmoto.com","host":"servmoto.com","path":"/wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623.110 Safari/537.36 OPR/36.2.2126.102826","action":"block","so… | |
| 2026-09-22T05:10:13Z | edge | servbg.dev | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-22T05:10:13Z","ip":"213.209.159.223","zone":"servbg.dev","host":"servbg.dev","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; MASEJS; rv:11.0) like Gecko","action":"block","source":"firewallManaged","rule_id":"<red… | |
| 2026-09-22T05:10:09Z | edge | servbg.dev | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-22T05:10:09Z","ip":"213.209.159.223","zone":"servbg.dev","host":"servbg.dev","path":"/wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; MASEJS; rv:11.0) like Gecko","action":"block","source":"firewallManaged","rule_id":"<redacted>"… | |
| 2026-09-22T05:09:14Z | edge | servbg.dev | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-22T05:09:14Z","ip":"213.209.159.223","zone":"servbg.dev","host":"servbg.dev","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR) AppleWebKit/525.28 (KHTML, like Gecko) Version/3.2.2 Safari/525.28.1","action":"block","source":"… | |
| 2026-09-22T05:09:10Z | edge | servbg.dev | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-22T05:09:10Z","ip":"213.209.159.223","zone":"servbg.dev","host":"servbg.dev","path":"/wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (Windows; U; Windows NT 5.1; fr-FR) AppleWebKit/525.28 (KHTML, like Gecko) Version/3.2.2 Safari/525.28.1","action":"block","source":"firewal… | |
| 2026-09-28T06:50:15Z | edge | servbg.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-28T06:50:15Z","ip":"213.209.159.223","zone":"servbg.com","host":"servbg.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media C… | |
| 2026-09-28T06:50:14Z | edge | servbg.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-28T06:50:14Z","ip":"213.209.159.223","zone":"servbg.com","host":"servbg.com","path":"/wp-config.php","method":"GET","query":"","ua":"Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center P… | |
| 2026-09-11T16:02:29Z | edge | servbg.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-11T16:02:29Z","ip":"213.209.159.223","zone":"servbg.com","host":"servbg.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Linux; U; Android 2.3.7; en-us; imx53_smd Build/R10.3.3-r1) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1","… | |
| 2026-09-11T16:02:29Z | edge | servbg.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-11T16:02:29Z","ip":"213.209.159.223","zone":"servbg.com","host":"servbg.com","path":"//wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (Linux; U; Android 2.3.7; en-us; imx53_smd Build/R10.3.3-r1) AppleWebKit/533.1 (KHTML, like Gecko) Version/4.0 Mobile Safari/533.1","action… | |
| 2026-09-27T12:25:03Z | edge | recmydays.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-27T12:25:03Z","ip":"213.209.159.223","zone":"recmydays.com","host":"recmydays.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.0.5) Gecko/20060731 Ubuntu/dapper-security Firefox/1.5.0.5","action":"block","source":"fir… | |
| 2026-09-27T12:24:59Z | edge | recmydays.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-27T12:24:59Z","ip":"213.209.159.223","zone":"recmydays.com","host":"recmydays.com","path":"/wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (X11; U; Linux x86_64; en-US; rv:1.8.0.5) Gecko/20060731 Ubuntu/dapper-security Firefox/1.5.0.5","action":"block","source":"firewallMa… | |
| 2026-09-29T05:27:07Z | edge | odor-ex.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-29T05:27:07Z","ip":"213.209.159.223","zone":"odor-ex.com","host":"odor-ex.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; yie11; rv:11.0) like Gecko","action":"block","source":"firewallManaged","rule_id":"<redac… | |
| 2026-09-29T05:27:01Z | edge | odor-ex.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-29T05:27:01Z","ip":"213.209.159.223","zone":"odor-ex.com","host":"odor-ex.com","path":"/wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; Trident/7.0; yie11; rv:11.0) like Gecko","action":"block","source":"firewallManaged","rule_id":"<redacted>","… | |
| 2026-09-25T14:05:58Z | edge | odor-ex.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-25T14:05:58Z","ip":"213.209.159.223","zone":"odor-ex.com","host":"odor-ex.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-us; Silk/1.0.13.81_10003810) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533… | |
| 2026-09-25T14:05:52Z | edge | odor-ex.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-25T14:05:52Z","ip":"213.209.159.223","zone":"odor-ex.com","host":"odor-ex.com","path":"/wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (Macintosh; U; Intel Mac OS X 10_6_3; en-us; Silk/1.0.13.81_10003810) AppleWebKit/533.16 (KHTML, like Gecko) Version/5.0 Safari/533.16 Sil… | |
| 2026-09-12T03:38:01Z | edge | odor-ex.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-12T03:38:01Z","ip":"213.209.159.223","zone":"odor-ex.com","host":"odor-ex.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (iPhone; CPU iPhone OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Mobile/15E148 Safari/604.1","a… | |
| 2026-09-12T03:37:07Z – 2026-09-12T03:38:00Z ×2 | edge | odor-ex.com | 2 × requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-12T03:38:00Z","ip":"213.209.159.223","zone":"odor-ex.com","host":"odor-ex.com","path":"//wp-config.php","method":"GET","query":"","ua":"Mozilla/5.0 (iPhone; CPU iPhone OS 13_3_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/13.0.5 Mobile/15E148 Safari/604.1","action"… | |
| 2026-09-12T03:37:07Z | edge | odor-ex.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-09-12T03:37:07Z","ip":"213.209.159.223","zone":"odor-ex.com","host":"odor-ex.com","path":"/wp-config.php.backup","method":"GET","query":"","ua":"Mozilla/5.0 (X11; U; Linux i686 (x86_64); de; rv:1.9.1) Gecko/20090624 Firefox/3.5","action":"block","source":"firewallManaged","rule_id":"<red… |
Report history
No abuse report sent for this address yet.
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 213.209.159.223 (mailbox goes live with phase 3). See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
