2602:fa59:10:521::1
In feed-v6.txt Brute Regular Campaign member
In feed-v6.txt indefinitely since UTC; IPv6 is published only, not refused by our own servers. A hosting-network block has no end date; it ends only through the delisting path.
Record
- Score
- 35/100each request counts half as much after 30 days
- Worst level
- Brute
- Attack-shaped requests
- 13all time
- Active days
- 2UTC days
- First seen
- Last seen
- Servers hit
- 2
- Targets
- 13sites
- Times blocked
- 1by the evidence rules
Its traffic probed for an exposed .git directory to download the site's source history and config.
Surfaces: web-app. Attack types: hunting for secrets. Seen by: edge, web.
Activity, last 90 days
Active on 2 of the last 90 UTC days. Current block: , with no end date.
Daily counts
| Day (UTC) | Requests |
|---|---|
| 10 | |
| 3 |
- At least 1 requests a minute at its peak ( UTC; identical requests in the same second are stored once).
- Methods: GET 13.
- The servers we watch answered: 403 12 (totals only, from our web servers).
Evidence
Newest first, the latest 50 stored requests grouped into runs. Times are UTC. The user agent is shown as its family only.
| Time | Site | What happened | Request | User agent | Seen by |
|---|---|---|---|---|---|
| bursukov.com | probed for an exposed .git directory to download the site's source history and config | GET /.git/config | browser claim | web | |
| amosix.eu | probed for an exposed .git directory to download the site's source history and config | GET /.git/config | browser claim | edge | |
| aeroways.eu | probed for an exposed .git directory to download the site's source history and config | GET /.git/config | browser claim | web | |
| – | 2 sites | 2× probed for an exposed .git directory to download the site's source history and config | GET /.git/config | browser claim | web |
| svestnik.com | probed for an exposed .git directory to download the site's source history and config | GET /.git/config | browser claim | web | |
| stefanpetkov.day | probed for an exposed .git directory to download the site's source history and config | GET /.git/config | browser claim | web | |
| – | 2 sites | 2× probed for an exposed .git directory to download the site's source history and config | GET /.git/config | browser claim | web |
| foundyourjob.com | probed for an exposed .git directory to download the site's source history and config | GET /.git/config | browser claim | web | |
| dubstard.com | probed for an exposed .git directory to download the site's source history and config | GET /.git/config | browser claim | web | |
| carrentvarna.com | probed for an exposed .git directory to download the site's source history and config | GET /.git/config | browser claim | web | |
| bgpoet.com | probed for an exposed .git directory to download the site's source history and config | GET /.git/config | browser claim | web | |
Network
- ASN
- AS14956 RouterHosting LLC
- Network type
- hosting
- Reverse DNS
- none
- Country
- United States US
- City
- Ogden (registry location of a hosting network)
- Flags
- none observed
- Abuse contact
- not found
- Checked
Campaign
Sends the same user agent (family: browser claim) and asks for the same paths as 6 other addresses, seen together from to . Paths: /.git/config.
Delisting
This block has no end date. If the range now belongs to someone else, it can leave the list through the free delisting path; every decision is published on the delisting log.