45.138.12.14
blockedPersistentRegularNight OwlToolkit
Case file
First seen on 2026-09-14T11:44:54Z, most recently active on 2026-10-03T06:01:29Z.
Recorded 101 attack-shaped requests across 2 separate days.
Its traffic requested a .env file, hoping to find API keys or database credentials; it also requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot; it also requested wp-config.php or a backup copy of it, hoping to read the database password in clear text.
Seen from 2 of our sensors: edge, nl4-web.
Scored into the "Persistent" level, carrying the badges Regular, Night Owl, Toolkit.
Routed via AS218785 (Tc Datacenter Limited), an ASN we classify as hosting.
Blocked on every one of our hosts and at our edge since 2026-10-04T15:29:58Z, through 2027-10-04T15:29:58Z.
Enrichment
| rDNS | none |
|---|---|
| ASN | AS218785 — Tc Datacenter Limited |
| ASN type | hosting |
| Country | Lithuania (LT) |
| Flags | none observed |
Timeline
- 2026-09-141
- 2026-10-03100
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-03T05:59:04Z | edge | 4emx.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-10-03T05:59:04Z","ip":"45.138.12.14","zone":"4emx.com","host":"4emx.com","path":"/wp-config.php.save","method":"GET","query":"<truncated>","ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","action":"block","source":"firewallManaged","rule_id":"<redacted… | |
| 2026-10-03T05:59:04Z | edge | 4emx.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-10-03T05:59:04Z","ip":"45.138.12.14","zone":"4emx.com","host":"4emx.com","path":"/wp-config.php.txt","method":"GET","query":"<truncated>","ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","action":"block","source":"firewallManaged","rule_id":"<redacted>… | |
| 2026-10-03T05:59:03Z | edge | 4emx.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-10-03T05:59:03Z","ip":"45.138.12.14","zone":"4emx.com","host":"4emx.com","path":"/wp-config.php.old","method":"GET","query":"<truncated>","ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","action":"block","source":"firewallManaged","rule_id":"<redacted>… | |
| 2026-10-03T05:59:02Z | edge | 4emx.com | requested wp-config.php or a backup copy of it, hoping to read the database password in clear text | {"ts":"2026-10-03T05:59:02Z","ip":"45.138.12.14","zone":"4emx.com","host":"4emx.com","path":"/wp-config.php.bak","method":"GET","query":"<truncated>","ua":"Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0","action":"block","source":"firewallManaged","rule_id":"<redacted>… | |
| 2026-10-03T06:01:29Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:29 +0300] "GET /config/together.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:29Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:29 +0300] "GET /config/stability.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:29Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:29 +0300] "GET /config/runwayml.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:29Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:29 +0300] "GET /config/elevenlabs.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:29Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:29 +0300] "GET /config/cohere.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:28Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:28 +0300] "GET /config/replicate.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:26Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:26 +0300] "GET /config/grok.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:25Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:25 +0300] "GET /config/perplexity.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:24Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:24 +0300] "GET /config/deepseek.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:24Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:24 +0300] "GET /config/huggingface.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:23Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:23 +0300] "GET /config/mistral.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:22Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:22 +0300] "GET /config/groq.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:22Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:22 +0300] "GET /config/minimax.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:21Z | nl4-web | 4emx.com | requested a config/credentials filename naming an AI API provider (Anthropic, OpenAI, OpenRouter), hoping an LLM API key was left in the webroot | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:21 +0300] "GET /config/openrouter.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:20Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:20 +0300] "GET /config/bedrock.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:19Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:19 +0300] "GET /config/vertex.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:18Z | nl4-web | 4emx.com | requested a config/credentials filename naming an AI API provider (Anthropic, OpenAI, OpenRouter), hoping an LLM API key was left in the webroot | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:18 +0300] "GET /config/azure-openai.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:17Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:17 +0300] "GET /config/claude.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:16Z | nl4-web | 4emx.com | requested a config/credentials filename naming an AI API provider (Anthropic, OpenAI, OpenRouter), hoping an LLM API key was left in the webroot | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:16 +0300] "GET /config/openai.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:14Z | nl4-web | 4emx.com | probed a Spring Boot actuator endpoint, which can leak environment variables and internal config if left open | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:14 +0300] "GET /actuator/configprops? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:09Z | nl4-web | 4emx.com | probed a Spring Boot actuator endpoint, which can leak environment variables and internal config if left open | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:09 +0300] "GET /actuator/env? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:01:08Z | nl4-web | 4emx.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | 45.138.12.14 - - [03/Oct/2026:09:01:08 +0300] "GET /apis/config/config.js? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:59Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:59 +0300] "GET /server/config/database.js? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:52Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:52 +0300] "GET /admin/config? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:48Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:48 +0300] "GET /config/constants.js? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:47Z | nl4-web | 4emx.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:47 +0300] "GET /shared/config/config.js? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:42Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:42 +0300] "GET /config/s3_config.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:35Z – 2026-10-03T06:00:41Z ×2 | nl4-web | 4emx.com | 2 × requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:41 +0300] "GET /gatsby-config.js? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" (2 distinct paths) |
| 2026-10-03T06:00:35Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:35 +0300] "GET /api/config/config.yml? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:33Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:33 +0300] "GET /backend/config/settings.yml? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:32Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:32 +0300] "GET /backend/config/development.yml? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:31Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:31 +0300] "GET /backend/config/default.yml? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:30Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:30 +0300] "GET /.circleci/configs/development.yml? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:22Z – 2026-10-03T06:00:23Z ×2 | nl4-web | 4emx.com | 2 × requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:23 +0300] "GET /config/aws.yml? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" (2 distinct paths) |
| 2026-10-03T06:00:21Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:21 +0300] "GET /config/application.yml? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:20Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:20 +0300] "GET /config/settings.prod? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:19Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:19 +0300] "GET /config/settings.local? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:18Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:18 +0300] "GET /config/settings.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:12Z | nl4-web | 4emx.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:12 +0300] "GET /config/config.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T06:00:11Z | nl4-web | 4emx.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | 45.138.12.14 - - [03/Oct/2026:09:00:11 +0300] "GET /config.json? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T05:56:59Z | nl4-web | 4emx.com | requested a .env file, hoping to find API keys or database credentials | 403 | [Sat Oct 03 08:56:59.519420 2026] [authz_core:error] AH01630: client denied by server configuration: <path> |
| 2026-10-03T05:59:19Z | nl4-web | 4emx.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | 45.138.12.14 - - [03/Oct/2026:08:59:19 +0300] "GET /config.js? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T05:59:18Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:08:59:18 +0300] "GET /admin/server_info.php? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
| 2026-10-03T05:59:12Z | nl4-web | 4emx.com | matched a catalogue rule | 404 | 45.138.12.14 - - [03/Oct/2026:08:59:12 +0300] "GET /config.php.old? HTTP/1.1" 404 876 "-" "Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:47.0) Gecko/20100101 Firefox/47.0" |
Report history
No abuse report sent for this address yet.
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 45.138.12.14 (mailbox goes live with phase 3). See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
