45.153.34.43

blockedPersistentRegularToolkit

Case file

First seen on 2026-10-02T05:24:50Z, most recently active on 2026-10-06T08:08:23Z.

Recorded 48 attack-shaped requests across 2 separate days.

Its traffic fuzzed a short, random filename looking for a forgotten script that responds; it also requested a .env file, hoping to find API keys or database credentials; it also requested phpinfo.php, which dumps the full PHP configuration and environment if left in place.

Seen on our web sensor.

Scored into the "Persistent" level, carrying the badges Regular, Toolkit.

Routed via AS197170 (TechTies Inc.), an ASN we classify as hosting.

Blocked by the firewalls on our servers since 2026-10-06T08:20:04Z, through 2027-10-06T08:20:04Z.

Enrichment

rDNS	none
ASN	AS197170 — TechTies Inc.
ASN type	hosting
Country	The Netherlands (NL)
Flags	none observed

External references: GreyNoise, Shodan, AbuseIPDB

Timeline

2026-10-0216
2026-10-0632

Evidence (newest first, up to 50)

Time (UTC)	Vantage	Site	Class	Status	Evidence
2026-10-06T08:08:23Z	web	neutralizatori.com	requested a database dump or site archive by its common backup filename	404	`GET /web/dump-6-18-15.sql -> 404`
2026-10-06T08:08:23Z	web	neutralizatori.com	2 × made a request that matched no known pattern	404	`GET /app_dev.php/_profiler/open? -> 404` (2 distinct paths)
2026-10-06T08:08:23Z	web	neutralizatori.com	requested a .env file, hoping to find API keys or database credentials	404	`GET /.env.bak -> 404`
2026-10-06T08:08:23Z	web	neutralizatori.com	requested a .env file, hoping to find API keys or database credentials	403	`GET /.env -> 403`
2026-10-06T08:08:22Z – 2026-10-06T08:08:23Z	web	neutralizatori.com	5 × fuzzed a short, random filename looking for a forgotten script that responds	404	`GET /init.php -> 404` (5 distinct paths)
2026-10-06T08:08:22Z	web	neutralizatori.com	requested an AWS credentials file left in a web-accessible path by mistake	404	`GET /.aws/credentials -> 404`
2026-10-06T08:08:22Z	web	neutralizatori.com	requested phpinfo.php, which dumps the full PHP configuration and environment if left in place	404	`GET /admin/phpinfo.php -> 404`
2026-10-06T08:08:22Z	web	neutralizatori.com	made a request that matched no known pattern	404	`GET /config.phpinfo -> 404`
2026-10-06T08:08:22Z	web	neutralizatori.com	requested a database dump or site archive by its common backup filename	404	`GET /web/dump-6-18-15.sql -> 404`
2026-10-06T08:08:22Z	web	neutralizatori.com	made a request that matched no known pattern	404	`GET /app_dev.php/_profiler/open? -> 404`
2026-10-06T08:08:22Z	web	neutralizatori.com	fuzzed a short, random filename looking for a forgotten script that responds	404	`GET /pi.php -> 404`
2026-10-06T08:08:22Z	web	neutralizatori.com	made a request that matched no known pattern	404	`GET /backup_web_config.txt -> 404`
2026-10-06T08:08:22Z	web	neutralizatori.com	fuzzed a short, random filename looking for a forgotten script that responds	404	`GET /i.php -> 404`
2026-10-06T08:08:22Z	web	neutralizatori.com	requested a .env file, hoping to find API keys or database credentials	404	`GET /.env.bak -> 404`
2026-10-06T08:08:22Z	web	neutralizatori.com	fuzzed a short, random filename looking for a forgotten script that responds	404	`GET /php.php -> 404`
2026-10-06T08:08:22Z	web	neutralizatori.com	requested a .env file, hoping to find API keys or database credentials	403	`GET /.env -> 403`
2026-10-06T08:08:21Z – 2026-10-06T08:08:22Z	web	neutralizatori.com	4 × fuzzed a short, random filename looking for a forgotten script that responds	404	`GET /info.php -> 404` (4 distinct paths)
2026-10-06T08:08:21Z	web	neutralizatori.com	requested phpinfo.php, which dumps the full PHP configuration and environment if left in place	404	`GET /phpinfo.php -> 404`
2026-10-06T08:08:21Z	web	neutralizatori.com	3 × fuzzed a short, random filename looking for a forgotten script that responds	404	`GET /version.php -> 404` (3 distinct paths)
2026-10-06T08:08:21Z	web	neutralizatori.com	requested an AWS credentials file left in a web-accessible path by mistake	404	`GET /.aws/credentials -> 404`
2026-10-06T08:08:21Z	web	neutralizatori.com	requested phpinfo.php, which dumps the full PHP configuration and environment if left in place	404	`GET /admin/phpinfo.php -> 404`
2026-10-06T08:08:21Z	web	neutralizatori.com	made a request that matched no known pattern	404	`GET /config.phpinfo -> 404`
2026-10-06T08:08:20Z – 2026-10-06T08:08:21Z	web	neutralizatori.com	5 × fuzzed a short, random filename looking for a forgotten script that responds	404	`GET /pi.php -> 404` (5 distinct paths)
2026-10-06T08:08:20Z	web	neutralizatori.com	requested phpinfo.php, which dumps the full PHP configuration and environment if left in place	404	`GET /phpinfo.php -> 404`
2026-10-02T05:24:50Z	web	schetio.com	requested a database dump or site archive by its common backup filename	404	`GET /web/dump-6-18-15.sql -> 404`
2026-10-02T05:24:50Z	web	schetio.com	2 × made a request that matched no known pattern	404	`GET /app_dev.php/_profiler/open? -> 404` (2 distinct paths)
2026-10-02T05:24:50Z	web	schetio.com	requested a .env file, hoping to find API keys or database credentials	404	`GET /.env.bak -> 404`
2026-10-02T05:24:50Z	web	schetio.com	requested a .env file, hoping to find API keys or database credentials	403	`GET /.env -> 403`
2026-10-02T05:24:50Z	web	schetio.com	5 × fuzzed a short, random filename looking for a forgotten script that responds	404	`GET /init.php -> 404` (5 distinct paths)
2026-10-02T05:24:50Z	web	schetio.com	requested an AWS credentials file left in a web-accessible path by mistake	404	`GET /.aws/credentials -> 404`
2026-10-02T05:24:50Z	web	schetio.com	requested phpinfo.php, which dumps the full PHP configuration and environment if left in place	404	`GET /admin/phpinfo.php -> 404`

Not currently correlated with any campaign.

Dispute or removal: [email protected] — reference 45.153.34.43. See /threats/about for the method and the 7-day review window.

card.svg (used as this page's og:image)