46.151.182.148
blockedPersistentRegularToolkit
Case file
First seen on 2026-09-29T13:06:38Z, most recently active on 2026-10-05T11:44:22Z.
Recorded 33 attack-shaped requests across 3 separate days.
Its traffic requested a .env file, hoping to find API keys or database credentials; it also requested a config.json file, hoping it exposes API keys or internal settings; it also requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated.
Seen on our edge, web sensors.
Scored into the "Persistent" level, carrying the badges Regular, Toolkit.
Routed via AS36680 (Netiface LLC), an ASN we classify as residential.
Blocked by the firewalls on our servers since 2026-10-04T17:50:03Z, through 2026-11-03T17:50:03Z.
Enrichment
| rDNS | none |
|---|---|
| ASN | AS36680 — Netiface LLC |
| ASN type | residential |
| Country | The Netherlands (NL) |
| Flags | none observed |
Timeline
- 2026-09-296
- 2026-10-0113
- 2026-10-0514
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-05T11:44:22Z | web | 4emx.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-10-05T11:44:22Z | web | 4emx.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-10-05T11:44:22Z | web | 4emx.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-10-05T11:22:10Z | web | 4emx.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-10-05T11:22:10Z | web | 4emx.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /config.js -> 404 |
| 2026-10-05T11:22:10Z | web | 4emx.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-10-05T11:22:10Z | web | 4emx.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-10-05T03:30:55Z | edge | victorantonov.com | was blocked at the edge without matching any specific attack signature | GET /.github/copilot-instructions.md | |
| 2026-10-05T03:30:55Z | edge | victorantonov.com | 2 × requested a .env file, hoping to find API keys or database credentials | GET /.env | |
| 2026-10-05T03:30:55Z | edge | victorantonov.com | was blocked at the edge without matching any specific attack signature | GET /.github/copilot-instructions.md | |
| 2026-10-05T03:30:55Z | web | victorantonov.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /config.js -> 404 |
| 2026-10-05T03:30:55Z | web | victorantonov.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-10-05T03:30:55Z | web | victorantonov.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-10-01T23:52:10Z | web | odor-ex.com | requested a .env file, hoping to find API keys or database credentials | 403 | /odor-ex.com/.env -> 403 |
| 2026-10-01T23:52:10Z | web | odor-ex.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /config.js -> 404 |
| 2026-10-01T23:52:10Z | web | odor-ex.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-10-01T23:52:10Z | web | odor-ex.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-10-01T23:52:10Z | web | odor-ex.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-10-01T15:57:15Z | web | schetio.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-10-01T15:57:15Z | web | schetio.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-10-01T15:57:15Z | web | schetio.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-10-01T15:57:15Z | web | schetio.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /config.js -> 404 |
| 2026-10-01T11:24:58Z | web | servbg.com | requested a config.json file, hoping it exposes API keys or internal settings | 403 | GET /config.json -> 403 |
| 2026-10-01T11:24:58Z | web | servbg.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 403 | GET /api/config -> 403 |
| 2026-10-01T11:24:58Z | web | servbg.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 403 | GET /config.js -> 403 |
| 2026-10-01T11:24:58Z | web | servbg.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-09-29T13:06:49Z | web | obdebug.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-09-29T13:06:49Z | web | obdebug.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-09-29T13:06:49Z | web | obdebug.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-09-29T13:06:38Z | web | obdebug.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-09-29T13:06:38Z | web | obdebug.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-09-29T13:06:38Z | web | obdebug.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 46.151.182.148. See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
