46.151.182.7
Case file
First seen on 2026-09-30T10:32:51Z, most recently active on 2026-10-05T07:30:09Z.
Recorded 8 attack-shaped requests across 2 separate days.
Its traffic requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated; it also requested a .env file, hoping to find API keys or database credentials; it also requested a config.json file, hoping it exposes API keys or internal settings.
Seen on our web sensor.
Scored into the "Scanner" level, carrying the badges Regular, Toolkit.
Routed via AS36680 (Netiface LLC), an ASN we classify as residential.
Publicly listed on this board, but not currently blocked on any of our hosts.
Enrichment
| rDNS | none |
|---|---|
| ASN | AS36680 — Netiface LLC |
| ASN type | residential |
| Country | The Netherlands (NL) |
| Flags | none observed |
Timeline
- 2026-09-303
- 2026-10-055
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-05T07:30:09Z | web | foundyourjob.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-10-05T07:30:08Z | web | foundyourjob.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /config.js -> 404 |
| 2026-10-05T07:30:08Z | web | foundyourjob.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-10-05T07:30:08Z | web | foundyourjob.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-10-05T07:30:08Z | web | foundyourjob.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-09-30T10:32:51Z | web | neutralizatori.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-09-30T10:32:51Z | web | neutralizatori.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-09-30T10:32:51Z | web | neutralizatori.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 46.151.182.7. See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
