46.151.182.93
Case file
First seen on 2026-09-29T21:49:14Z, most recently active on 2026-10-05T11:50:55Z.
Recorded 12 attack-shaped requests across 3 separate days.
Its traffic requested a .env file, hoping to find API keys or database credentials; it also requested a config.json file, hoping it exposes API keys or internal settings; it also requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated.
Seen on our web sensor.
Scored into the "Brute" level, carrying the badges Regular, Toolkit.
Routed via AS36680 (Netiface LLC), an ASN we classify as residential.
Blocked by the firewalls on our servers since 2026-10-05T12:00:05Z, through 2026-11-04T12:00:05Z.
Enrichment
| rDNS | none |
|---|---|
| ASN | AS36680 — Netiface LLC |
| ASN type | residential |
| Country | The Netherlands (NL) |
| Flags | none observed |
Timeline
- 2026-09-294
- 2026-10-014
- 2026-10-054
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-05T11:50:55Z | web | 4emx.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-10-05T11:50:55Z | web | 4emx.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-10-05T11:50:55Z | web | 4emx.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-10-05T11:50:54Z | web | 4emx.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-10-01T23:53:05Z | web | odor-ex.com | requested a .env file, hoping to find API keys or database credentials | 403 | /odor-ex.com/.env -> 403 |
| 2026-10-01T23:53:05Z | web | odor-ex.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-10-01T23:53:05Z | web | odor-ex.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-10-01T23:53:05Z | web | odor-ex.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-09-29T21:49:14Z | web | bgpoet.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /config.js -> 404 |
| 2026-09-29T21:49:14Z | web | bgpoet.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-09-29T21:49:14Z | web | bgpoet.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-09-29T21:49:14Z | web | bgpoet.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 46.151.182.93. See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
