64.89.161.82
blockedPersistentRegularToolkit
Case file
First seen on 2026-09-29T05:20:25Z, most recently active on 2026-10-04T21:19:06Z.
Recorded 40 attack-shaped requests across 3 separate days.
Its traffic requested a config.json file, hoping it exposes API keys or internal settings; it also requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated; it also requested a .env file, hoping to find API keys or database credentials.
Seen on our web sensor.
Scored into the "Persistent" level, carrying the badges Regular, Toolkit.
Routed via AS36680 (Netiface LLC), an ASN we classify as residential.
Blocked by the firewalls on our servers since 2026-10-04T15:29:58Z, through 2026-11-03T15:29:58Z.
Enrichment
| rDNS | none |
|---|---|
| ASN | AS36680 — Netiface LLC |
| Routing ASN (differs) | AS403005 |
| ASN type | residential |
| Country | United States (US) |
| Flags | none observed |
Timeline
- 2026-09-2916
- 2026-09-3012
- 2026-10-0412
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-04T21:19:06Z | web | bgpoet.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-10-04T21:19:06Z | web | bgpoet.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-10-04T21:19:06Z | web | bgpoet.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-10-04T21:19:05Z | web | bgpoet.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /config.js -> 404 |
| 2026-10-04T21:19:05Z | web | bgpoet.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-10-04T21:19:05Z | web | bgpoet.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-10-04T21:19:05Z | web | bgpoet.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-10-04T15:11:10Z | web | schetio.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-10-04T15:11:09Z | web | schetio.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-10-04T15:11:09Z | web | schetio.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-10-04T15:11:09Z | web | schetio.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-10-04T15:11:09Z | web | schetio.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /config.js -> 404 |
| 2026-09-30T10:33:37Z | web | neutralizatori.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-09-30T10:33:37Z | web | neutralizatori.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-09-30T10:33:37Z | web | neutralizatori.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-09-30T10:33:36Z | web | neutralizatori.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /config.js -> 404 |
| 2026-09-30T10:33:36Z | web | neutralizatori.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-09-30T10:33:36Z | web | neutralizatori.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-09-30T10:33:36Z | web | neutralizatori.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-09-30T08:42:50Z | web | servbg.com | requested a config.json file, hoping it exposes API keys or internal settings | 403 | GET /config.json -> 403 |
| 2026-09-30T08:42:49Z | web | servbg.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 403 | GET /config.js -> 403 |
| 2026-09-30T08:42:49Z | web | servbg.com | requested a config.json file, hoping it exposes API keys or internal settings | 403 | GET /config.json -> 403 |
| 2026-09-30T08:42:49Z | web | servbg.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 403 | GET /api/config -> 403 |
| 2026-09-30T08:42:49Z | web | servbg.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-09-29T11:20:27Z | web | dubstard.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /config.js -> 404 |
| 2026-09-29T11:20:27Z | web | dubstard.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-09-29T11:20:27Z | web | dubstard.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-09-29T11:20:27Z | web | dubstard.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-09-29T11:20:26Z | web | dubstard.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-09-29T05:22:05Z – 2026-09-29T05:22:07Z | web | dubstard.com | 2 × requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-09-29T05:22:05Z | web | dubstard.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-09-29T05:20:26Z – 2026-09-29T05:22:05Z | web | dubstard.com | 2 × requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-09-29T05:20:26Z | web | dubstard.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-09-29T05:20:26Z | web | dubstard.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-09-29T05:20:26Z | web | dubstard.com | requested a common cloud/app secrets or credentials filename (AWS, GCP, Firebase, Kubernetes service-account token, SSH, master key) from a wordlist, hoping one was left in the webroot | 404 | GET /config.js -> 404 |
| 2026-09-29T05:20:25Z | web | dubstard.com | requested a config.json file, hoping it exposes API keys or internal settings | 404 | GET /config.json -> 404 |
| 2026-09-29T05:20:25Z | web | dubstard.com | requested a generic /config or /api/config endpoint, hoping the app exposes its runtime configuration unauthenticated | 404 | GET /api/config -> 404 |
| 2026-09-29T05:20:25Z | web | dubstard.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 64.89.161.82. See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
