// actor profile

104.28.204.176

geo United States · New York[US]asn AS13335 Cloudflare, Inc.isp Cloudflare, Inc.

// observed 0h · refreshed 2026-08-25 16:03:37 UTC

Behavior

asn.coordinated

Stats

Total events

148

SSH events

0 failures

Distinct users tried

Distinct paths tried

147

1 HTTP 4xx

Observed tactics

probe.admin probe.backup probe.config probe.dotenv probe.dotgit probe.dotssh protocol.no-language

Recent activity

// last 25 events · successful exploits filtered

When	Source	Category	Detail	Status	Tags
2026-08-01 17:29:52	http	request	GET /.ssh/authorized_keys	307	probe.configprotocol.no-languageprobe.dotssh
2026-08-01 17:29:52	http	request	GET /.ssh/config	307	probe.configprotocol.no-languageprobe.dotssh
2026-08-01 17:29:52	http	request	GET /login?next=%2F.ssh%2Fid_rsa	200
2026-08-01 17:29:52	http	request	GET /login?next=%2F.ssh%2Fid_ed25519	200
2026-08-01 17:29:52	http	request	GET /login?next=%2F.ssh%2Fid_dsa	200
2026-08-01 17:29:52	http	request	GET /login?next=%2F.ssh%2Fid_ecdsa	200
2026-08-01 17:29:52	http	request	GET /login?next=%2F.boto	200
2026-08-01 17:29:52	http	request	GET /.ssh/id_rsa	307	probe.configprotocol.no-languageprobe.dotssh
2026-08-01 17:29:52	http	request	GET /.ssh/id_dsa	307	probe.configprotocol.no-languageprobe.dotssh
2026-08-01 17:29:52	http	request	GET /.ssh/id_ed25519	307	probe.configprotocol.no-languageprobe.dotssh
2026-08-01 17:29:52	http	request	GET /.ssh/id_ecdsa	307	probe.configprotocol.no-languageprobe.dotssh
2026-08-01 17:29:52	http	request	GET /login?next=%2Fterraform.tfstate	200
2026-08-01 17:29:51	http	request	GET /.boto	307
2026-08-01 17:29:51	http	request	GET /terraform.tfstate	307
2026-08-01 17:29:51	http	request	GET /login?next=%2F.svn%2Fentries	200
2026-08-01 17:29:51	http	request	GET /login?next=%2F.htpasswd	200
2026-08-01 17:29:51	http	request	GET /login?next=%2Fdocker-compose.yaml	200
2026-08-01 17:29:51	http	request	GET /login?next=%2F.vscode%2Flaunch.json	200
2026-08-01 17:29:50	http	request	GET /docker-compose.yaml	307
2026-08-01 17:29:50	http	request	GET /.svn/entries	307	probe.configprotocol.no-language
2026-08-01 17:29:50	http	request	GET /.vscode/launch.json	307
2026-08-01 17:29:50	http	request	GET /.htpasswd	307
2026-08-01 17:29:49	http	request	GET /login?next=%2F.docker%2Fconfig.json	200
2026-08-01 17:29:49	http	request	GET /login?next=%2F.github%2F.env	200
2026-08-01 17:29:49	http	request	GET /login?next=%2F.s3cfg	200

// machine-readable

JSON →tactic catalog →