← Back to IP report

Log Explorer

Fact drill-down for 195.176.3.24

Risk 6 LOW Scope All time All-time facts 55 In-scope 55 Filtered 55 Seen 2023-09-21 → 2025-05-29

Reset (all-time)

Active (none) Clear

Faceted filters (facts-based) exact core + snapshot + optional start/end

Annotation facets

HTTP facets

Snapshot facets

Custom time window (optional override)

Provide start/end to scope time explicitly (overrides days). Leave blank for all-time.

Tip: keep windows tight when you need speed, but the default is fact-complete.

Top annotators (facts, in-scope)

base 31 sfp 14 cred 6 scan_velocity 2 ref 2

Top labels (facts, in-scope)

observed 31 sensitive_file 14 cred 6 scan_velocity 2 ref 2

Click a pill to apply it as a filter.

Annotated access events

Showing page 1 / 2 — total 55 rows

← Prev Next →

#1 2025-05-29 18:05:16 event 8061767 GET 404 bytes 7943

ann base label observed

Request event observed

/database/db.sql

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/database/db.sql

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#2 2025-05-29 18:05:16 event 8061765 GET 404 bytes 7948

ann base label observed

Request event observed

/database/backup.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/database/backup.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#3 2025-05-29 18:05:16 event 8061764 GET 404 bytes 7943

ann base label observed

Request event observed

/database/db.sql

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/database/db.sql

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#4 2025-05-29 18:05:16 event 8061762 GET 404 bytes 7948

ann base label observed

Request event observed

/database/backup.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/database/backup.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#5 2025-05-29 18:05:15 event 8061754 GET 404 bytes 7943

ann scan_velocity 10 label scan_velocity

Request Scan-velocity indicator: scanv:ext_enum

/db.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

scan_velocity

rule

scanv:ext_enum

conf

85.00

details

ext_hits=5; score=5; window=90s; total=19; rpm_equiv=12.7; upm_nonstatic_equiv=6.7; 404=5/19(0.26); ext_hits=5; ua_sig=0; methods=['GET']

More (full fields + snapshot) expand

url

/db.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

Scan-velocity indicator: scanv:ext_enum

details

ext_hits=5; score=5; window=90s; total=19; rpm_equiv=12.7; upm_nonstatic_equiv=6.7; 404=5/19(0.26); ext_hits=5; ua_sig=0; methods=['GET']

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#6 2025-05-29 18:05:15 event 8061754 GET 404 bytes 7943

ann scan_velocity label scan_velocity

Request Scan-velocity window summary

/db.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

scan_velocity

rule

scanv:window

conf

—

details

window=90s; total=19; rpm_equiv=12.7; upm_nonstatic_equiv=6.7; 404=5/19(0.26); ext_hits=5; ua_sig=0; methods=['GET']

More (full fields + snapshot) expand

url

/db.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

Scan-velocity window summary

details

window=90s; total=19; rpm_equiv=12.7; upm_nonstatic_equiv=6.7; 404=5/19(0.26); ext_hits=5; ua_sig=0; methods=['GET']

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#7 2025-05-29 18:05:15 event 8061759 GET 404 bytes 7944

ann base label observed

Request event observed

/data.sql

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/data.sql

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#8 2025-05-29 18:05:15 event 8061758 GET 404 bytes 7943

ann base label observed

Request event observed

/db.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/db.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#9 2025-05-29 18:05:15 event 8061755 GET 404 bytes 7944

ann base label observed

Request event observed

/data.sql

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/data.sql

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#10 2025-05-29 18:05:15 event 8061754 GET 404 bytes 7943

ann base label observed

Request event observed

/db.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/db.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#11 2025-05-29 18:05:14 event 8061753 GET 404 bytes 7946

ann base label observed

Request event observed

/backup.sql

referer

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/backup.sql

referer

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#12 2025-05-29 18:05:14 event 8061751 GET 404 bytes 7944

ann base label observed

Request event observed

/database.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/database.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#13 2025-05-29 18:05:14 event 8061750 GET 404 bytes 7946

ann base label observed

Request event observed

/backup.sql

referer

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/backup.sql

referer

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/115.0.0.0 Safari/537.36

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#14 2025-05-29 18:05:14 event 8061748 GET 404 bytes 7944

ann base label observed

Request event observed

/database.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/database.sql

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#15 2025-05-29 18:05:13 event 8061746 GET 301 bytes 178

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env.qa

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.qa'

More (full fields + snapshot) expand

url

/.env.qa

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.qa'

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#16 2025-05-29 18:05:13 event 8061744 GET 301 bytes 178

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env.prod

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.prod'

More (full fields + snapshot) expand

url

/.env.prod

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.prod'

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#17 2025-05-29 18:05:13 event 8061741 GET 301 bytes 178

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env.qa

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.qa'

More (full fields + snapshot) expand

url

/.env.qa

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.qa'

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#18 2025-05-29 18:05:13 event 8061739 GET 301 bytes 178

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env.prod

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.prod'

More (full fields + snapshot) expand

url

/.env.prod

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.prod'

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#19 2025-05-29 18:05:13 event 8061746 GET 301 bytes 178

ann base label observed

Request event observed

/.env.qa

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env.qa

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#20 2025-05-29 18:05:13 event 8061744 GET 301 bytes 178

ann base label observed

Request event observed

/.env.prod

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env.prod

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#21 2025-05-29 18:05:13 event 8061741 GET 301 bytes 178

ann base label observed

Request event observed

/.env.qa

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env.qa

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#22 2025-05-29 18:05:13 event 8061739 GET 301 bytes 178

ann base label observed

Request event observed

/.env.prod

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env.prod

referer

Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:115.0) Gecko/20100101 Firefox/115.0

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#23 2025-05-29 18:05:12 event 8061736 GET 301 bytes 178

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env.dev

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.dev'

More (full fields + snapshot) expand

url

/.env.dev

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.dev'

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#24 2025-05-29 18:05:12 event 8061735 GET 301 bytes 178

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env.staging

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.staging'

More (full fields + snapshot) expand

url

/.env.staging

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.staging'

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#25 2025-05-29 18:05:12 event 8061733 GET 301 bytes 178

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env.dev

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.dev'

More (full fields + snapshot) expand

url

/.env.dev

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.dev'

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#26 2025-05-29 18:05:12 event 8061732 GET 301 bytes 178

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env.staging

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.staging'

More (full fields + snapshot) expand

url

/.env.staging

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.staging'

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#27 2025-05-29 18:05:12 event 8061736 GET 301 bytes 178

ann base label observed

Request event observed

/.env.dev

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env.dev

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#28 2025-05-29 18:05:12 event 8061735 GET 301 bytes 178

ann base label observed

Request event observed

/.env.staging

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env.staging

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#29 2025-05-29 18:05:12 event 8061733 GET 301 bytes 178

ann base label observed

Request event observed

/.env.dev

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env.dev

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#30 2025-05-29 18:05:12 event 8061732 GET 301 bytes 178

ann base label observed

Request event observed

/.env.staging

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env.staging

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#31 2025-05-29 18:05:11 event 8061729 GET 301 bytes 178

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env.test

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.test'

More (full fields + snapshot) expand

url

/.env.test

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.test'

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#32 2025-05-29 18:05:11 event 8061725 GET 301 bytes 178

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env.test

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.test'

More (full fields + snapshot) expand

url

/.env.test

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.test'

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#33 2025-05-29 18:05:11 event 8061729 GET 301 bytes 178

ann base label observed

Request event observed

/.env.test

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env.test

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#34 2025-05-29 18:05:11 event 8061725 GET 301 bytes 178

ann base label observed

Request event observed

/.env.test

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env.test

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#35 2025-05-29 18:05:10 event 8061723 GET 301 bytes 178

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env.local

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.local'

More (full fields + snapshot) expand

url

/.env.local

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.local'

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#36 2025-05-29 18:05:10 event 8061719 GET 301 bytes 178

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env.local

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.local'

More (full fields + snapshot) expand

url

/.env.local

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.local'

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#37 2025-05-29 18:05:10 event 8061723 GET 301 bytes 178

ann base label observed

Request event observed

/.env.local

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env.local

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#38 2025-05-29 18:05:10 event 8061719 GET 301 bytes 178

ann base label observed

Request event observed

/.env.local

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env.local

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#39 2025-05-29 18:05:09 event 8061714 GET 301 bytes 178

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env'

More (full fields + snapshot) expand

url

/.env

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env'

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#40 2025-05-29 18:05:09 event 8061711 GET 301 bytes 178

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env'

More (full fields + snapshot) expand

url

/.env

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env'

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#41 2025-05-29 18:05:09 event 8061714 GET 301 bytes 178

ann base label observed

Request event observed

/.env

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#42 2025-05-29 18:05:09 event 8061711 GET 301 bytes 178

ann base label observed

Request event observed

/.env

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env

referer

Mozilla/5.0 (Macintosh; Intel Mac OS X 13_5) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.5 Safari/605.1.15

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#43 2023-11-30 03:40:21 event 489978 GET 301 bytes 169

ann base label observed

Request event observed

referer

http://syndu.com/

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

referer

http://syndu.com/

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/64.0.3282.140 Safari/537.36 Edge/17.17134

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#44 2023-11-19 01:56:19 event 1115476 POST 200 bytes 4558

ann base label observed

Request event observed

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 OPR/54.0.2952.64 (Edition Yx)

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 OPR/54.0.2952.64 (Edition Yx)

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#45 2023-11-19 01:56:19 event 1115476 POST 200 bytes 4558

ann ref 6 label ref

Request External referer observed on an auth-like endpoint

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 OPR/54.0.2952.64 (Edition Yx)

Annotation facts

label

ref

rule

ref:external_referer_to_auth

conf

70.00

details

External origins hitting login/auth endpoints can be a signal of phishing landing pages or malicious redirect chains. This is only emitted for auth-like paths.

More (full fields + snapshot) expand

url

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 OPR/54.0.2952.64 (Edition Yx)

summary

External referer observed on an auth-like endpoint

details

External origins hitting login/auth endpoints can be a signal of phishing landing pages or malicious redirect chains. This is only emitted for auth-like paths.

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#46 2023-11-19 01:56:19 event 1115476 POST 200 bytes 4558

ann cred 8 label cred

Request Auth success (200) on auth endpoint

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 OPR/54.0.2952.64 (Edition Yx)

Annotation facts

label

cred

rule

cred:auth_success

conf

70.00

details

Useful for takeover-style correlations when preceded by failures from same source.

More (full fields + snapshot) expand

url

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 OPR/54.0.2952.64 (Edition Yx)

summary

Auth success (200) on auth endpoint

details

Useful for takeover-style correlations when preceded by failures from same source.

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#47 2023-11-19 01:56:19 event 1115476 POST 200 bytes 4558

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 OPR/54.0.2952.64 (Edition Yx)

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 OPR/54.0.2952.64 (Edition Yx)

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#48 2023-11-19 01:56:19 event 1115476 POST 200 bytes 4558

ann cred label cred

Request Auth endpoint request observed

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 OPR/54.0.2952.64 (Edition Yx)

Annotation facts

label

cred

rule

cred:auth_hit:login

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.87 Safari/537.36 OPR/54.0.2952.64 (Edition Yx)

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#49 2023-11-12 16:30:57 event 649990 GET 200 bytes 4396

ann base label observed

Request event observed

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36

summary

event observed

details

—

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

#50 2023-11-12 16:30:57 event 649990 GET 200 bytes 4396

ann ref 6 label ref

Request External referer observed on an auth-like endpoint

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36

Annotation facts

label

ref

rule

ref:external_referer_to_auth

conf

70.00

details

External origins hitting login/auth endpoints can be a signal of phishing landing pages or malicious redirect chains. This is only emitted for auth-like paths.

More (full fields + snapshot) expand

url

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 6.3; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36

summary

External referer observed on an auth-like endpoint

details

External origins hitting login/auth endpoints can be a signal of phishing landing pages or malicious redirect chains. This is only emitted for auth-like paths.

subnet

195.176.3.0/24

asn

559 — SWITCH

geo

Switzerland, Vaud, Lausanne

org

Digitale Gesellschaft

Log Explorer

Annotated access events

Confirm Action