← Back to IP report

Log Explorer

Fact drill-down for 212.30.36.93

Risk 1 LOW Scope All time All-time facts 11 In-scope 11 Filtered 11 Seen 2024-02-01 → 2025-03-11

Reset (all-time)

Active (none) Clear

Faceted filters (facts-based) exact core + snapshot + optional start/end

Annotation facets

HTTP facets

Snapshot facets

Custom time window (optional override)

Provide start/end to scope time explicitly (overrides days). Leave blank for all-time.

Tip: keep windows tight when you need speed, but the default is fact-complete.

Top annotators (facts, in-scope)

base 6 cred 3 sfp 1 ref 1

Top labels (facts, in-scope)

observed 6 cred 3 sensitive_file 1 ref 1

Click a pill to apply it as a filter.

Annotated access events

Showing page 1 / 1 — total 11 rows

← Prev Next →

# 2025-03-11 12:10:23 event 3602307 POST 301 bytes 169

ann base label observed

Request event observed

/.env.production

referer

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/.env.production

referer

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36

summary

event observed

details

—

subnet

212.30.36.0/24

asn

137409 — GSL Networks Pty LTD

geo

Germany, Bavaria, Nuremberg

org

GSL Networks

# 2025-03-11 12:10:23 event 3602307 POST 301 bytes 169

ann sfp 40 label sensitive_file

Request Probe for environment/secret file (.env)

/.env.production

referer

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36

Annotation facts

label

sensitive_file

rule

sfp:file:env

conf

92.00

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.production'

More (full fields + snapshot) expand

url

/.env.production

referer

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36

summary

Probe for environment/secret file (.env)

details

Request targeted a .env-style file (often contains secrets). Snippet='/.env.production'

subnet

212.30.36.0/24

asn

137409 — GSL Networks Pty LTD

geo

Germany, Bavaria, Nuremberg

org

GSL Networks

# 2025-03-11 12:10:16 event 3602295 GET 200 bytes 27492

ann base label observed

Request event observed

referer

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

referer

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/106.0.0.0 Safari/537.36

summary

event observed

details

—

subnet

212.30.36.0/24

asn

137409 — GSL Networks Pty LTD

geo

Germany, Bavaria, Nuremberg

org

GSL Networks

# 2024-02-02 21:18:29 event 1053642 GET 200 bytes 60898

ann base label observed

Request event observed

/blog/ai-on-ai-state-of-the-estate-additional-countries-ai-analysis/

referer

https://syndu.com/blog/ai-on-ai-state-of-the-estate-additional-countries-ai-analysis/

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/blog/ai-on-ai-state-of-the-estate-additional-countries-ai-analysis/

referer

https://syndu.com/blog/ai-on-ai-state-of-the-estate-additional-countries-ai-analysis/

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Safari/537.36

summary

event observed

details

—

subnet

212.30.36.0/24

asn

137409 — GSL Networks Pty LTD

geo

Germany, Bavaria, Nuremberg

org

GSL Networks

# 2024-02-02 21:17:47 event 1053638 GET 200 bytes 15194

ann base label observed

Request event observed

referer

https://syndu.com/

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

referer

https://syndu.com/

Mozilla/5.0 (Windows NT 6.1) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.114 Safari/537.36

summary

event observed

details

—

subnet

212.30.36.0/24

asn

137409 — GSL Networks Pty LTD

geo

Germany, Bavaria, Nuremberg

org

GSL Networks

# 2024-02-01 22:44:48 event 1004871 GET 200 bytes 44688

ann base label observed

Request event observed

/blog/ai-on-ai-state-of-the-estate-south-korea-ai-analysis/

referer

https://syndu.com/blog/ai-on-ai-state-of-the-estate-south-korea-ai-analysis/

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.66 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/blog/ai-on-ai-state-of-the-estate-south-korea-ai-analysis/

referer

https://syndu.com/blog/ai-on-ai-state-of-the-estate-south-korea-ai-analysis/

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.66 Safari/537.36

summary

event observed

details

—

subnet

212.30.36.0/24

asn

137409 — GSL Networks Pty LTD

geo

Germany, Bavaria, Nuremberg

org

GSL Networks

# 2024-02-01 22:43:49 event 1004862 GET 200 bytes 4396

ann base label observed

Request event observed

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.66 Safari/537.36

Annotation facts

label

observed

rule

base_observed

conf

—

details

—

More (full fields + snapshot) expand

url

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.66 Safari/537.36

summary

event observed

details

—

subnet

212.30.36.0/24

asn

137409 — GSL Networks Pty LTD

geo

Germany, Bavaria, Nuremberg

org

GSL Networks

# 2024-02-01 22:43:49 event 1004862 GET 200 bytes 4396

ann ref 6 label ref

Request External referer observed on an auth-like endpoint

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.66 Safari/537.36

Annotation facts

label

ref

rule

ref:external_referer_to_auth

conf

70.00

details

External origins hitting login/auth endpoints can be a signal of phishing landing pages or malicious redirect chains. This is only emitted for auth-like paths.

More (full fields + snapshot) expand

url

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.66 Safari/537.36

summary

External referer observed on an auth-like endpoint

details

External origins hitting login/auth endpoints can be a signal of phishing landing pages or malicious redirect chains. This is only emitted for auth-like paths.

subnet

212.30.36.0/24

asn

137409 — GSL Networks Pty LTD

geo

Germany, Bavaria, Nuremberg

org

GSL Networks

# 2024-02-01 22:43:49 event 1004862 GET 200 bytes 4396

ann cred 8 label cred

Request Auth success (200) on auth endpoint

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.66 Safari/537.36

Annotation facts

label

cred

rule

cred:auth_success

conf

70.00

details

Useful for takeover-style correlations when preceded by failures from same source.

More (full fields + snapshot) expand

url

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.66 Safari/537.36

summary

Auth success (200) on auth endpoint

details

Useful for takeover-style correlations when preceded by failures from same source.

subnet

212.30.36.0/24

asn

137409 — GSL Networks Pty LTD

geo

Germany, Bavaria, Nuremberg

org

GSL Networks

# 2024-02-01 22:43:49 event 1004862 GET 200 bytes 4396

ann cred 10 label cred

Request Auth request appears to use an automation-oriented user agent

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.66 Safari/537.36

Annotation facts

label

cred

rule

cred:scripted_user_agent

conf

70.00

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

More (full fields + snapshot) expand

url

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.66 Safari/537.36

summary

Auth request appears to use an automation-oriented user agent

details

Automation-ish UA strings are useful correlates when paired with failures or spraying patterns.

subnet

212.30.36.0/24

asn

137409 — GSL Networks Pty LTD

geo

Germany, Bavaria, Nuremberg

org

GSL Networks

# 2024-02-01 22:43:49 event 1004862 GET 200 bytes 4396

ann cred label cred

Request Auth endpoint request observed

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.66 Safari/537.36

Annotation facts

label

cred

rule

cred:auth_hit:login

conf

55.00

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

More (full fields + snapshot) expand

url

/accounts/login/

referer

https://syndu.com/accounts/login/

Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/103.0.5060.66 Safari/537.36

summary

Auth endpoint request observed

details

Row-level auth primitive for downstream aggregation (no velocity logic here).

subnet

212.30.36.0/24

asn

137409 — GSL Networks Pty LTD

geo

Germany, Bavaria, Nuremberg

org

GSL Networks

Log Explorer

Annotated access events

Confirm Action