TLP:CLEAR SL-ADV-2026-WP-001 Incident note Outcome: no compromise 2026-10-23

Omegatech cluster: direct-from-ASN `.env` harvesting of the Dispensight app tier

On 2026-10-23, ten source IPs from the tracked Omegatech cluster scanned Dispensight / SecureLeaf application infrastructure directly from their own announced BGP space — no Cloudflare fronting, no Storm ring. The objective was credential disclosure via exposed .env files. Every probe was refused; nothing was disclosed.

Author: Dispensight / SecureLeafSeries: SL-ADV-2026-WP-001Cluster: AS202412 / AS197769 / AS219502Evidence: origin SSL + tunnel telemetry

Key judgements

High
Attempt failed — no compromise. All four .env probes returned 404, the Adminer DB-panel probe 403, and the WordPress enumeration 404. The only 200s were benign page loads (root pages and a login form). No secrets, config, DB panel, or auth bypass.
High
Scanning came direct from announced ASN space. 8 of 10 IPs originate in AS202412 (Omegatech, Spamhaus DROP); 7 of those from a single rotating-host pool, 130.12.180.0/24. 2 from the co-operated buddy AS197769 (VPS Dedicated). This is the second wave (after 2026-10-18) of Omegatech scanning from its own space rather than fronting.
High
They went for the application tier, not the marketing site. Targets were s01-app, kpi, help.dispensight.cloud and the taxii CTI-feed host — the systems that would hold credentials — with dispensight.com seeing only the Adminer probe.
Medium
130.12.180.0/24 is a durable, blockable indicator. It has recurred as a direct-scan source on 2026-10-18 and 2026-10-23, cycling fresh hosts (.175/.176 new this wave). It can be dropped at the /24 with zero collateral — the whole block is Omegatech.
Medium
Shared-operator attribution holds. AS202412 / AS197769 / AS219502 remain one operator per shared transit cone, overlapping address space, and Δ0.0d co-timed BGP announcements (see the SecureLeaf ASN Route Watch).

What happened

Between 2026-10-22 21:35 and 2026-10-23 07:51 PDT, ten distinct source IPs — all inside tracked Omegatech cluster prefixes — probed the Dispensight application subdomains. The dominant action was GET /.env across four hosts, consistent with automated harvesting for a framework secrets file (database URLs, API keys, app secrets). Supporting activity included WordPress wlwmanifest.xml path-fuzzing (fishing for a WordPress install that does not exist) and a probe for an exposed Adminer database panel.

What makes this wave notable is the origin: the traffic arrived straight from Omegatech's announced BGP prefixes rather than behind Cloudflare or routed through the Storm Industries (AS219502) ring, as earlier WP-001 activity was. Combined with the recurrence of 130.12.180.0/24, this indicates Omegatech is now comfortable scanning from — and burning — its own DROP-listed space.

Targeted endpoints

Host	Role	Offenders	Paths probed
s01-app.dispensight.ca	Application	4	/.env, /wp-includes/wlwmanifest.xml, /
help.dispensight.cloud	Support	4	/.env, /
kpi.dispensight.ca	KPI dashboard	3	/.env, /login
taxii.dispensight.ca	CTI feed (TAXII)	1	/.env, /
dispensight.com	Marketing	1	/admin/_adminer.php

Outcome — every probe refused

No compromise. Aggregate response codes across all ten offenders: 404 ×15 (incl. all four .env and the WordPress enum), 403 ×1 (Adminer), 302 ×2, 200 ×9. Every 200 was a benign page load — root pages and a single GET /login returning the login form (no POST, no authentication, no bypass). Zero secrets, configuration, database access, or credentials were disclosed. The application tier held.

Indicators

Defanged context in prose; the machine-readable set ships as SL-ADV-2026-WP-001-omega-offenders-20261023.stix.json (STIX 2.1, OTX-ready). Cluster prefixes are safe to block at the CIDR level.

Source IPs (2026-10-23)

IP	ASN / prefix	Hits	Activity	Result	Action
130.12.180.165	AS202412 / 130.12.180.0/24	3	.env harvest (help, kpi, s01-app)	404	Block
130.12.180.175	AS202412 / 130.12.180.0/24	3	.env harvest (kpi, taxii) — new host	404	Block
130.12.180.171	AS202412 / 130.12.180.0/24	1	.env harvest (help)	404	Block
130.12.180.176	AS202412 / 130.12.180.0/24	1	.env harvest (s01-app) — new host	404	Block
130.12.180.164	AS202412 / 130.12.180.0/24	1	/login recon (kpi)	200 (form)	Block
130.12.180.163	AS202412 / 130.12.180.0/24	1	root recon (s01-app)	—	Block
130.12.180.170	AS202412 / 130.12.180.0/24	1	root recon (help)	—	Block
91.92.240.200	AS202412 / 91.92.240.0/24	1	Adminer DB-panel probe (dispensight.com)	403	Block
102.220.160.173	AS197769 / 102.220.160.0/23	9	WordPress wlwmanifest.xml enum (s01-app)	404	Block
102.220.161.89	AS197769 / 102.220.160.0/23	2	root recon (help, taxii)	—	Block

Prefixes & ASNs

Indicator	Owner	Note	Action
130.12.180.0/24	AS202412 Omegatech	Rotating direct-scan pool; recurred 10-18 & 10-23	Block /24
91.92.240.0/24	AS202412 Omegatech	Adminer probe source	Block /24
102.220.160.0/23	AS197769 VPS Dedicated	Buddy ASN; WP enum + recon	Block /23
AS202412 / AS197769 / AS219502	Omegatech cluster	One operator (co-timed BGP, shared transit)	Monitor / ASN-block

Recommended actions

Drop 130.12.180.0/24, 91.92.240.0/24 and 102.220.160.0/23 at the edge — all Omegatech cluster space, zero legitimate collateral.
Alert on any GET /.env (and framework-secret variants) against the application subdomains; confirm all return 404.
Keep /admin/* admin tooling (Adminer, phpMyAdmin) off public surfaces — the 403 held, keep it that way.
Treat the whole DROP-listed cluster (AS202412 / AS197769 / AS219502) as block-on-sight; the SecureLeaf ASN Route Watch tracks their announcements near-real-time.

SecureLeaf CTI · secureleaf.dispensight.com · SL-ADV-2026-WP-001 incident note · TLP:CLEAR · 2026-10-23 · Companion: SL-ADV-2026-WP-001-omega-offenders-20261023.stix.json. Attribution held at the infrastructure level; no named group asserted.