139.59.143.102

blockedPersistentRegularToolkit

Case file

First seen on 2026-09-12T00:20:16Z, most recently active on 2026-10-04T21:17:58Z.

Recorded 33 attack-shaped requests across 2 separate days.

Its traffic was scanned by LeakIX, an internet-wide exposure-mapping service; it also probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities; it also probed for an exposed .git directory to download the site's source history and config.

Seen on our edge, web sensors.

Scored into the "Persistent" level, carrying the badges Regular, Toolkit.

Routed via AS14061 (DigitalOcean, LLC), an ASN we classify as hosting.

Blocked by the firewalls on our servers since 2026-10-04T21:30:04Z, through 2027-10-04T21:30:04Z.

Enrichment

rDNSf1096f7e4e.scan.leakix.org
ASNAS14061 — DigitalOcean, LLC
ASN typehosting
CountryGermany (DE)
Flagsnone observed

External references: GreyNoise, Shodan, AbuseIPDB

Timeline

Evidence (newest first, up to 50)

Time (UTC)VantageSiteClassStatusEvidence
2026-10-04T21:17:58Zwebbgpoet.comwas scanned by LeakIX, an internet-wide exposure-mapping service404GET /debug/default/view? -> 404
2026-10-04T21:17:56Zwebbgpoet.comwas scanned by LeakIX, an internet-wide exposure-mapping service200OPTIONS / -> 200
2026-10-04T21:17:53Z – 2026-10-04T21:17:55Zwebbgpoet.com3 × was scanned by LeakIX, an internet-wide exposure-mapping service404GET /.vscode/sftp.json -> 404 (3 distinct paths)
2026-10-04T21:17:52Zwebbgpoet.comprobed a Spring Boot actuator endpoint, which can leak environment variables and internal config if left open404GET /actuator/env -> 404
2026-10-04T21:17:51Zwebbgpoet.comwas scanned by LeakIX, an internet-wide exposure-mapping service404GET /.well-known/security.txt -> 404
2026-10-04T21:17:50Zwebbgpoet.comfuzzed a short, random filename looking for a forgotten script that responds404GET /info.php -> 404
2026-10-04T21:17:47Z – 2026-10-04T21:17:49Zwebbgpoet.com3 × was scanned by LeakIX, an internet-wide exposure-mapping service404GET /telescope/requests -> 404 (3 distinct paths)
2026-10-04T21:17:46Zwebbgpoet.com5 × was scanned by LeakIX, an internet-wide exposure-mapping service404POST /api/gql -> 404 (5 distinct paths)
2026-10-04T21:17:45Zwebbgpoet.comrequested the .git directory itself, hoping it is exposed and browsable403/.git -> 403
2026-10-04T21:17:45Zwebbgpoet.comprobed for an exposed .git directory to download the site's source history and config403GET /.git/config -> 403
2026-10-04T21:17:43Zwebbgpoet.comwas scanned by LeakIX, an internet-wide exposure-mapping service404GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application -> 404
2026-10-04T21:17:41Zwebbgpoet.comrequested a .env file, hoping to find API keys or database credentials403GET /.env -> 403
2026-10-04T21:17:36Z – 2026-10-04T21:17:40Zwebbgpoet.com6 × was scanned by LeakIX, an internet-wide exposure-mapping service404GET /.DS_Store -> 404 (6 distinct paths)
2026-10-04T21:17:35Zwebbgpoet.comwas scanned by LeakIX, an internet-wide exposure-mapping service403GET /server-status -> 403
2026-10-04T21:17:33Z – 2026-10-04T21:17:34Zwebbgpoet.com2 × was scanned by LeakIX, an internet-wide exposure-mapping service404GET /server -> 404 (2 distinct paths)
2026-09-12T00:20:18Z – 2026-09-12T00:20:19Zedgevictorantonov.com2 × probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilitiesPOST /wp-json/batch/v1
2026-09-12T00:20:16Z – 2026-09-12T00:20:17Zedgevictorantonov.com2 × was scanned by LeakIX, an internet-wide exposure-mapping servicePOST /

Not currently correlated with any campaign.

Dispute or removal: [email protected] — reference 139.59.143.102. See /threats/about for the method and the 7-day review window.

card.svg (used as this page's og:image)