157.245.36.108
blockedPersistentRegularToolkit
Case file
First seen on 2026-10-01T16:16:39Z, most recently active on 2026-10-05T11:42:32Z.
Recorded 61 attack-shaped requests across 2 separate days.
Its traffic was scanned by LeakIX, an internet-wide exposure-mapping service; it also requested the .git directory itself, hoping it is exposed and browsable; it also probed for an exposed .git directory to download the site's source history and config.
Seen on our web sensor.
Scored into the "Persistent" level, carrying the badges Regular, Toolkit.
Routed via AS14061 (DigitalOcean, LLC), an ASN we classify as hosting.
Blocked by the firewalls on our servers since 2026-10-05T11:50:04Z, through 2027-10-05T11:50:04Z.
Enrichment
| rDNS | a93200c42e.scan.leakix.org |
|---|---|
| ASN | AS14061 — DigitalOcean, LLC |
| ASN type | hosting |
| Country | United Kingdom (GB) |
| Flags | none observed |
Timeline
- 2026-10-0132
- 2026-10-0529
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-05T11:42:32Z | web | 4emx.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /debug/default/view? -> 404 |
| 2026-10-05T11:42:30Z | web | 4emx.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 200 | OPTIONS / -> 200 |
| 2026-10-05T11:42:27Z – 2026-10-05T11:42:29Z | web | 4emx.com | 3 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /.vscode/sftp.json -> 404 (3 distinct paths) |
| 2026-10-05T11:42:26Z | web | 4emx.com | probed a Spring Boot actuator endpoint, which can leak environment variables and internal config if left open | 404 | GET /actuator/env -> 404 |
| 2026-10-05T11:42:25Z | web | 4emx.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /.well-known/security.txt -> 404 |
| 2026-10-05T11:42:24Z | web | 4emx.com | fuzzed a short, random filename looking for a forgotten script that responds | 404 | GET /info.php -> 404 |
| 2026-10-05T11:42:21Z – 2026-10-05T11:42:23Z | web | 4emx.com | 3 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /telescope/requests -> 404 (3 distinct paths) |
| 2026-10-05T11:42:20Z | web | 4emx.com | 5 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | POST /api/gql -> 404 (5 distinct paths) |
| 2026-10-05T11:42:19Z | web | 4emx.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | /.git -> 403 |
| 2026-10-05T11:42:19Z | web | 4emx.com | probed for an exposed .git directory to download the site's source history and config | 403 | GET /.git/config -> 403 |
| 2026-10-05T11:42:17Z | web | 4emx.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application -> 404 |
| 2026-10-05T11:42:15Z | web | 4emx.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-10-05T11:42:10Z – 2026-10-05T11:42:14Z | web | 4emx.com | 6 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /.DS_Store -> 404 (6 distinct paths) |
| 2026-10-05T11:42:09Z | web | 4emx.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 403 | GET /server-status -> 403 |
| 2026-10-05T11:42:07Z – 2026-10-05T11:42:08Z | web | 4emx.com | 2 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /server -> 404 (2 distinct paths) |
| 2026-10-01T16:17:05Z | web | schetio.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /debug/default/view? -> 404 |
| 2026-10-01T16:17:04Z | web | schetio.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 200 | GET /? -> 200 |
| 2026-10-01T16:17:03Z | web | schetio.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 200 | OPTIONS / -> 200 |
| 2026-10-01T16:17:00Z – 2026-10-01T16:17:02Z | web | schetio.com | 3 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /.vscode/sftp.json -> 404 (3 distinct paths) |
| 2026-10-01T16:16:59Z | web | schetio.com | probed a Spring Boot actuator endpoint, which can leak environment variables and internal config if left open | 404 | GET /actuator/env -> 404 |
| 2026-10-01T16:16:58Z | web | schetio.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /.well-known/security.txt -> 404 |
| 2026-10-01T16:16:57Z | web | schetio.com | fuzzed a short, random filename looking for a forgotten script that responds | 404 | GET /info.php -> 404 |
| 2026-10-01T16:16:54Z – 2026-10-01T16:16:57Z | web | schetio.com | 3 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /telescope/requests -> 404 (3 distinct paths) |
| 2026-10-01T16:16:53Z | web | schetio.com | 5 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | POST /api/gql -> 404 (5 distinct paths) |
| 2026-10-01T16:16:52Z | web | schetio.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | /.git -> 403 |
| 2026-10-01T16:16:52Z | web | schetio.com | probed for an exposed .git directory to download the site's source history and config | 403 | GET /.git/config -> 403 |
| 2026-10-01T16:16:50Z | web | schetio.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application -> 404 |
| 2026-10-01T16:16:48Z | web | schetio.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 157.245.36.108. See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
