165.227.39.235

blockedPersistentRegularToolkit

Case file

First seen on 2026-10-03T23:35:07Z, most recently active on 2026-10-05T07:49:56Z.

Recorded 60 attack-shaped requests across 2 separate days.

Its traffic was scanned by LeakIX, an internet-wide exposure-mapping service; it also requested the .git directory itself, hoping it is exposed and browsable; it also probed for an exposed .git directory to download the site's source history and config.

Seen on our web sensor.

Scored into the "Persistent" level, carrying the badges Regular, Toolkit.

Routed via AS14061 (DigitalOcean, LLC), an ASN we classify as hosting.

Blocked by the firewalls on our servers since 2026-10-05T08:00:04Z, through 2027-10-05T08:00:04Z.

Enrichment

rDNS	c53df711d7.scan.leakix.org
ASN	AS14061 — DigitalOcean, LLC
ASN type	hosting
Country	Canada (CA)
Flags	none observed

External references: GreyNoise, Shodan, AbuseIPDB

Timeline

2026-10-0332
2026-10-0528

Evidence (newest first, up to 50)

Time (UTC)	Vantage	Site	Class	Status	Evidence
2026-10-05T07:49:56Z	web	foundyourjob.com	was scanned by LeakIX, an internet-wide exposure-mapping service	404	`GET /debug/default/view? -> 404`
2026-10-05T07:49:54Z	web	foundyourjob.com	was scanned by LeakIX, an internet-wide exposure-mapping service	200	`OPTIONS / -> 200`
2026-10-05T07:49:51Z – 2026-10-05T07:49:53Z	web	foundyourjob.com	3 × was scanned by LeakIX, an internet-wide exposure-mapping service	404	`GET /.vscode/sftp.json -> 404` (3 distinct paths)
2026-10-05T07:49:50Z	web	foundyourjob.com	probed a Spring Boot actuator endpoint, which can leak environment variables and internal config if left open	404	`GET /actuator/env -> 404`
2026-10-05T07:49:49Z	web	foundyourjob.com	was scanned by LeakIX, an internet-wide exposure-mapping service	404	`GET /.well-known/security.txt -> 404`
2026-10-05T07:49:48Z	web	foundyourjob.com	fuzzed a short, random filename looking for a forgotten script that responds	404	`GET /info.php -> 404`
2026-10-05T07:49:45Z – 2026-10-05T07:49:47Z	web	foundyourjob.com	3 × was scanned by LeakIX, an internet-wide exposure-mapping service	404	`GET /telescope/requests -> 404` (3 distinct paths)
2026-10-05T07:49:44Z – 2026-10-05T07:49:45Z	web	foundyourjob.com	3 × was scanned by LeakIX, an internet-wide exposure-mapping service	404	`POST /api/gql -> 404` (3 distinct paths)
2026-10-05T07:49:44Z	web	foundyourjob.com	was scanned by LeakIX, an internet-wide exposure-mapping service	301	`POST /api -> 301`
2026-10-05T07:49:44Z	web	foundyourjob.com	was scanned by LeakIX, an internet-wide exposure-mapping service	404	`POST /graphql -> 404`
2026-10-05T07:49:43Z	web	foundyourjob.com	requested the .git directory itself, hoping it is exposed and browsable	403	`/.git -> 403`
2026-10-05T07:49:43Z	web	foundyourjob.com	probed for an exposed .git directory to download the site's source history and config	403	`GET /.git/config -> 403`
2026-10-05T07:49:41Z	web	foundyourjob.com	was scanned by LeakIX, an internet-wide exposure-mapping service	404	`GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application -> 404`
2026-10-05T07:49:39Z	web	foundyourjob.com	requested a .env file, hoping to find API keys or database credentials	403	`GET /.env -> 403`
2026-10-05T07:49:34Z – 2026-10-05T07:49:38Z	web	foundyourjob.com	6 × was scanned by LeakIX, an internet-wide exposure-mapping service	404	`GET /.DS_Store -> 404` (6 distinct paths)
2026-10-05T07:49:33Z	web	foundyourjob.com	was scanned by LeakIX, an internet-wide exposure-mapping service	403	`GET /server-status -> 403`
2026-10-05T07:49:32Z	web	foundyourjob.com	was scanned by LeakIX, an internet-wide exposure-mapping service	404	`GET /server -> 404`
2026-10-03T23:35:34Z	web	techauthors.eu	was scanned by LeakIX, an internet-wide exposure-mapping service	404	`GET /debug/default/view? -> 404`
2026-10-03T23:35:33Z	web	techauthors.eu	was scanned by LeakIX, an internet-wide exposure-mapping service	200	`GET /? -> 200`
2026-10-03T23:35:32Z	web	techauthors.eu	was scanned by LeakIX, an internet-wide exposure-mapping service	200	`OPTIONS / -> 200`
2026-10-03T23:35:29Z – 2026-10-03T23:35:31Z	web	techauthors.eu	3 × was scanned by LeakIX, an internet-wide exposure-mapping service	404	`GET /.vscode/sftp.json -> 404` (3 distinct paths)
2026-10-03T23:35:28Z	web	techauthors.eu	probed a Spring Boot actuator endpoint, which can leak environment variables and internal config if left open	404	`GET /actuator/env -> 404`
2026-10-03T23:35:27Z	web	techauthors.eu	was scanned by LeakIX, an internet-wide exposure-mapping service	404	`GET /.well-known/security.txt -> 404`
2026-10-03T23:35:26Z	web	techauthors.eu	fuzzed a short, random filename looking for a forgotten script that responds	404	`GET /info.php -> 404`
2026-10-03T23:35:22Z – 2026-10-03T23:35:25Z	web	techauthors.eu	3 × was scanned by LeakIX, an internet-wide exposure-mapping service	404	`GET /telescope/requests -> 404` (3 distinct paths)
2026-10-03T23:35:21Z – 2026-10-03T23:35:22Z	web	techauthors.eu	5 × was scanned by LeakIX, an internet-wide exposure-mapping service	404	`POST /api/gql -> 404` (5 distinct paths)
2026-10-03T23:35:20Z	web	techauthors.eu	requested the .git directory itself, hoping it is exposed and browsable	403	`/.git -> 403`
2026-10-03T23:35:20Z	web	techauthors.eu	probed for an exposed .git directory to download the site's source history and config	403	`GET /.git/config -> 403`
2026-10-03T23:35:18Z	web	techauthors.eu	was scanned by LeakIX, an internet-wide exposure-mapping service	404	`GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application -> 404`
2026-10-03T23:35:16Z	web	techauthors.eu	requested a .env file, hoping to find API keys or database credentials	403	`GET /.env -> 403`
2026-10-03T23:35:16Z	web	techauthors.eu	was scanned by LeakIX, an internet-wide exposure-mapping service	404	`GET /.DS_Store -> 404`

Not currently correlated with any campaign.

Dispute or removal: [email protected] — reference 165.227.39.235. See /threats/about for the method and the 7-day review window.

card.svg (used as this page's og:image)