206.81.24.74
Case file
First seen on 2026-09-15T21:37:45Z, most recently active on 2026-10-05T23:04:45Z.
Recorded 39 attack-shaped requests across 3 separate days.
Its traffic was scanned by LeakIX, an internet-wide exposure-mapping service; it also probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities; it also fuzzed a short, random filename looking for a forgotten script that responds.
Seen on our edge, panel sensors.
Scored into the "Persistent" level, carrying the badges Regular, Toolkit.
Routed via AS14061 (DigitalOcean, LLC), an ASN we classify as hosting.
Blocked by the firewalls on our servers since 2026-10-05T23:10:05Z, through 2027-10-05T23:10:05Z.
Enrichment
| rDNS | be0f5ba2c6.scan.leakix.org |
|---|---|
| ASN | AS14061 — DigitalOcean, LLC |
| ASN type | hosting |
| Country | Germany (DE) |
| Flags | none observed |
Timeline
- 2026-09-154
- 2026-09-234
- 2026-10-0531
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-05T23:04:45Z | panel | nl4 | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /debug/default/view? -> 404 |
| 2026-10-05T23:04:44Z | panel | nl4 | was scanned by LeakIX, an internet-wide exposure-mapping service | 302 | GET /? -> 302 |
| 2026-10-05T23:04:43Z | panel | nl4 | was scanned by LeakIX, an internet-wide exposure-mapping service | 405 | OPTIONS / -> 405 |
| 2026-10-05T23:04:40Z – 2026-10-05T23:04:42Z | panel | nl4 | 3 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /.vscode/sftp.json -> 404 (3 distinct paths) |
| 2026-10-05T23:04:39Z | panel | nl4 | probed a Spring Boot actuator endpoint, which can leak environment variables and internal config if left open | 404 | GET /actuator/env -> 404 |
| 2026-10-05T23:04:38Z | panel | nl4 | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /.well-known/security.txt -> 404 |
| 2026-10-05T23:04:37Z | panel | nl4 | fuzzed a short, random filename looking for a forgotten script that responds | 404 | GET /info.php -> 404 |
| 2026-10-05T23:04:36Z | panel | nl4 | tried to abuse a local or remote file inclusion parameter such as allow_url_include | 404 | POST /php-cgi/php-cgi.exe? -> 404 |
| 2026-10-05T23:04:33Z – 2026-10-05T23:04:36Z | panel | nl4 | 3 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /telescope/requests -> 404 (3 distinct paths) |
| 2026-10-05T23:04:32Z | panel | nl4 | 3 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | POST /api/gql -> 404 (3 distinct paths) |
| 2026-10-05T23:04:32Z | panel | nl4 | was scanned by LeakIX, an internet-wide exposure-mapping service | 301 | POST /api -> 301 |
| 2026-10-05T23:04:32Z | panel | nl4 | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | POST /graphql -> 404 |
| 2026-10-05T23:04:31Z | panel | nl4 | probed for an exposed .git directory to download the site's source history and config | 404 | GET /.git/config -> 404 |
| 2026-10-05T23:04:29Z | panel | nl4 | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application -> 404 |
| 2026-10-05T23:04:27Z | panel | nl4 | requested a .env file, hoping to find API keys or database credentials | 404 | GET /.env -> 404 |
| 2026-10-05T23:04:25Z – 2026-10-05T23:04:26Z | panel | nl4 | 4 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /.DS_Store -> 404 (4 distinct paths) |
| 2026-10-05T23:04:25Z | panel | nl4 | was scanned by LeakIX, an internet-wide exposure-mapping service | 302 | GET / -> 302 |
| 2026-10-05T23:04:20Z – 2026-10-05T23:04:24Z | panel | nl4 | 4 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /about -> 404 (4 distinct paths) |
| 2026-10-05T23:04:19Z | panel | nl4 | was scanned by LeakIX, an internet-wide exposure-mapping service | 302 | GET / -> 302 |
| 2026-09-23T06:36:07Z – 2026-09-23T06:36:08Z | edge | victorantonov.com | 2 × probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | POST /wp-json/batch/v1 | |
| 2026-09-23T06:36:05Z – 2026-09-23T06:36:06Z | edge | victorantonov.com | 2 × was scanned by LeakIX, an internet-wide exposure-mapping service | POST / | |
| 2026-09-15T21:37:47Z – 2026-09-15T21:37:48Z | edge | victorantonov.com | 2 × probed the WordPress REST API batch endpoint, often used to fingerprint or chain other WordPress vulnerabilities | POST /wp-json/batch/v1 | |
| 2026-09-15T21:37:45Z – 2026-09-15T21:37:46Z | edge | victorantonov.com | 2 × was scanned by LeakIX, an internet-wide exposure-mapping service | POST / |
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 206.81.24.74. See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
