68.183.9.16
blockedPersistentRegularToolkit
Case file
First seen on 2026-09-29T12:17:35Z, most recently active on 2026-10-06T05:43:52Z.
Recorded 61 attack-shaped requests across 2 separate days.
Its traffic was scanned by LeakIX, an internet-wide exposure-mapping service; it also probed for an exposed .git directory to download the site's source history and config; it also requested a .env file, hoping to find API keys or database credentials.
Seen on our web sensor.
Scored into the "Persistent" level, carrying the badges Regular, Toolkit.
Routed via AS14061 (DigitalOcean, LLC), an ASN we classify as hosting.
Blocked by the firewalls on our servers since 2026-10-06T05:50:04Z, through 2027-10-06T05:50:04Z.
Enrichment
| rDNS | fafb352f31.scan.leakix.org |
|---|---|
| ASN | AS14061 — DigitalOcean, LLC |
| ASN type | hosting |
| Country | The Netherlands (NL) |
| Flags | none observed |
Timeline
- 2026-09-2932
- 2026-10-0629
Evidence (newest first, up to 50)
| Time (UTC) | Vantage | Site | Class | Status | Evidence |
|---|---|---|---|---|---|
| 2026-10-06T05:43:52Z | web | zmey.eu | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /debug/default/view? -> 404 |
| 2026-10-06T05:43:50Z | web | zmey.eu | was scanned by LeakIX, an internet-wide exposure-mapping service | 200 | OPTIONS / -> 200 |
| 2026-10-06T05:43:47Z – 2026-10-06T05:43:49Z | web | zmey.eu | 3 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /.vscode/sftp.json -> 404 (3 distinct paths) |
| 2026-10-06T05:43:46Z | web | zmey.eu | probed a Spring Boot actuator endpoint, which can leak environment variables and internal config if left open | 404 | GET /actuator/env -> 404 |
| 2026-10-06T05:43:45Z | web | zmey.eu | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /.well-known/security.txt -> 404 |
| 2026-10-06T05:43:44Z | web | zmey.eu | fuzzed a short, random filename looking for a forgotten script that responds | 404 | GET /info.php -> 404 |
| 2026-10-06T05:43:41Z – 2026-10-06T05:43:44Z | web | zmey.eu | 3 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /telescope/requests -> 404 (3 distinct paths) |
| 2026-10-06T05:43:40Z | web | zmey.eu | 5 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | POST /api/gql -> 404 (5 distinct paths) |
| 2026-10-06T05:43:39Z | web | zmey.eu | requested the .git directory itself, hoping it is exposed and browsable | 403 | /.git -> 403 |
| 2026-10-06T05:43:39Z | web | zmey.eu | probed for an exposed .git directory to download the site's source history and config | 403 | GET /.git/config -> 403 |
| 2026-10-06T05:43:37Z | web | zmey.eu | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application -> 404 |
| 2026-10-06T05:43:35Z | web | zmey.eu | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
| 2026-10-06T05:43:30Z – 2026-10-06T05:43:34Z | web | zmey.eu | 6 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /.DS_Store -> 404 (6 distinct paths) |
| 2026-10-06T05:43:28Z | web | zmey.eu | was scanned by LeakIX, an internet-wide exposure-mapping service | 403 | GET /server-status -> 403 |
| 2026-10-06T05:43:26Z – 2026-10-06T05:43:28Z | web | zmey.eu | 2 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /server -> 404 (2 distinct paths) |
| 2026-09-29T12:18:01Z | web | obdebug.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /debug/default/view? -> 404 |
| 2026-09-29T12:18:00Z | web | obdebug.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 200 | GET /? -> 200 |
| 2026-09-29T12:17:59Z | web | obdebug.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 200 | OPTIONS / -> 200 |
| 2026-09-29T12:17:56Z – 2026-09-29T12:17:58Z | web | obdebug.com | 3 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /.vscode/sftp.json -> 404 (3 distinct paths) |
| 2026-09-29T12:17:55Z | web | obdebug.com | probed a Spring Boot actuator endpoint, which can leak environment variables and internal config if left open | 404 | GET /actuator/env -> 404 |
| 2026-09-29T12:17:54Z | web | obdebug.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /.well-known/security.txt -> 404 |
| 2026-09-29T12:17:53Z | web | obdebug.com | fuzzed a short, random filename looking for a forgotten script that responds | 404 | GET /info.php -> 404 |
| 2026-09-29T12:17:50Z – 2026-09-29T12:17:52Z | web | obdebug.com | 3 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /telescope/requests -> 404 (3 distinct paths) |
| 2026-09-29T12:17:49Z | web | obdebug.com | 3 × was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | POST /api/gql -> 404 (3 distinct paths) |
| 2026-09-29T12:17:49Z | web | obdebug.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 301 | POST /api -> 301 |
| 2026-09-29T12:17:49Z | web | obdebug.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | POST /graphql -> 404 |
| 2026-09-29T12:17:48Z | web | obdebug.com | requested the .git directory itself, hoping it is exposed and browsable | 403 | /.git -> 403 |
| 2026-09-29T12:17:48Z | web | obdebug.com | probed for an exposed .git directory to download the site's source history and config | 403 | GET /.git/config -> 403 |
| 2026-09-29T12:17:46Z | web | obdebug.com | was scanned by LeakIX, an internet-wide exposure-mapping service | 404 | GET /ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application -> 404 |
| 2026-09-29T12:17:44Z | web | obdebug.com | requested a .env file, hoping to find API keys or database credentials | 403 | GET /.env -> 403 |
Not currently correlated with any campaign.
Dispute or removal: [email protected] — reference 68.183.9.16. See /threats/about for the method and the 7-day review window.
card.svg (used as this page's og:image)
