{"ip":"143.244.168.161","total_events":73,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"leakix","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (leakix).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"6,465 bytes sent","bytes_sent":6465,"session_seconds":0,"persistent":false}},"first_seen":"2026-05-01T05:50:26","last_seen":"2026-10-01T17:55:17","events_24h":32,"events_7d":32,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"b4ed9564d2.scan.leakix.org","known_scanners":["leakix","LeakIX"],"scanner_tag":{"key":"auto:leakix_org","label":"LeakIX","category":"commercial","url":"https://leakix.net"},"cve_matches":[{"cve_id":"CVE-2026-27771","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog"}],"malware":[],"top_ports":[{"port":8921,"proto":"tcp","label":"","count":41},{"port":5010,"proto":"tcp","label":"","count":32}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131300_f57a46bbacb6_3b244d8fbcc8","t13i131200_f57a46bbacb6_fb48f8b98a29","t13i131000_f57a46bbacb6_e5728521abd4","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"160301066801000664030395d4662cdc142b9d449f78f3ff85c5e825e1f89928943c7465806a4ae51b999c20e46f21e509b5f0e6fd9a4711f20eacca9aa79ff5cdc14241e6daf79221a44510001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000601000b0002010000230000ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c07b8493a2a6032cb70068912f244c2e420007107616cd019fc0425f86d0bb72f602d5b09336f2133e273f01890a666763c6b9a769f627c98a0bad2b39af481050767ec09b8df267743e6335de8105327478c1883461225ee8903a98db1a4a2c56841260a64c376b0b6c96f17ecb99995097a763c10923279173368d3eb73e06c91b5b6c83884441753735f93209c3d7a2942110ab760be168989984424ed5a0aa23b42a7a52af63bd422a1bd0e01ffa6a61cb477df3667ccc8092c35049c589604fa0824f67179927877b853d97b1cc91956bc5f7a11f040dfb14c791860b14fc4e05f1c250a232db268fd4750a50a6bab0e68164e74e13f844444097a1491c49d40f275ab14c0a10c76975e4043028275140080db5e54abc90a4ec8095820597ee042ff9788d3a32920624b7794b3f4a5c847fa6ae557c51fdc83b37416866a6013e6a117ad04063d4bb4367a7ac9b6dba802b8371a07a9bb02d3b3733c7b341ecbbfed137760200f48c131d2294b6a49c163404c1f474da8b66dcd16521f8cc6484b9d9925b06f127ec94bf33930cded85b06f705aa47b4b30bb136186ed6b2a42d8b3e56c6590c3a311ae95ea0a1c5a153bebdb9a30070156e4800e31a4b81603b85e888fa37222439c8a3a9a883ca4428669860975e6d5834445569a548728194b5cd07af0703bde5b50e5a9945cce26a7b96babde61c62672f0f01aec9103efe216c5444cee7ba4bcda15edf305afe18829220cbf1a7591702b8b48ac95b341c259205efea2650c4ae745933d4458053bcb353245776ac711481199ec4c9ecb89193e62df7db4187dc935713a8c0fa85e9c653b543ca6c7289235a832c343b69acbaeb12cd23ec563da0559b280489310fd60762756299a33abd7d28210dd8b6d2d9214fab473eda9ff220691142076a1a449de67192e07f554261302c47ccf07ec553b7fd8047e4d9bc0b883cc76a35353073c4e6479ccb1710b737235b9afc707ddcfb21104c1e9d4c94f7e86680260c343b29b45c4ee7b137df7b6157c712c8c27cab6076a3901b92b747f1b3031ba8c92bfa386cac3d0f3c4b3698532a800174212c0c591c63101d04195b15c350f0343aa9613e9ae439478a280dda9339d03b3bf90440999e92387d19aa95b5fab962d1648b9b44c711a3117bb56e1b8e61f5281d6c1a9d4c60d842072c7281a177b43642384df33f2e7acd30d75eb2b47cfbc4701267155c213bb2e46fd2a5cd94d6788f06411aa547db48b773449b2bf99fa595bc08872fafe34f85e95f64f97b27863d01c7ae66f1866f12bb98d2bd87590b0d78a2d3f9c54737c392cc72c60c032134485d57c35cdc94d3d825b24b580928c930ac877c4987bd64be1dc4adc59868a96380e7d189ee2c6562b86ad0f23ccf427af17444694c9e004ba3db44770b8276dbf6a80c73ae3c696b6aa03069d839f141aec7c65b9de30e44fb2f3c0c884e160edbb15d5b7358993258e8449dca031afd60a5e28c3c42b587bb158ae5073fdcac6c49a8c3099c4aa4842bb496bb265ca93fb463a1817787ec23991c4421f844200112da6599233511ec7109bae3ba447493616ac7ad95021918b306d445147109df0782dfbcbb967449e4427a8564c55d939cab5828322fc9d589f5b434d81ad27d677fd6d3eb3eb734a8e283714de20e6c7296ad209170a4ef1fafdc28122f824836f42887aa43292c001d0020a8e283714de20e6c7296ad209170a4ef1fafdc28122f824836f42887aa43292c002d0002010100290094006f006940a5c5b55640d9c8381f370810056acfefc6eaf9b15709020ea263317c92a3556adffcfe00730514f3a3dfd8271ca4715f16f84a6a0f5be46ceb3cb54e7795d8ac770d5506d060b619c863fb7c623bfdec84c05609de0b971051d5fdc47e69d155bee7716128c1de946e7f027900212054c41a28192fb87150ba51771d221b90902abdad7c221a0a6a03854fd1518347","tls_ja3":["0d19b15a013ea9e1ae313614888f79f5","725543c78edf669194c11dc7a039b56e","37b3769f942aae0789e38e380a532088"],"http_akin":["b11cun030_00040011_c91eaf54","b11cuq070_00050817_ae8383eb","b11cun040_00040013_608dab68","b11cun050_00040017_e873236c"]},"fingerprint_peers":{"t13i131300_f57a46bbacb6_3b244d8fbcc8":47,"t13i131200_f57a46bbacb6_fb48f8b98a29":49,"t13i131000_f57a46bbacb6_ab7e3b40a677":4729,"b11cun030_00040011_c91eaf54":608,"b11cuq070_00050817_ae8383eb":49,"b11cun040_00040013_608dab68":4356,"b11cun050_00040017_e873236c":728,"t13i131000_f57a46bbacb6_e5728521abd4":59},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":2,"ips":608},"b11cuq070_00050817_ae8383eb":{"head":"b11cuq070_00050817_ae8383eb","shapes":2,"ips":49},"b11cun050_00040017_e873236c":{"head":"b11cun050_00040017_e873236c","shapes":4,"ips":728}},"user_agents":["Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)"],"timeline":[{"date":"2026-10-01","count":32}],"recent_events":[{"timestamp":"2026-10-01T17:55:17","port":5010,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5010\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/debug/default/view?panel=config","summary":"","payload_hex":"474554202f64656275672f64656661756c742f766965773f70616e656c3d636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a353031300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"e57348b1-d0b7-4ee6-ba76-dd40989a76b5","seq":1,"duration_ms":104,"bytes_in":200,"bytes_out":80},{"timestamp":"2026-10-01T17:55:16","port":5010,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5010\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/?rest_route=/wp/v2/users/","summary":"","payload_hex":"474554202f3f726573745f726f7574653d2f77702f76322f75736572732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353031300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"e68af363-1d0b-4e5f-b1da-6cc1094c9b68","seq":1,"duration_ms":113,"bytes_in":194,"bytes_out":80},{"timestamp":"2026-10-01T17:55:15","port":5010,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5010\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353031300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"6725a170-81ba-4b3e-8f16-1f4ff91e3907","seq":1,"duration_ms":101,"bytes_in":173,"bytes_out":80},{"timestamp":"2026-10-01T17:55:14","port":5010,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5010\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.vscode/sftp.json","summary":"","payload_hex":"474554202f2e7673636f64652f736674702e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a353031300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"814b0c99-6d45-4812-9dd0-76eb7b51bdf1","seq":1,"duration_ms":101,"bytes_in":186,"bytes_out":80},{"timestamp":"2026-10-01T17:55:13","port":5010,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5010\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/@vite/env","summary":"","payload_hex":"474554202f40766974652f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353031300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"8dd109f9-b387-4ffc-ab2a-77776e3a42ac","seq":1,"duration_ms":103,"bytes_in":178,"bytes_out":80},{"timestamp":"2026-10-01T17:55:12","port":5010,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5010\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/trace.axd","summary":"","payload_hex":"474554202f74726163652e61786420485454502f312e310d0a486f73743a20<HONEYPOT>3a353031300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"b13672a4-b493-47d8-9e93-f78f9e0f292f","seq":1,"duration_ms":105,"bytes_in":178,"bytes_out":80},{"timestamp":"2026-10-01T17:55:11","port":5010,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5010\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/actuator/env","summary":"","payload_hex":"474554202f6163747561746f722f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353031300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"1eefacc6-7470-4ced-a961-95aa991b4b7f","seq":1,"duration_ms":102,"bytes_in":181,"bytes_out":80},{"timestamp":"2026-10-01T17:55:10","port":5010,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5010\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a353031300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"0896c1ba-c86b-426e-890a-9b6be5118b6f","seq":1,"duration_ms":101,"bytes_in":193,"bytes_out":80},{"timestamp":"2026-10-01T17:55:09","port":5010,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5010\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/info.php","summary":"","payload_hex":"474554202f696e666f2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a353031300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"50a08a77-7ad1-4b58-8e2d-14030f1db7e0","seq":1,"duration_ms":164,"bytes_in":177,"bytes_out":80},{"timestamp":"2026-10-01T17:55:08","port":5010,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5010\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/telescope/requests","summary":"","payload_hex":"474554202f74656c6573636f70652f726571756573747320485454502f312e310d0a486f73743a20<HONEYPOT>3a353031300d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"93a22d7a-40b0-4ace-b7e7-28161cf3b29d","seq":1,"duration_ms":101,"bytes_in":187,"bytes_out":80}],"http_methods":[{"method":"GET","count":57},{"method":"POST","count":10},{"method":"OPTIONS","count":2}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":5,"ports":2},{"path":"/.DS_Store","count":2,"ports":2},{"path":"/telescope/requests","count":2,"ports":2},{"path":"/api","count":2,"ports":2},{"path":"/graphql","count":2,"ports":2},{"path":"/api/gql","count":2,"ports":2},{"path":"/about","count":2,"ports":2},{"path":"/@vite/env","count":2,"ports":2},{"path":"/console/","count":2,"ports":2},{"path":"/s/732323e27333e24393e23323/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties","count":2,"ports":2},{"path":"/trace.axd","count":2,"ports":2},{"path":"/server","count":2,"ports":2},{"path":"/config.json","count":2,"ports":2},{"path":"/graphql/api","count":2,"ports":2},{"path":"/server-status","count":2,"ports":2}],"distinct_paths_total":39,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:5010","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-27771","tag_type":"cve","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","reference_urls":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37290","https://github.com/go-gitea/gitea/pull/37610","https://orca.security/resources/blog/gitea-container-registry-vulnerability/"]}],"data_as_of":"2026-10-02T01:10:12.437991+00:00"}