{"ip":"157.245.36.108","total_events":161,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"leakix","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (leakix).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"32,690 bytes sent","bytes_sent":32690,"session_seconds":0,"persistent":false}},"first_seen":"2026-10-01T11:03:35","last_seen":"2026-10-04T07:50:35","events_24h":95,"events_7d":161,"geo":{"country_code":"GB","country_name":"United Kingdom","region":"England","city":"Slough","lat":51.5177,"lon":-0.6215,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"a93200c42e.scan.leakix.org","known_scanners":["leakix","LeakIX"],"scanner_tag":{"key":"auto:leakix_org","label":"LeakIX","category":"commercial","url":"https://leakix.net"},"cve_matches":[{"cve_id":"CVE-2026-27771","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog"}],"malware":[],"top_ports":[{"port":5984,"proto":"tcp","label":"CouchDB","count":32},{"port":8000,"proto":"tcp","label":"HTTP-alt","count":32},{"port":5002,"proto":"tcp","label":"","count":32},{"port":8983,"proto":"tcp","label":"Solr","count":32},{"port":8111,"proto":"tcp","label":"","count":31},{"port":21,"proto":"tcp","label":"FTP","count":2}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131200_f57a46bbacb6_fb48f8b98a29","t13i131300_f57a46bbacb6_3b244d8fbcc8","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"1603010668010006640303b52acde6782feea25c07666673ca3f01f85c21937ecf48b32a9dd0958b6f5c8620d6934fa8af1d0527237f960ac072319a6463cbcb6cf72e0f854f50ef477468b3001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000601000b0002010000230000ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c06cc09fe7d7ca6d174acf301ce08b07cd78785ae810840b37e4f44be7639e1bc1c1c503c5cfc261f396134e42345a3ccaa61601f696521434ca9283c196827045ecc65699c3d4b3b99b3c9347c447051ba99f7b8db06675baf1003a8c40258073f40a9835b9509d36205e434d8ba1526da02816185973963ff6c39ca22c2aeef8c55b0a1219d996b927b91229850f7cb0a2199badf373f8c184a2bc9213a937788b4b413164ed128d2cd663c89190be5206adca6f02448b63619af61c20d69058c0604851b4879490bc20f5bdadf73afbd73fd890c45b55bb32677f1ed4134016c09a7b22e06c8cfea0153bd7958d1353d4e14f2486923e70c8171094d6a5910b8b4633099ff16bb2d8cb4a79d91fe9d0980fab843471c033f29a69451d741610eda0953f37624c80a23c079e75734a97d8c9783652d6822ab4d75e68ca2630a7bb2546a2299b3301032cf6fc5c99120f9522aa31917f3007aeab944fdac0ba5f3c0b205183c4454f5d4a511b18b02c6521a38a045b1599d2d3a91d66a5d63cc7552a9eece555c2212060e19ed530ba79a070453ac7207c1b756540826582b20cc8fda106e84b753f7aa67db300c686aee6b369e82062a36c7795913831d009c2504fd8599ec04801db3a0756e20e3365272ea328d9e91038885b03e661d9010940290d3053076adc1ed2c4073f7188febcb48d689af3122f5eb31d1c7313c2a997761417b7e21798a05f96960108c468b8188c8cfa7b3caa8312e78daa0cb4a3393cb1d61ba053965d4247bb664588a732d0808352c74a92b515401aba93c2ad1de1117d5c85ef9136e4c904a27b2519690938139f7fd69ca0947c24ba43e2c3884cc891e17a8d2cf876b134287a2a9c51f1bf4cec090ac4138492a3e3367978a1811ff0675cd179beb85d54b6c818cc1ff4911c606729b2bacc0818a3008b45db850c5e8a6916a71e3b192df4228b8e754e29b43b37f177b6236900fa73a82538a403c57b851836f163f4ec9d9d359a52983612c05e2007ca5e817e1c9aae885bcabf5a663b3581a8e0ad08a6bb1f17a371221dc1a30e02949bda74bd6dc93830f5a3e90b4e2c01b5167c18042a422bc1a273937358a9c275687147f1061ad2cdfc01398525719b247bc8f607c1db5ba250534ff91dc43c563fdc2cd8426a90035213cb2fa64a1c1793a0f62aaca905835ef2b36a2471d78909a7894a96168510704ee072a456691ddc82b4435c254f69be88f352e18ba9d4577728fbc182d88916a3c2b8d843928268190ab1a502544d56732e714c83ec42c5480cac32750be5ab59a7bff0d328c92b4c31c58c1d82303a11b7e1b40201c80aa784bd095c3620a9ba17e307df95596cc448906463cb83435d3a00643269773640e7543867bb74cb7479961c6b5e20b06306bfef633c98a75ba5f972660a5cfd399ffe936ac76c52f273c224e740dd0a1168f4605b102fbf0379390123c255cebc84b39ddab248794389b7628b08154b601677094d1418a1d65907659c4df1d46d42c01010c1143a19cf88c10a75b257cdf69e1679a719b11d8ee3863f616ac0b63ae1a3366926a72eeba9ac08244af72562ea4b33f275c7ec45970410f7423ddcd60bd4589148cd1927e5b6376f32689099c76a53dd21c2b484f556c506273483a8945050f05902868054568a05bb4e712044621d33d68de14f575d3c91c36b928b8ddc4137001d00205902868054568a05bb4e712044621d33d68de14f575d3c91c36b928b8ddc4137002d0002010100290094006f00696674f8be77f52a639bf0bfe98cf77187d6334502f31226af53903791c503a65902876346b41ba85f193538265e15c9817f289c11281719bb7d48384fc178204b11ff3f0b6ddf848845669099a1b4c00559cf833980a3d89e8bbf677ab2d7ece09d4c000b3b52dcef985469cd44002120e7b3727b245b5b74757d69b074efdc94c5823a7d21d633539fb755dd5de27cd0","tls_ja3":["0d19b15a013ea9e1ae313614888f79f5","725543c78edf669194c11dc7a039b56e","37b3769f942aae0789e38e380a532088"],"http_akin":["b11cun030_00040011_c91eaf54","b11cuq070_00050817_ae8383eb","b11cun040_00040013_608dab68","b11cun050_00040017_e873236c"]},"fingerprint_peers":{"t13i131200_f57a46bbacb6_fb48f8b98a29":69,"t13i131300_f57a46bbacb6_3b244d8fbcc8":67,"t13i131000_f57a46bbacb6_ab7e3b40a677":4362,"b11cun030_00040011_c91eaf54":625,"b11cuq070_00050817_ae8383eb":69,"b11cun040_00040013_608dab68":4397,"b11cun050_00040017_e873236c":743},"akin_families":{"b11cuq070_00050817_ae8383eb":{"head":"b11cuq070_00050817_ae8383eb","shapes":4,"ips":69},"b11cun050_00040017_e873236c":{"head":"b11cun050_00040017_e873236c","shapes":4,"ips":743}},"user_agents":["Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)","Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)","Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)"],"timeline":[{"date":"2026-10-01","count":32},{"date":"2026-10-02","count":2},{"date":"2026-10-03","count":95},{"date":"2026-10-04","count":32}],"recent_events":[{"timestamp":"2026-10-04T07:50:35","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/debug/default/view?panel=config","summary":"","payload_hex":"474554202f64656275672f64656661756c742f766965773f70616e656c3d636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e313330333233653231333833653238333233323365323533383331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"4a419640-1b20-4a9b-8830-8315811a44f0","seq":1,"duration_ms":101,"bytes_in":206,"bytes_out":79},{"timestamp":"2026-10-04T07:50:34","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/?rest_route=/wp/v2/users/","summary":"","payload_hex":"474554202f3f726573745f726f7574653d2f77702f76322f75736572732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e313330333233653231333833653238333233323365323533383331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"e8ff0a92-c3ba-43ee-be54-87f44554481d","seq":1,"duration_ms":103,"bytes_in":200,"bytes_out":79},{"timestamp":"2026-10-04T07:50:33","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e313330333233653231333833653238333233323365323533383331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"c97a6273-6999-410b-b42a-28dfad731d6f","seq":1,"duration_ms":100,"bytes_in":179,"bytes_out":79},{"timestamp":"2026-10-04T07:50:32","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.vscode/sftp.json","summary":"","payload_hex":"474554202f2e7673636f64652f736674702e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e313330333233653231333833653238333233323365323533383331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"f6634cad-0624-4f79-8158-6c788c87a1e6","seq":1,"duration_ms":115,"bytes_in":192,"bytes_out":79},{"timestamp":"2026-10-04T07:50:31","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/@vite/env","summary":"","payload_hex":"474554202f40766974652f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e313330333233653231333833653238333233323365323533383331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"768b2ca2-0e65-47bb-b6c3-d67fbd0cd0a4","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":79},{"timestamp":"2026-10-04T07:50:30","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/trace.axd","summary":"","payload_hex":"474554202f74726163652e61786420485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e313330333233653231333833653238333233323365323533383331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"3fd29445-d8cf-40d9-b610-4e6b2ba1b987","seq":1,"duration_ms":102,"bytes_in":184,"bytes_out":79},{"timestamp":"2026-10-04T07:50:29","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/actuator/env","summary":"","payload_hex":"474554202f6163747561746f722f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e313330333233653231333833653238333233323365323533383331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"2e94da91-f487-4dfb-8ac8-3180fa7f8bea","seq":1,"duration_ms":100,"bytes_in":187,"bytes_out":79},{"timestamp":"2026-10-04T07:50:28","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e313330333233653231333833653238333233323365323533383331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"d18ac1cd-ecf1-4019-9f42-03e71cf861e3","seq":1,"duration_ms":103,"bytes_in":199,"bytes_out":79},{"timestamp":"2026-10-04T07:50:27","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/info.php","summary":"","payload_hex":"474554202f696e666f2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e313330333233653231333833653238333233323365323533383331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"2a29bc3d-3d36-4fec-8f76-0653eb8860a3","seq":1,"duration_ms":100,"bytes_in":183,"bytes_out":79},{"timestamp":"2026-10-04T07:50:26","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/telescope/requests","summary":"","payload_hex":"474554202f74656c6573636f70652f726571756573747320485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e313330333233653231333833653238333233323365323533383331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"9eca6840-f759-43d5-949c-c6d3a3f904b0","seq":1,"duration_ms":100,"bytes_in":193,"bytes_out":79}],"http_methods":[{"method":"GET","count":120},{"method":"POST","count":25},{"method":"OPTIONS","count":5}],"distinct_ports_total":6,"top_paths":[{"path":"/","count":16,"ports":6},{"path":"/.DS_Store","count":5,"ports":5},{"path":"/debug/default/view?panel=config","count":5,"ports":5},{"path":"/api","count":5,"ports":5},{"path":"/graphql","count":5,"ports":5},{"path":"/api/gql","count":5,"ports":5},{"path":"/about","count":5,"ports":5},{"path":"/@vite/env","count":5,"ports":5},{"path":"/console/","count":5,"ports":5},{"path":"/server","count":5,"ports":5},{"path":"/config.json","count":5,"ports":5},{"path":"/graphql/api","count":5,"ports":5},{"path":"/server-status","count":5,"ports":5},{"path":"/info.php","count":5,"ports":5},{"path":"/actuator/env","count":5,"ports":5}],"distinct_paths_total":30,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:5984","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-27771","tag_type":"cve","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","reference_urls":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37290","https://github.com/go-gitea/gitea/pull/37610","https://orca.security/resources/blog/gitea-container-registry-vulnerability/"]}],"data_as_of":"2026-10-04T15:23:49.623848+00:00"}