{"ip":"159.65.144.72","total_events":63,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"leakix","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (leakix).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"12,917 bytes sent","bytes_sent":12917,"session_seconds":0,"persistent":false}},"first_seen":"2026-10-01T16:32:44","last_seen":"2026-10-04T12:25:18","events_24h":32,"events_7d":63,"geo":{"country_code":"IN","country_name":"India","region":"Karnataka","city":"Bengaluru","lat":12.9753,"lon":77.591,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"a579b68427.scan.leakix.org","known_scanners":["leakix","LeakIX"],"scanner_tag":{"key":"auto:leakix_org","label":"LeakIX","category":"commercial","url":"https://leakix.net"},"cve_matches":[{"cve_id":"CVE-2026-27771","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog"}],"malware":[],"top_ports":[{"port":5984,"proto":"tcp","label":"CouchDB","count":32},{"port":5017,"proto":"tcp","label":"","count":31}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131200_f57a46bbacb6_fb48f8b98a29","t13i131300_f57a46bbacb6_3b244d8fbcc8","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"1603010668010006640303098041139a8a7fe9c1664e8a86421efd14cbbabda81e2099af54b0072a42751120e15a56f2dc53cc0d77159752708f7e62bbecfc3ebec9cfef66586597f9b6cb12001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000601000b0002010000230000ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c086a0af98e073c8d523f764abf4eb5578a72899ba078fb9168a217266da3bf390775b1543c39b4ee4e550e51a5fcbd7c947d2c34ff2957a706cbb5b34708007dda19342b82144837562a369aaf99c6a2c5c60c0753fe039e3b00bc8b77ed692c1b55152c6133c68f51f7c5629afa8756347199a08b8b1e59bba87850e7543d5b19459d4181467ce88046b9697226f7702c8a4cb6db559992c4f9fa14bd99929d45833d4a2c79555657816abfa4a670a703138fb0fc3842d4d44cec070003b1cb47b464f28e3c12b665e3664b27e274d304b9eee009a964495ff5c9d8ab0606b1abbfaa60a75304e32709af93a80bfac1ab9c43cfca7864c7417d15500ec78475e5c7882574084b08b7dca3c2da8c1b8f87809cbc8f8421a54d3153af4bc926c99073a9a0f7b2b550b1c3ccba80d51c702f84613575bf73918bd363e72682c113aacee1c67fce381723cc6a5812ae117875548439ec7524c6132e9f1690bb2ae63275860f073a81961d28a34ed776f63c1bb7e2618813a6e2803c0ea1b8f6aa614a2a986bfe5c42e7322dcbcc428f3be818a78e537cdf4d89506703037015ffac02a73541219a00636480aba83af186717c8490ba2fc0dc8b66e729b14126051587427b7d10108ba7dafdb2cb020c37db617f8b587fb703d1711a0770688050a762833518284c4f2350d21eb713817ae60a31c12f8c518f66799b670a151209cfa5f516c67771237f3bb9de09389f8c1ce962412ed32ba903cac01779995f788245988beca553100a409305e81b39e792761df3c8002dcca61bb003616a4143b62c4b54d7e294774ba743e7aac3cd8c471e4bef4c415062898c4b434d7378dda172bdf8745acc66cc02a683d41b7b06a3eb47313ef151cec186361ec69a2971798b5137680c448390321b87bac668237d33ab55b3fb9e259bbc404acc27db8ea1963f02655935d012c7dad9b5cb7b86f4d93591ac68b3c4687b4c4b451a805a41c0840cb7e935c7b2c057ca9b1aad136662c8c62df35102625b8d4aa1e3c505e0011b0bb986c7878419efca262e59d1c8ccf9c7235829b64f0921e8258210035c128d3520de3bc58fc68c931bedea3100f93c448763b2914b9d2928e256192bf513565883064e81d67888881290b636398f8b86b2466897a93c89cc97ea19a0321b24e8200631783b27738129fa354c82b2dbb0974d8740cbbe2925b9c5e10c01ff9f098a7138ab0dc2ab1e875bd1c6773a8255f37c5c857ceafa679eb164ed2e0bf5a500da5c510ffc6a717f80cc537b97f113f1e144021f72b8ef76d7e3285e0587cfecaa789e6b6c9e4bd6417784533b2689320bdb2008f3b5eac4016f230cd8b5212c1d967b6b236e001d0e6965a07150d09029950bc32a0ba1b677b03541c3914ea6958d0c3a4cb6e21b9b34b6a8968010d36f3154d0950a1a9ba7bd41ec0c54191493fad3c52f792112c98902d55a2ffc31e73e9bc04ea9104f25289e39076d295b76119f9491624792a970b11c6f48804a6b257d8068cf0960a560e382203009c0b2cfc831a6a27a24b9f18b95831a48566a7808dc6200ec01ef0009ee5f083751033c04ab0319329a275cf56657ae289cb6e0a1d770954571c4c5a1594efdb354c1312abf7675ed4d986e5cacdfe259023908c8ed6cbd668f793b994e10cf09f746c4af94e3fc98085cc4367acebce595d6f8f3d5e4b6d04af3b0a046c001d00200cf09f746c4af94e3fc98085cc4367acebce595d6f8f3d5e4b6d04af3b0a046c002d0002010100290094006f006927b98c69a27e289aac1d92976eb694c448ec0ee347936e723068c0947c0c0959d3ae1545be90071521ff8b7fd612d4c3e0ad719c4a7827b4bde908eca44e42756a890669c331bb254e84d94600731903172918a992d14cbf3ee688fd4d09df9e452a6bb52e5a09e7112a389beb00212075a20e2e2a14df8c249ef4781a32b761dccf8069bc526223564643aaf3a79083","tls_ja3":["0d19b15a013ea9e1ae313614888f79f5","725543c78edf669194c11dc7a039b56e","37b3769f942aae0789e38e380a532088"],"http_akin":["b11cun030_00040011_c91eaf54","b11cuq070_00050817_ae8383eb","b11cun040_00040013_608dab68","b11cun050_00040017_e873236c"]},"fingerprint_peers":{"t13i131200_f57a46bbacb6_fb48f8b98a29":69,"t13i131300_f57a46bbacb6_3b244d8fbcc8":67,"t13i131000_f57a46bbacb6_ab7e3b40a677":4325,"b11cun030_00040011_c91eaf54":624,"b11cuq070_00050817_ae8383eb":70,"b11cun040_00040013_608dab68":4385,"b11cun050_00040017_e873236c":747},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":2,"ips":624},"b11cuq070_00050817_ae8383eb":{"head":"b11cuq070_00050817_ae8383eb","shapes":4,"ips":70},"b11cun050_00040017_e873236c":{"head":"b11cun050_00040017_e873236c","shapes":4,"ips":747}},"user_agents":["Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)"],"timeline":[{"date":"2026-10-01","count":31},{"date":"2026-10-04","count":32}],"recent_events":[{"timestamp":"2026-10-04T12:25:18","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/debug/default/view?panel=config","summary":"","payload_hex":"474554202f64656275672f64656661756c742f766965773f70616e656c3d636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"da7cce58-ae0b-4f3c-9713-5ed80db34bdc","seq":1,"duration_ms":108,"bytes_in":203,"bytes_out":78},{"timestamp":"2026-10-04T12:25:17","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/?rest_route=/wp/v2/users/","summary":"","payload_hex":"474554202f3f726573745f726f7574653d2f77702f76322f75736572732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"bb3aa1ea-217b-4c58-aed5-5c12b6ed0d35","seq":1,"duration_ms":102,"bytes_in":197,"bytes_out":78},{"timestamp":"2026-10-04T12:25:16","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"0a0a0f2d-9bb7-4965-b7e2-ed5efc86d9ea","seq":1,"duration_ms":105,"bytes_in":176,"bytes_out":78},{"timestamp":"2026-10-04T12:25:15","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.vscode/sftp.json","summary":"","payload_hex":"474554202f2e7673636f64652f736674702e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"f64e1066-0789-40b1-83f5-0ebf7849c9ee","seq":1,"duration_ms":101,"bytes_in":189,"bytes_out":78},{"timestamp":"2026-10-04T12:25:14","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/@vite/env","summary":"","payload_hex":"474554202f40766974652f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"e11199c4-eb7f-457f-9bdc-79947e957a94","seq":1,"duration_ms":115,"bytes_in":181,"bytes_out":78},{"timestamp":"2026-10-04T12:25:13","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/trace.axd","summary":"","payload_hex":"474554202f74726163652e61786420485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"1fe43f27-f6a5-4e6c-8010-49288ed8a499","seq":1,"duration_ms":102,"bytes_in":181,"bytes_out":78},{"timestamp":"2026-10-04T12:25:12","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/actuator/env","summary":"","payload_hex":"474554202f6163747561746f722f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"4bacaf36-424c-4028-a458-ec6a0ac3ddfa","seq":1,"duration_ms":115,"bytes_in":184,"bytes_out":78},{"timestamp":"2026-10-04T12:25:11","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"0551e070-6bd4-4480-8f0e-cf614a10b64a","seq":1,"duration_ms":101,"bytes_in":196,"bytes_out":78},{"timestamp":"2026-10-04T12:25:10","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/info.php","summary":"","payload_hex":"474554202f696e666f2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"0b0094f7-a724-46dc-8584-18af04664285","seq":1,"duration_ms":130,"bytes_in":180,"bytes_out":78},{"timestamp":"2026-10-04T12:25:09","port":5984,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5984\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/telescope/requests","summary":"","payload_hex":"474554202f74656c6573636f70652f726571756573747320485454502f312e310d0a486f73743a20<HONEYPOT>3a353938340d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"46430a39-88c3-4fff-927e-c0511382ef7c","seq":1,"duration_ms":129,"bytes_in":190,"bytes_out":78}],"http_methods":[{"method":"GET","count":47},{"method":"POST","count":10},{"method":"OPTIONS","count":2}],"distinct_ports_total":2,"top_paths":[{"path":"/","count":6,"ports":2},{"path":"/actuator/env","count":2,"ports":2},{"path":"/___proxy_subdomain_whm/login","count":2,"ports":2},{"path":"/api","count":2,"ports":2},{"path":"/graphql","count":2,"ports":2},{"path":"/api/gql","count":2,"ports":2},{"path":"/about","count":2,"ports":2},{"path":"/@vite/env","count":2,"ports":2},{"path":"/server","count":2,"ports":2},{"path":"/trace.axd","count":2,"ports":2},{"path":"/config.json","count":2,"ports":2},{"path":"/graphql/api","count":2,"ports":2},{"path":"/server-status","count":2,"ports":2},{"path":"/info.php","count":2,"ports":2},{"path":"/.env","count":2,"ports":2}],"distinct_paths_total":28,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:5984","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-27771","tag_type":"cve","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","reference_urls":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37290","https://github.com/go-gitea/gitea/pull/37610","https://orca.security/resources/blog/gitea-container-registry-vulnerability/"]}],"data_as_of":"2026-10-04T20:29:50.409213+00:00"}