{"ip":"159.89.174.87","total_events":248,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"leakix","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (leakix).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"26,170 bytes sent","bytes_sent":26170,"session_seconds":0,"persistent":false}},"first_seen":"2026-04-22T09:58:27","last_seen":"2026-10-02T18:15:19","events_24h":64,"events_7d":128,"geo":{"country_code":"IN","country_name":"India","region":"Karnataka","city":"Bengaluru","lat":12.9753,"lon":77.591,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"f8fb72f228.scan.leakix.org","known_scanners":["leakix","LeakIX"],"scanner_tag":{"key":"auto:leakix_org","label":"LeakIX","category":"commercial","url":"https://leakix.net"},"cve_matches":[{"cve_id":"CVE-2026-27771","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog"}],"malware":[],"top_ports":[{"port":6088,"proto":"tcp","label":"","count":42},{"port":9222,"proto":"tcp","label":"","count":40},{"port":9162,"proto":"tcp","label":"","count":38},{"port":5015,"proto":"tcp","label":"","count":32},{"port":5007,"proto":"tcp","label":"","count":32},{"port":84,"proto":"tcp","label":"","count":32},{"port":2031,"proto":"tcp","label":"","count":32}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131300_f57a46bbacb6_3b244d8fbcc8","t13i131200_f57a46bbacb6_fb48f8b98a29","t13i131000_f57a46bbacb6_e5728521abd4","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"16030106680100066403036ff7b495cd5507e4d39bf7c6cfd5fd6e8656dc316f4174bf96baecff8b5b0e32208144b661d11ccb4d87b3b2aba0fca5b79ac6f2856118326105a84b0346982c6f001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000601000b0002010000230000ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c090ec75e9333c33c75b0789c2b17b601e58c8628cc4ab798d3901658d538542271be7845f8e2028d0f0aaf923c08485c4d874c86a741c9bf9652de173cbe8bb67d231c2672f4678559a07881a75b503075eae09c73c27c6ce216d05d20a585254bc61b03a924cb834c45e7822ea7159dae449b3d68602447a2e19703fdbb45fb73c6fe54e820b75f928405ea76539bb1c53a5cd9cb21130874a42930042f238f6998468da30e904b7646cbadba4c15d1a181d6520338c4f56a4602e64816fe9c51c00961a9c8c44f40959d2ce72f30a71f214f8c206ca99c94646a6e838bea4814c21e224084288e4d97c12260beb9458b6e6735e5b443cb90697a54f0ebb9c90c29748b26a88db993da8bfd9e9cc0c09beb5a154ec395c35597fdceb608cbb20eed5ac63c50f6c015fc8131db146ceb2a36dbb4b95a1f26a69a0632134bd4545726e90c3d35313af647bcc825a172c35a9257b33148c868c325f446ba8bc10105339bb60baf30c0f8532a217b61c83d8692ffa07dfc9c23131a7f6f81221c0a59a54c1bd9339d3994e29d1c5aa278feecc579e1a228c660ff710c82c31138c2a6685804753983992973f66573403d46845f514d50a81c4ca27bf7369cd259192293883f302b72b76ec38222f206911c9c2bf4b317c661b47958c633a6fe1e14778f9ace8490e34a6bc2bd9187c83464c5b738f3c494ff36eeb086752586f7cebca333329866819d6b666e7ec5b0eb8cda73c22153903d1b319182a7663c1272fa836f6579ea516b914a58ce3f46886881de161202c429be0aa154bca4d61f0c896e5a0ff8a9e7ea3cc29f941517387d31a1e93fc4db8434f3ca66f399884446381e4629add14aaaa413a03285f08b6081f3862deca3a9ce7b353a318c1aa396b42856d4168f5c74338b1b33de624a656ca97a66f59ccb6dd1537fcc9ac3fc6a43585ae55d5708a0a7def1346249b71a8328d48c9cb490977985c1b72767437f05fa0627638066c4f30410a35a203e1487c1139de105488143e860a550b5038ca1b7629c33e2e28b751582073dc23e888aea30019211cc9a1c6c23511bd79769e7e6a7e83d08cc2140b382a953eb24d1ebb4c30702e3bc3b54192a208b394faa9b2e3323314665573fb06c40245d0e656101c8bcbb5a0dc3669af74be96c142f43970098452fd59cb8434b723874f13200118351998555f9e2cc79f134f666717f7879019f5c00e70cbbfc1751c5542c5e79192844f4b6c085deb46cb097115f76e8a03778e19cd74a6b513f850ed8ac7f4bcb21e002948a5566f790bbba80df622affb45642ad10d02d4454ef5cf4e27920ed41cb8faaf44eb05fe568bc3867677350472c3b0087aa22c0715cda8ce16f1ae65f10ec710c15fe86f8947717de3223e94789f4a253645b8cd5c58db72944a017352352870437ae8863bbbcbaef6705536283b55aa1179b89257602cf3cb8f5739c5ea6385e70b0890f3c620e855ea43caef27ab6041c1b2209555a62a681557d02b52288009ae65513fd31c26d78147f55478993865f73f06f5bb9080b4dbea97eec403716672d8764772a35a32cb4855f17f4d5bc6973b0f99e826afa7603bd30d57d52124947f02a13e7a73456a214e5679bde63b40c4d0548d95c2cf374c9fa22d28e162497711b57f1e012f8e4cb58314f3310ade91a71c3dd53c86d8e40b9ccf07dfe49e0c11a96c2ad15d001d00208e4cb58314f3310ade91a71c3dd53c86d8e40b9ccf07dfe49e0c11a96c2ad15d002d0002010100290094006f006915270613cba35c9760d759879f9b5349d4ac77dcc1b0913cec70db2a44d9d2f262fe5038e83fb1a6b3d1ac3a9342968defe2dbf0f8ef4f8cd4482011aac78ad32bebe7fb73f9b289cee50c1331fc8fb3bb86563eb72b8829a61c04d6c91e7a35215b2445c6257ba614fea63dc4002120c8d97e6fd86ac73a3320611a35378a39dd817dafe33555d70d28cc9c1dc61a2c","tls_ja3":["0d19b15a013ea9e1ae313614888f79f5","725543c78edf669194c11dc7a039b56e","37b3769f942aae0789e38e380a532088"],"http_akin":["b11cun030_00040011_c91eaf54","b11cuq070_00050817_ae8383eb","b11cun040_00040013_608dab68","b11cun050_00040017_e873236c"]},"fingerprint_peers":{"t13i131300_f57a46bbacb6_3b244d8fbcc8":61,"t13i131200_f57a46bbacb6_fb48f8b98a29":64,"t13i131000_f57a46bbacb6_e5728521abd4":59,"b11cun030_00040011_c91eaf54":597,"b11cuq070_00050817_ae8383eb":64,"b11cun040_00040013_608dab68":4399,"b11cun050_00040017_e873236c":738,"t13i131000_f57a46bbacb6_ab7e3b40a677":4642},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":4,"ips":597},"b11cuq070_00050817_ae8383eb":{"head":"b11cuq070_00050817_ae8383eb","shapes":4,"ips":64},"b11cun050_00040017_e873236c":{"head":"b11cun050_00040017_e873236c","shapes":5,"ips":739}},"user_agents":["Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)","Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)"],"timeline":[{"date":"2026-10-01","count":64},{"date":"2026-10-02","count":64}],"recent_events":[{"timestamp":"2026-10-02T18:15:19","port":5007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5007\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/debug/default/view?panel=config","summary":"","payload_hex":"474554202f64656275672f64656661756c742f766965773f70616e656c3d636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a353030370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e36333433313365323833313331336532333365323233393331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"f2edd268-f280-42c2-a0e7-5100964734f1","seq":1,"duration_ms":100,"bytes_in":203,"bytes_out":78},{"timestamp":"2026-10-02T18:15:18","port":5007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5007\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/?rest_route=/wp/v2/users/","summary":"","payload_hex":"474554202f3f726573745f726f7574653d2f77702f76322f75736572732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e36333433313365323833313331336532333365323233393331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"0c3a4c41-0dc6-446a-958e-b9186b51b924","seq":1,"duration_ms":100,"bytes_in":197,"bytes_out":78},{"timestamp":"2026-10-02T18:15:17","port":5007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5007\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e36333433313365323833313331336532333365323233393331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"402a586d-4552-4502-bff7-39b4a9acbd29","seq":1,"duration_ms":100,"bytes_in":176,"bytes_out":78},{"timestamp":"2026-10-02T18:15:16","port":5007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5007\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.vscode/sftp.json","summary":"","payload_hex":"474554202f2e7673636f64652f736674702e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a353030370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e36333433313365323833313331336532333365323233393331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"ac907599-67c2-48b8-8aeb-eee8de8448f4","seq":1,"duration_ms":100,"bytes_in":189,"bytes_out":78},{"timestamp":"2026-10-02T18:15:15","port":5007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5007\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/@vite/env","summary":"","payload_hex":"474554202f40766974652f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353030370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e36333433313365323833313331336532333365323233393331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"26b99a70-dc73-4fd3-b249-d6ccfd061430","seq":1,"duration_ms":102,"bytes_in":181,"bytes_out":78},{"timestamp":"2026-10-02T18:15:14","port":5007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5007\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/trace.axd","summary":"","payload_hex":"474554202f74726163652e61786420485454502f312e310d0a486f73743a20<HONEYPOT>3a353030370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e36333433313365323833313331336532333365323233393331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"8dee884c-d56d-4f9a-a328-b0f411e1754d","seq":1,"duration_ms":100,"bytes_in":181,"bytes_out":78},{"timestamp":"2026-10-02T18:15:13","port":5007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5007\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/actuator/env","summary":"","payload_hex":"474554202f6163747561746f722f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a353030370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e36333433313365323833313331336532333365323233393331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"4897db24-5f9d-45dc-aaf5-d02138d08551","seq":1,"duration_ms":101,"bytes_in":184,"bytes_out":78},{"timestamp":"2026-10-02T18:15:12","port":5007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5007\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a353030370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e36333433313365323833313331336532333365323233393331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"9c82a1f1-f658-4809-8314-8432eea39716","seq":1,"duration_ms":102,"bytes_in":196,"bytes_out":78},{"timestamp":"2026-10-02T18:15:11","port":5007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5007\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/info.php","summary":"","payload_hex":"474554202f696e666f2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a353030370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e36333433313365323833313331336532333365323233393331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"82971bba-a326-4af7-97f3-93892d0c2782","seq":1,"duration_ms":100,"bytes_in":180,"bytes_out":78},{"timestamp":"2026-10-02T18:15:10","port":5007,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:5007\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/telescope/requests","summary":"","payload_hex":"474554202f74656c6573636f70652f726571756573747320485454502f312e310d0a486f73743a20<HONEYPOT>3a353030370d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e36333433313365323833313331336532333365323233393331333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"ccd8f030-f494-4599-8b79-b6ed8776002b","seq":1,"duration_ms":153,"bytes_in":190,"bytes_out":78}],"http_methods":[{"method":"GET","count":193},{"method":"POST","count":34},{"method":"OPTIONS","count":7}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":19,"ports":7},{"path":"/v2/_catalog","count":7,"ports":7},{"path":"/ecp/Current/exporttool/microsoft.exchange.ediscovery.exporttool.application","count":7,"ports":7},{"path":"/api","count":7,"ports":7},{"path":"/graphql","count":7,"ports":7},{"path":"/api/gql","count":7,"ports":7},{"path":"/about","count":7,"ports":7},{"path":"/@vite/env","count":7,"ports":7},{"path":"/console/","count":7,"ports":7},{"path":"/telescope/requests","count":7,"ports":7},{"path":"/trace.axd","count":7,"ports":7},{"path":"/server","count":7,"ports":7},{"path":"/config.json","count":7,"ports":7},{"path":"/.well-known/security.txt","count":7,"ports":7},{"path":"/server-status","count":7,"ports":7}],"distinct_paths_total":40,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:5007","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (l9scan/2.0.634313e2831313e233e2239313; +https://leakix.net)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-27771","tag_type":"cve","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","reference_urls":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37290","https://github.com/go-gitea/gitea/pull/37610","https://orca.security/resources/blog/gitea-container-registry-vulnerability/"]}],"data_as_of":"2026-10-02T21:48:01.796682+00:00"}