{"ip":"165.227.173.41","total_events":243,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"leakix","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (leakix).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"32,485 bytes sent","bytes_sent":32485,"session_seconds":1,"persistent":false}},"first_seen":"2026-04-30T17:48:10","last_seen":"2026-10-05T08:48:34","events_24h":32,"events_7d":160,"geo":{"country_code":"DE","country_name":"Germany","region":"Hesse","city":"Frankfurt am Main","lat":50.1169,"lon":8.6837,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"d559d155e9.scan.leakix.org","known_scanners":["leakix","LeakIX"],"scanner_tag":{"key":"auto:leakix_org","label":"LeakIX","category":"commercial","url":"https://leakix.net"},"cve_matches":[{"cve_id":"CVE-2026-27771","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog"}],"malware":[],"udp":null,"top_ports":[{"port":6085,"proto":"tcp","label":"","count":42},{"port":8609,"proto":"tcp","label":"","count":41},{"port":8081,"proto":"tcp","label":"","count":32},{"port":82,"proto":"tcp","label":"","count":32},{"port":4532,"proto":"tcp","label":"","count":32},{"port":86,"proto":"tcp","label":"","count":32},{"port":5017,"proto":"tcp","label":"","count":32}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131200_f57a46bbacb6_1bd98dace775","t13i131300_f57a46bbacb6_47d1ff9c9a84","t13i131200_f57a46bbacb6_fb48f8b98a29","t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"160301066801000664030346e53cd479bbb44c568ac1b0297f51bc3c4c5c861387c9c76f014c891a67ba0420920afe6e65faab52b246cb94d4c2f47cc6a35c65b55c1fe713c9a28c699155ce001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000601000b0002010000230000ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c09949b2793b185d919eab84788f1172f0180953621faea4bcfe15a3a27184549b47dd990abb88151e2b6ccd4691342565bf8464137758cb40cf05912dd2888d6dfa95adc26224e785d019c579e736504758eb87b051b9533cc7533d27cc8436970c54319fb506faa7cdf8917574f3bc627936931b519c664a78a237b9089bf0f5541ef2a8f2d10c15a8824475c2d398c92099961248b040c479b8fa5a4c1241c7b74304d21e87b87a9bac6806428ffabc88debc645526b18e40c7c1314b4071918ab31458db8e4d9594d627cefddb12801c466dc1b761252fa5f58064a443d559cdb24c326d2248d55826934a79edeb1d37008c078c685b4977cba38537cab8988445591796be4b17b97b1b8bd87ac601932a596a03bb82039b3188d981996c4287849ca9e5639e25200b88b1fc779eece8c2bb430b42d20c7eeabfd2f36fa225594c482a56859524c48c7f9100c568497cea09fda5a44114af5150ca32b524e89820efa3bdb540384388605a9c1d3bc472da83797880cee5b8c9ecc43f5a3134857850a22c4bfe8a7e9baa9a6867ce1b286aae335948868826399a3edb2d58a87ebf803e9a6c769fa87d7c256de4b3443b13ce97eb793b5ab924f541ca4819e1b632b700b802f64ce931390cf541867c88fde402ea001d8d0b1868f07c02f62333513e89ea0d1412642de16069f793a6a635c7231858ccb4dc22a601528e3929936532a39f7096109ca4c1798c26ba1dd0f41a16d17df12c0f375261307859ad9a20e410498ad26ef33ca73b188fcca38a136c36539911f080c3bc630dcd72752c7a312ef43c4c558ae9e64ed5471544c9414af0339f2953742889bbc8a2b5c8acbd28b577e958cc15a2cac190545795c02412d6061f700c6d12d9ce3776419f9c9a4a860a6b7625a8b79a9cc690ae2022f85968886aa02e8186191cca08a5319d0c5349ea5977b4841fc9a084cb576265cf381a003a6c44309a73346291c4e01da8711ed91379d1ec1f813853bdb47bcea0276777cb29d315a0b4c8ea0aadca912a0af883b9765b29873bf904a12c7802af2294b54ca03602137f17637db447129b7c0353028b00811a6961f1929aadec091c101a7e781fe9a9778db26522aab91097910c902346384738359fa6ab1ce39212741298731c656599c9a71acfc8b9a368dabf9406407f69c016fa9de9077bd1709f84fa6ecc6b7359b19f7bb96de74b02a9130f543b5477d48040912d835350a6304b9e869e2da1024486703b41bd3aaa839bcb913544a4923bbf9e9b88e501a6bc64952fd649003b2567eabbc7246b8b10b0cc77b025ba90050a45708117d89498c9b4c733629aca06c09c06398a77b3b2787a1c827efcb84160911caa1687bda56d08c102b48a727488a9bb611cf4720daf0689dab67dfedb272f72208d4ca21ea6bec7402bab456188139d31394621505d88f68b71fc33997a17f1a72baaa99f557510b161098fa58876d943e8025f43062737c6c38df17964e3ba96b93a66c23a0f2ba71d28b031b4b7c3a91a7c780d14006327a22256e55499a76784e91301d7a7299909620112d3cb336a730ac20409779b0c28ea4f99380012c60436b29bc80c93e7e8ac8a5ca581279d86a82f2bd5838586e672536c8101efe0e32aeaad489c0db3966867905ec6c480360f6ad5f7c413be1ca4650d40b9ecf2a500044f8441f9e9e534b1afa544bf1b001d0020360f6ad5f7c413be1ca4650d40b9ecf2a500044f8441f9e9e534b1afa544bf1b002d0002010100290094006f0069364405de7b439dc1268d4065023e114d7294cb6a42afd67eaece128d464b4f7f1582a0b13cde9c10cb40e149c49b72919c53f096da97a78b70ae8082afec82a4b44911b6e43acec6f0012cf3b00dfc937e10ff6e206f111a99d1627d3b229dcdaf6702e16063d3529fbb9c99d4002120fe0d8005a52ed3301508453acfc81d7be343ddc648096bf19f8faad51352f11a","tls_ja3":["0d19b15a013ea9e1ae313614888f79f5","725543c78edf669194c11dc7a039b56e","37b3769f942aae0789e38e380a532088"],"http_akin":["b11cun030_00040011_c91eaf54","b11cuq070_00050817_ae8383eb","b11cun040_00040013_608dab68","b11cun050_00040017_e873236c"]},"fingerprint_peers":{"t13i131200_f57a46bbacb6_1bd98dace775":13,"t13i131300_f57a46bbacb6_47d1ff9c9a84":0,"t13i131200_f57a46bbacb6_fb48f8b98a29":72,"t13i131000_f57a46bbacb6_e5728521abd4":56,"b11cun030_00040011_c91eaf54":638,"b11cuq070_00050817_ae8383eb":73,"b11cun040_00040013_608dab68":4397,"b11cun050_00040017_e873236c":751},"akin_families":{"b11cuq070_00050817_ae8383eb":{"head":"b11cuq070_00050817_ae8383eb","shapes":4,"ips":73},"b11cun050_00040017_e873236c":{"head":"b11cun050_00040017_e873236c","shapes":3,"ips":751}},"user_agents":["Mozilla/5.0 (l9scan/2.0.134313e26333e24393e23323; +https://leakix.net)","Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)"],"timeline":[{"date":"2026-10-02","count":32},{"date":"2026-10-03","count":64},{"date":"2026-10-04","count":32},{"date":"2026-10-05","count":32}],"recent_events":[{"timestamp":"2026-10-05T08:48:34","port":86,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:86\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/debug/default/view?panel=config","summary":"","payload_hex":"474554202f64656275672f64656661756c742f766965773f70616e656c3d636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a38360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"9d814b11-a1ca-49ff-b67d-625877414463","seq":1,"duration_ms":101,"bytes_in":198,"bytes_out":79},{"timestamp":"2026-10-05T08:48:33","port":86,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:86\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/?rest_route=/wp/v2/users/","summary":"","payload_hex":"474554202f3f726573745f726f7574653d2f77702f76322f75736572732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"bef22b5c-b047-42da-b32a-d60b9ec7d8d0","seq":1,"duration_ms":101,"bytes_in":192,"bytes_out":79},{"timestamp":"2026-10-05T08:48:32","port":86,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:86\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a38360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"7555f104-a516-4903-886e-584383b6feae","seq":1,"duration_ms":104,"bytes_in":171,"bytes_out":79},{"timestamp":"2026-10-05T08:48:31","port":86,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:86\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.vscode/sftp.json","summary":"","payload_hex":"474554202f2e7673636f64652f736674702e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a38360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"c4d621c4-83a3-4917-9165-308394b96949","seq":1,"duration_ms":100,"bytes_in":184,"bytes_out":79},{"timestamp":"2026-10-05T08:48:30","port":86,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:86\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/@vite/env","summary":"","payload_hex":"474554202f40766974652f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a38360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"e76a2de0-1239-4f26-b0e1-3ab8ad4020ce","seq":1,"duration_ms":101,"bytes_in":176,"bytes_out":79},{"timestamp":"2026-10-05T08:48:29","port":86,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:86\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/trace.axd","summary":"","payload_hex":"474554202f74726163652e61786420485454502f312e310d0a486f73743a20<HONEYPOT>3a38360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"73b60a02-96a0-43ca-9579-0820807802d5","seq":1,"duration_ms":100,"bytes_in":176,"bytes_out":79},{"timestamp":"2026-10-05T08:48:28","port":86,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:86\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/actuator/env","summary":"","payload_hex":"474554202f6163747561746f722f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a38360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"4439b934-a787-4d6f-b2d2-51f01884f52e","seq":1,"duration_ms":101,"bytes_in":179,"bytes_out":79},{"timestamp":"2026-10-05T08:48:27","port":86,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:86\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a38360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"18ceea39-f4da-4162-b84f-51c235980bb1","seq":1,"duration_ms":101,"bytes_in":191,"bytes_out":79},{"timestamp":"2026-10-05T08:48:26","port":86,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:86\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/info.php","summary":"","payload_hex":"474554202f696e666f2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a38360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"3442ac91-45d3-4a08-8b24-fc62e43acef1","seq":1,"duration_ms":105,"bytes_in":175,"bytes_out":79},{"timestamp":"2026-10-05T08:48:25","port":86,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:86\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/telescope/requests","summary":"","payload_hex":"474554202f74656c6573636f70652f726571756573747320485454502f312e310d0a486f73743a20<HONEYPOT>3a38360d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"774b371f-62f0-4632-91ed-5df108c6a581","seq":1,"duration_ms":100,"bytes_in":185,"bytes_out":79}],"http_methods":[{"method":"GET","count":187},{"method":"POST","count":35},{"method":"OPTIONS","count":7}],"distinct_ports_total":7,"top_paths":[{"path":"/","count":20,"ports":7},{"path":"/v2/_catalog","count":7,"ports":7},{"path":"/telescope/requests","count":7,"ports":7},{"path":"/api","count":7,"ports":7},{"path":"/graphql","count":7,"ports":7},{"path":"/api/gql","count":7,"ports":7},{"path":"/about","count":7,"ports":7},{"path":"/@vite/env","count":7,"ports":7},{"path":"/console/","count":7,"ports":7},{"path":"/___proxy_subdomain_cpanel","count":7,"ports":7},{"path":"/trace.axd","count":7,"ports":7},{"path":"/server","count":7,"ports":7},{"path":"/config.json","count":7,"ports":7},{"path":"/graphql/api","count":7,"ports":7},{"path":"/server-status","count":7,"ports":7}],"distinct_paths_total":41,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:86","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-27771","tag_type":"cve","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","reference_urls":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37290","https://github.com/go-gitea/gitea/pull/37610","https://orca.security/resources/blog/gitea-container-registry-vulnerability/"]}],"data_as_of":"2026-10-05T16:39:50.395795+00:00"}