{"ip":"165.227.84.14","total_events":96,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"leakix","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (leakix).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"19,516 bytes sent","bytes_sent":19516,"session_seconds":1,"persistent":false}},"first_seen":"2026-09-30T23:31:01","last_seen":"2026-10-02T18:30:56","events_24h":64,"events_7d":96,"geo":{"country_code":"US","country_name":"United States","region":"New Jersey","city":"North Bergen","lat":40.7964,"lon":-74.0203,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"d3b29af448.scan.leakix.org","known_scanners":["leakix","LeakIX"],"scanner_tag":{"key":"auto:leakix_org","label":"LeakIX","category":"commercial","url":"https://leakix.net"},"cve_matches":[{"cve_id":"CVE-2026-27771","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog"}],"malware":[],"top_ports":[{"port":8040,"proto":"tcp","label":"","count":32},{"port":7401,"proto":"tcp","label":"","count":32},{"port":61616,"proto":"tcp","label":"ActiveMQ","count":32}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131200_f57a46bbacb6_fb48f8b98a29","t13i131300_f57a46bbacb6_3b244d8fbcc8","t13i131000_f57a46bbacb6_ab7e3b40a677"],"tls_client_hello":"160301066801000664030312d6a9b9ca3d1989f07c26d061863cb299abb9e0c6730a6a570db35bfbecd8252007ba62e888f9886cc3cbe2fd993c9a6c31de61bc647ac69760cb197399a1c315001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000601000b0002010000230000ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c01d383e2efa767ab53a861992a4c1632495783494cefca9c92c332a18d0c71c95cfdf01b20c129c66e47a23f869c1e7467a2bac6d1c52e94918009d401b703325414f0fa022c645a238737bd1052f88a00186299a81d262ef9494c250bca8f8649ac22f30d480799187f4f436d7f78c7e812d29d3073299a9eeb44f2dcb3b13ac9edfb222cfb5537324a26d4429ecc1912264580c39b400d42c88a881faa2291877a379f0a0d70b4393fa400b382c22207190fa281d4559c407b7b4c7c2bd2ac170925f5322afb0616c5daa7dc346b1a2203e59dc01b4e09c69d118c1135742e6b8803625000d7138839be21a082c628b58ba9b70d59bfbf2b329e83f46e421721524f2450f17f00f35bb2f66f2bc4cc83f62090792880641b2536e07ae45a629154286880cc189d3545731a63db06456c2720e737a8f236e39fc835733489d703680393e22c939bb1baad5716c2fd92703dc308ab5c73166594eb828bbf497b9f4bdff1a2d752c6d51fcaf918850ffbca48403a70ce194d37093e84bbdccaa4eb211c45f713077e98d342a88e2b69032b572cf86933df47471d32032f31cc5db879e53666f643129835c54a18684e83d5219773b2ca6c51a4ea63b6da376b5f104382603c4c9c92e6c27595ff16fe6c52d79e04f7ac0c11dc8909ae62569173484220198c33db5c36c2d8859455263bfc0806535baa61aae94c44bd531530381a5c23900c2f99849a221ea1551d559248394abf7ea288f40326a552efd1c66cc4458a84a5ca451662a02875ed65262171d4de1a41140c3d3c312656a5ecb6813897a2027d387e8bb98ce779657c329cf84af82bb243da47e58426c26fa8cf893a66f4a85d07192812cba28a159bfccc9f0285c0fac69d0715c3b51b395b124f5b2a96c8b8090028507943659d94519f375c384118e14c8536927a1f9288c8c926418c5a651340675b4fe0928c84682e83022bfb413c5fa519bdc8e6e6c845db7bbf877c4e8e4733bf8c5f2e07220078368b87aa57b2fe202bdaf45330f342f68f414eac72eb862030a9a0c92a7c1381ca76c63774d84204f2699e464879e9420d756c85670c7e18339bb34001f6bc67ffb2d9977c17c13122ce1bcec816a05faa702ab039398261a538470bb7822349e8eba29e0399f6b6696d762424f4a103a8ac6279907f3f80350260cf4d5a9a984a3de3b0baa206d2453338445817c7b4363e02965bc942db971958c7ed192700820ae565454694cc48824269f748d19c26c7b0cbacc8c8d584a9ae8647140978329ac7a34b1b1145075aad23aae1a2e3a06d05ef14759710fb5d8be1d5a2d8ca01cd44b525107be6316718997189e50734937aac7e76acb169ac7c0959f5c405455842538cacb1163f34995008d581735bd5d106b6111b51a53cf425420c439a008cb0ef1408fb44c3b20846ab4986427a69acafa8038b4457b5c61d95cb111569fce787bacabb117f7cf47086888977ad8513122b78c55806f117a02e8883b5ab91a05a03f1b371c9b23baac2a6001f438457c019b173ed98468c41374a4c538de44c41762c6fbd3161e96227f21330eaa01e4145a7a3b226428066413974c83a768f94b71959d6a2787375c8487927f084b7e5c075c8b183596db7ed1e094acfa5043f8473601369c507cfab045686a06927f33b0f2d0bd53982614229a4c45aa6875a82b3fc258213e64a2ef48f004001d002006927f33b0f2d0bd53982614229a4c45aa6875a82b3fc258213e64a2ef48f004002d0002010100290094006f0069ab592ef7cf6e77d114e62a08174ce6c8bf1f33cf9d7eebcdc9570d261a84270b7233489141ce2856bb5aa717b5de21d687f2bb2a80992b30619894aa4ab1c602da0a8ec0ee20ad120cc3b86cdf7b37168dc7252c2e2d294494734c2efc8d88e88948fcc4dd6f933fabd4aec497002120973c0cf658234677330989e29f5ce98f638c7dc37c69a7d9ae1c50abd1a00044","tls_ja3":["0d19b15a013ea9e1ae313614888f79f5","725543c78edf669194c11dc7a039b56e","37b3769f942aae0789e38e380a532088"],"http_akin":["b11cun030_00040011_c91eaf54","b11cuq070_00050817_ae8383eb","b11cun040_00040013_608dab68","b11cun050_00040017_e873236c"]},"fingerprint_peers":{"t13i131200_f57a46bbacb6_fb48f8b98a29":64,"t13i131300_f57a46bbacb6_3b244d8fbcc8":61,"t13i131000_f57a46bbacb6_ab7e3b40a677":4642,"b11cun030_00040011_c91eaf54":597,"b11cuq070_00050817_ae8383eb":64,"b11cun040_00040013_608dab68":4399,"b11cun050_00040017_e873236c":738},"akin_families":{"b11cun030_00040011_c91eaf54":{"head":"b11cun030_00040011_c91eaf54","shapes":4,"ips":597},"b11cuq070_00050817_ae8383eb":{"head":"b11cuq070_00050817_ae8383eb","shapes":4,"ips":64},"b11cun050_00040017_e873236c":{"head":"b11cun050_00040017_e873236c","shapes":5,"ips":739}},"user_agents":["Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)"],"timeline":[{"date":"2026-09-30","count":32},{"date":"2026-10-02","count":64}],"recent_events":[{"timestamp":"2026-10-02T18:30:56","port":7401,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7401\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/debug/default/view?panel=config","summary":"","payload_hex":"474554202f64656275672f64656661756c742f766965773f70616e656c3d636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a373430310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"e37e0f6b-1dc0-42d5-9cfe-d78a48d3692f","seq":1,"duration_ms":105,"bytes_in":203,"bytes_out":78},{"timestamp":"2026-10-02T18:30:55","port":7401,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7401\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/?rest_route=/wp/v2/users/","summary":"","payload_hex":"474554202f3f726573745f726f7574653d2f77702f76322f75736572732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373430310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"a7b28238-5567-496b-a8e9-cd9e19338a70","seq":1,"duration_ms":112,"bytes_in":197,"bytes_out":78},{"timestamp":"2026-10-02T18:30:54","port":7401,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7401\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a373430310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"af361cb9-ac0c-46da-a173-4738484e6e76","seq":1,"duration_ms":106,"bytes_in":176,"bytes_out":78},{"timestamp":"2026-10-02T18:30:53","port":7401,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7401\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.vscode/sftp.json","summary":"","payload_hex":"474554202f2e7673636f64652f736674702e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a373430310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"688b2af2-2e1f-404b-8df3-36b5210070a6","seq":1,"duration_ms":116,"bytes_in":189,"bytes_out":78},{"timestamp":"2026-10-02T18:30:51","port":7401,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7401\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/trace.axd","summary":"","payload_hex":"474554202f74726163652e61786420485454502f312e310d0a486f73743a20<HONEYPOT>3a373430310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"075603af-a311-4925-b73d-5311d7a32cec","seq":1,"duration_ms":113,"bytes_in":181,"bytes_out":78},{"timestamp":"2026-10-02T18:30:51","port":7401,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7401\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/@vite/env","summary":"","payload_hex":"474554202f40766974652f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a373430310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"5488dec0-7273-4964-a49c-eeff3432309b","seq":1,"duration_ms":101,"bytes_in":181,"bytes_out":78},{"timestamp":"2026-10-02T18:30:50","port":7401,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7401\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/actuator/env","summary":"","payload_hex":"474554202f6163747561746f722f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a373430310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"387235b2-7d0b-450d-8c0b-390698d12920","seq":1,"duration_ms":104,"bytes_in":184,"bytes_out":78},{"timestamp":"2026-10-02T18:30:49","port":7401,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7401\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a373430310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"83deb07d-0a8c-4dfd-aeb1-0c1d0f41aeb7","seq":1,"duration_ms":105,"bytes_in":196,"bytes_out":78},{"timestamp":"2026-10-02T18:30:48","port":7401,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7401\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/info.php","summary":"","payload_hex":"474554202f696e666f2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a373430310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"33bb63f6-e26c-4ee8-9e78-10e0c199532e","seq":1,"duration_ms":105,"bytes_in":180,"bytes_out":78},{"timestamp":"2026-10-02T18:30:47","port":7401,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:7401\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_AES_128_GCM_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/telescope/requests","summary":"","payload_hex":"474554202f74656c6573636f70652f726571756573747320485454502f312e310d0a486f73743a20<HONEYPOT>3a373430310d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e32333333313365323333383331336532353337333133653235333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"2f67a9d9-60dd-4680-96a2-7add572ecffa","seq":1,"duration_ms":116,"bytes_in":190,"bytes_out":78}],"http_methods":[{"method":"GET","count":72},{"method":"POST","count":15},{"method":"OPTIONS","count":3}],"distinct_ports_total":3,"top_paths":[{"path":"/","count":9,"ports":3},{"path":"/actuator/env","count":3,"ports":3},{"path":"/___proxy_subdomain_whm/login","count":3,"ports":3},{"path":"/api","count":3,"ports":3},{"path":"/graphql","count":3,"ports":3},{"path":"/api/gql","count":3,"ports":3},{"path":"/about","count":3,"ports":3},{"path":"/@vite/env","count":3,"ports":3},{"path":"/server","count":3,"ports":3},{"path":"/trace.axd","count":3,"ports":3},{"path":"/config.json","count":3,"ports":3},{"path":"/graphql/api","count":3,"ports":3},{"path":"/server-status","count":3,"ports":3},{"path":"/info.php","count":3,"ports":3},{"path":"/.env","count":3,"ports":3}],"distinct_paths_total":29,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:7401","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (l9scan/2.0.233313e2338313e2537313e253; +https://leakix.net)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-27771","tag_type":"cve","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","reference_urls":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37290","https://github.com/go-gitea/gitea/pull/37610","https://orca.security/resources/blog/gitea-container-registry-vulnerability/"]}],"data_as_of":"2026-10-02T21:48:52.865937+00:00"}