{"ip":"64.227.70.2","total_events":169,"verdict":{"verdict":"scanner","label":"Recognized scanner","detail":"leakix","confidence":"high","network_type":"CDN","why":["Source IP is in a known scanner range (leakix).","Known research and commercial scanners are labelled as such, not as threats."],"engagement":{"level":"payload","label":"Sustained payload","detail":"26,228 bytes sent","bytes_sent":26228,"session_seconds":0,"persistent":false}},"first_seen":"2026-05-01T00:24:03","last_seen":"2026-10-02T09:01:29","events_24h":0,"events_7d":128,"geo":{"country_code":"NL","country_name":"The Netherlands","region":"North Holland","city":"Amsterdam","lat":52.352,"lon":4.9392,"asn":14061,"org":"DigitalOcean, LLC"},"source_domain":"b46c9f9797.scan.leakix.org","known_scanners":["leakix","LeakIX"],"scanner_tag":{"key":"auto:leakix_org","label":"LeakIX","category":"commercial","url":"https://leakix.net"},"cve_matches":[{"cve_id":"CVE-2026-27771","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog"}],"malware":[],"top_ports":[{"port":8300,"proto":"tcp","label":"","count":41},{"port":4532,"proto":"tcp","label":"","count":32},{"port":8006,"proto":"tcp","label":"","count":32},{"port":8082,"proto":"tcp","label":"","count":32},{"port":8080,"proto":"tcp","label":"HTTP-alt","count":32}],"fingerprints":{"ssh_hassh":[],"tls_ja4":["t13i131200_f57a46bbacb6_1bd98dace775","t13i131300_f57a46bbacb6_47d1ff9c9a84","t13i131200_f57a46bbacb6_fb48f8b98a29","t13i131000_f57a46bbacb6_e5728521abd4"],"tls_client_hello":"16030106680100066403035c32dd672f770179a833d7ee9924b10931dae237ac38035fd4d49b4d5bd7d14e200de09114cdeac18cbfc26e27bb10712bbcc4c3ae2477982d140e43b3b02ddfe9001ac02bc02fc02cc030cca9cca8c009c013c00ac01413011302130301000601000b0002010000230000ff010001000017000000120000000500050100000000000a0010000e11ec11eb11ed001d001700180019000d0016001408040403080708050806040105010601050306030032001a0018080404030807080508060401050106010503060302010203002b00050403040303003304ea04e811ec04c0d248355cf44762e547ed261e64475e1fca96e2981dad5667691a805a468b829b643684a52868ccc9828f9a1767dbc0bbcb05a0941b03f35b487c7c3e1fe112cde46b120631ff59b8e2dc030f1262fea7618608bc3e1a45be972ad2655996ab25a5d25937e5aa3bf22739602788d1567db70e6394a719e7bda06c95f7f8b82a3c4c47d0a957298c93c98f93f8c90097907573265e8a00cfe912052a672ff5785ca0866eaac46f7bad341a87e5d9207be9814247af3c339ba8f7cdb82c0318127b337696ec9ac995e12bf668275798aa9385a0502452b673784e1590d934b55be236bb563bf1589e35a77a20a62719c2001fc34121e54beb7c54e1a39e4c739c2b05244b4180cfbccf644c7d5fc20188337c627997b67c886cc5aad4f55a73f3c5a948513a12801de50454263b18772292ab281b53a15e3526a8eab857f283f53a20531372fdd9362ae9127950774594209bf37536d85401e27bcf5ca0d8bc6852288b255aa04dab0fa9ea46cf9a09414447480693991aafd09c0d762b17d4133caea78aa3665a0fa140fab066016304496c8388ac899ee210aae3048dc545115b60128cb52e318c66ab317397b74d0b1b5f185fc7f3c639285cba89068c110d4b1086e91a261e40a58c23402213044e8b1a7352524dbb2e7a6648f5544d75f57321c5730b30b0488c981472a926379b3f92234284c8a717431f3ba17f00177108cc2510a782b09ae4150786f8948b75a3a1a395c82a9f61310f967c66613230efc4c82a913486c33d58890ea432aeadd68b91b72c53268a0d9bcf307aae7b6c4cb56265f383cdb603b4506505194780714b1d61bc0c9c99948c05154fc2a9f3fa34515c90a5b902810a418713077d651dec753eab55c3846075b8f87662244e8f8c886cacc12877ae443cacff559d0650298717ad70552340506f5db2c5b2b16013aab14f4cbceee309407796a5caa37c7c1f1d104033f4316fab0dfd58c00ee45e50ac5d61493b696b4bbf702c88b349a240907cd40eb454bd28c990a5d389d5b371d1c93ea2f53b0590b1936777aebc4e12230c3c7159f289b497b57957e19f4f2c52e58a950a64cbbc80297c434010670e16ec01b369b47238183053ab10d57f30a14321d5330edc81db94443c00411d9b9216928aa0a949d93109a7ca0eb8e01807d72f381c19df239c723cad485347965bbd782a9333ab686c9b3d5860b7c1494782729db4bc72d37859caf016272388aaa728532a5d420114bf207dd28930eca6b7c45c06effc0331e08002220efb9109b3c14d86eb1c1c606fba130fe95c214b3b793562507f5405a4a9a9c9228ab7ba96da0b888f2a30a7e50d9c0833cc265c04e07c94e9330197791c2cc3ac878005b365640ab3f0739d8c7406728c9f35d8c86cd0abf7a8670492253b8971d0286f79517b690948efb48f99118dca933a39c60d6f94a854d842503cb36c59213fd939d8eb34c6a15eba2c90b8176aa40127c8534fb5b76ec69417a2939e501cc8ba9662c92632657509ff70c252c2bc22a168b58500eea24810738972724f7611ba748814321080a071585c1cc036398f06652e2bba02d4153078b68b3bdc43a6910bf4b30939bb3319ac3d75ab32f95b516840fa0920ce9815fc24935dcfa94701d14c458d9a57c0d1a081bcf8104cfb445c9b1e943eaf4edcdef727d9eeac93b7a91c56e577b6cab5027b4f8539001d00204cfb445c9b1e943eaf4edcdef727d9eeac93b7a91c56e577b6cab5027b4f8539002d0002010100290094006f0069b8fe8da5d2c6f06d2674096702446111dc8bbe95ef7404a4bf28da4c9d1912677f849c645bd525acc603b4d554e2fe724ebfcd7991d94f863db8bec1f885180b8728f5e4ae590950bc0abb59f837e8d7542e660449f424dde68cfb0d32d875debd142d867d0ecfec032ca8b64b0021204a3c4b7285b515f5633a8ee98b40d7bcd6197be74332d24c98469023563563d8","tls_ja3":["0d19b15a013ea9e1ae313614888f79f5","725543c78edf669194c11dc7a039b56e","37b3769f942aae0789e38e380a532088"],"http_akin":["b11cun030_00040011_c91eaf54","b11cuq070_00050817_ae8383eb","b11cun040_00040013_608dab68","b11cun050_00040017_e873236c"]},"fingerprint_peers":{"t13i131200_f57a46bbacb6_fb48f8b98a29":69,"b11cun030_00040011_c91eaf54":625,"b11cuq070_00050817_ae8383eb":69,"b11cun040_00040013_608dab68":4397,"b11cun050_00040017_e873236c":743,"t13i131200_f57a46bbacb6_1bd98dace775":13,"t13i131000_f57a46bbacb6_e5728521abd4":56,"t13i131300_f57a46bbacb6_47d1ff9c9a84":0},"akin_families":{"b11cuq070_00050817_ae8383eb":{"head":"b11cuq070_00050817_ae8383eb","shapes":4,"ips":69},"b11cun050_00040017_e873236c":{"head":"b11cun050_00040017_e873236c","shapes":4,"ips":743}},"user_agents":["Mozilla/5.0 (l9scan/2.0.134313e26333e24393e23323; +https://leakix.net)","Mozilla/5.0 (l9scan/2.0.130323e21383e2832323e2538313; +https://leakix.net)","Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)"],"timeline":[{"date":"2026-10-01","count":64},{"date":"2026-10-02","count":64}],"recent_events":[{"timestamp":"2026-10-02T09:01:29","port":4532,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4532\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/debug/default/view?panel=config","summary":"","payload_hex":"474554202f64656275672f64656661756c742f766965773f70616e656c3d636f6e66696720485454502f312e310d0a486f73743a20<HONEYPOT>3a343533320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"d3700414-1e01-4d4b-9731-e52f4acc29ea","seq":1,"duration_ms":101,"bytes_in":200,"bytes_out":76},{"timestamp":"2026-10-02T09:01:28","port":4532,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4532\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/?rest_route=/wp/v2/users/","summary":"","payload_hex":"474554202f3f726573745f726f7574653d2f77702f76322f75736572732f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343533320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"f3646d3f-a3dd-446f-8d2e-5e532a2ff779","seq":1,"duration_ms":102,"bytes_in":194,"bytes_out":76},{"timestamp":"2026-10-02T09:01:27","port":4532,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4532\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/","summary":"","payload_hex":"4f5054494f4e53202f20485454502f312e310d0a486f73743a20<HONEYPOT>3a343533320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"OPTIONS","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"822888a5-8291-4bec-81dd-15ef2fed7670","seq":1,"duration_ms":114,"bytes_in":173,"bytes_out":76},{"timestamp":"2026-10-02T09:01:26","port":4532,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4532\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.vscode/sftp.json","summary":"","payload_hex":"474554202f2e7673636f64652f736674702e6a736f6e20485454502f312e310d0a486f73743a20<HONEYPOT>3a343533320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"4154d8f2-0eec-4434-a284-410c5b91e1fb","seq":1,"duration_ms":154,"bytes_in":186,"bytes_out":76},{"timestamp":"2026-10-02T09:01:25","port":4532,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4532\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/@vite/env","summary":"","payload_hex":"474554202f40766974652f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a343533320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"d149437c-f406-4a97-bd2f-bce7a41761c0","seq":1,"duration_ms":101,"bytes_in":178,"bytes_out":76},{"timestamp":"2026-10-02T09:01:24","port":4532,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4532\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/trace.axd","summary":"","payload_hex":"474554202f74726163652e61786420485454502f312e310d0a486f73743a20<HONEYPOT>3a343533320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"2a6b2957-e266-4914-870f-f606598f9e3d","seq":1,"duration_ms":125,"bytes_in":178,"bytes_out":76},{"timestamp":"2026-10-02T09:01:23","port":4532,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4532\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/actuator/env","summary":"","payload_hex":"474554202f6163747561746f722f656e7620485454502f312e310d0a486f73743a20<HONEYPOT>3a343533320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"b3e3076c-348b-4a7f-a0a3-94e33051a22a","seq":1,"duration_ms":101,"bytes_in":181,"bytes_out":76},{"timestamp":"2026-10-02T09:01:22","port":4532,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4532\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/.well-known/security.txt","summary":"","payload_hex":"474554202f2e77656c6c2d6b6e6f776e2f73656375726974792e74787420485454502f312e310d0a486f73743a20<HONEYPOT>3a343533320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"d42af31f-676e-48c2-b423-8f909478a59e","seq":1,"duration_ms":100,"bytes_in":193,"bytes_out":76},{"timestamp":"2026-10-02T09:01:21","port":4532,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4532\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/info.php","summary":"","payload_hex":"474554202f696e666f2e70687020485454502f312e310d0a486f73743a20<HONEYPOT>3a343533320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"44f17b87-85fb-414e-aee4-be5c42401aab","seq":1,"duration_ms":101,"bytes_in":177,"bytes_out":76},{"timestamp":"2026-10-02T09:01:20","port":4532,"proto":"tcp","app_proto":"tls","app_protocol":"http","host":"<HONEYPOT>","headers":"{\"accept-encoding\":\"gzip\",\"connection\":\"close\",\"host\":\"<HONEYPOT>:4532\",\"user-agent\":\"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)\"}","body":"","sni":"","tls_cipher":"TLS_CHACHA20_POLY1305_SHA256","tls_version":"TLSv1.3","alpn":[],"url_path":"/telescope/requests","summary":"","payload_hex":"474554202f74656c6573636f70652f726571756573747320485454502f312e310d0a486f73743a20<HONEYPOT>3a343533320d0a557365722d4167656e743a204d6f7a696c6c612f352e3020286c397363616e2f322e302e3733323332336532373333336532343339336532333332333b202b68747470733a2f2f6c65616b69782e6e6574290d0a4163636570742d456e636f64696e673a20677a69700d0a436f6e6e656374696f6e3a20636c6f73650d0a0d0a","method":"GET","user_agent":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","ja3":"37b3769f942aae0789e38e380a532088","session":"002ddef5-0c3c-490a-80ad-49499a14d16f","seq":1,"duration_ms":103,"bytes_in":187,"bytes_out":76}],"http_methods":[{"method":"GET","count":129},{"method":"POST","count":25},{"method":"OPTIONS","count":5}],"distinct_ports_total":5,"top_paths":[{"path":"/","count":14,"ports":5},{"path":"/v2/_catalog","count":5,"ports":5},{"path":"/telescope/requests","count":5,"ports":5},{"path":"/api","count":5,"ports":5},{"path":"/graphql","count":5,"ports":5},{"path":"/api/gql","count":5,"ports":5},{"path":"/about","count":5,"ports":5},{"path":"/@vite/env","count":5,"ports":5},{"path":"/console/","count":5,"ports":5},{"path":"/___proxy_subdomain_cpanel","count":5,"ports":5},{"path":"/trace.axd","count":5,"ports":5},{"path":"/server","count":5,"ports":5},{"path":"/config.json","count":5,"ports":5},{"path":"/graphql/api","count":5,"ports":5},{"path":"/server-status","count":5,"ports":5}],"distinct_paths_total":41,"top_snis":[],"top_hosts":[],"top_alpns":[],"banners":[],"credentials":[],"header_profile":{"signature":["Accept-Encoding","Connection","Host","User-Agent"],"representative":[{"name":"Accept-Encoding","value":"gzip","notable":false},{"name":"Connection","value":"close","notable":false},{"name":"Host","value":"<HONEYPOT>:4532","notable":false},{"name":"User-Agent","value":"Mozilla/5.0 (l9scan/2.0.732323e27333e24393e23323; +https://leakix.net)","notable":false}],"distinct_sets":1,"events_with_headers":10},"tags":[{"tag_id":"CVE-2026-27771","tag_type":"cve","title":"Gitea Container Registry - Unauthorized Private Image Access","severity":"high","actively_exploited":false,"match_field":"url_path","matched_pattern":"/v2/_catalog","reference_urls":["https://blog.gitea.com/release-of-1.26.2/","https://github.com/go-gitea/gitea/pull/37290","https://github.com/go-gitea/gitea/pull/37610","https://orca.security/resources/blog/gitea-container-registry-vulnerability/"]}],"data_as_of":"2026-10-04T15:22:39.629610+00:00"}