TI-2026-061A — The Index of Everything Broken

Classification: HIGH · Grey-Hat Data Broker · Dual-Use / Intelligence-Adjacent Confidence: HIGH on the facts (fleet, CVEs, attribution, business model); the "research" framing is interrogated against this program's own documented record. TLP:WHITE — external scanner infrastructure named in full; operator internals redacted. Series: The Fake Umbrella — Part A. An alphabet of the "ethical / research / security / privacy" cover — a facet a letter, each backed by the OSINT record. Facts are facts. They are good for some and bad for others. Let the reader judge; the facts are the proof.

The seed: a scanner that tells you who it is

Most of the traffic in this program lies — spoofed browsers, empty user-agents, forged 2018 Chrome strings. So a request wearing this user-agent looks, for a moment, disarmingly honest:

Mozilla/5.0 (l9scan/2.0.8353e2936313e24313e253; +https://leakix.net)

It names its tool (l9scan). It names its operator (+https://leakix.net). It carries a per-scan correlation token (8353e293…). A courteous knock — until you see what the courteous knock was reaching for. That same token, welded into a URL path, arrives from the same fleet:

GET /s/8353e2936313e24313e253/_/;/META-INF/maven/com.atlassian.jira/jira-webapp-dist/pom.properties

That is CVE-2022-26134 — the unauthenticated OGNL-injection remote-code-execution flaw in Atlassian Confluence, the one CISA put on its Known Exploited list within days in 2022. The scanner did not just knock. It tried one of the decade's most severe web RCEs on a server it does not own and was not invited to — and it signed the attempt with its own name and a reference number.

The comfortable reading is that this is a friendly security service doing responsible research. This dossier does not take the comfortable reading, because this program has already documented, repeatedly and with sources, that "friendly security service" is the single most reliable costume in the entire threat landscape.

Who is LeakIX — and what it actually sells

Take the self-identification at face value. LeakIX (leakix.net) is, in Rapid7's own words, "a search engine focused on indexing internet-exposed services and leaked credentials/databases." Its Go toolset — l9scan, l9explore ("Digs the dirt"), l9synscan — is open-source on GitHub. SANS ISC has catalogued its internet-wide recon. All true. And all of it describes the scanning. The product is something else, and it is worth saying in plain words:

LeakIX takes the exposures and leaked credentials and databases it finds across the whole internet, and it makes them searchable, for a fee. That is not a metaphor. Its business model — API tiers and subscriptions, identical to Shodan and Censys — is to sell query access to a catalogue of other people's broken doors and stolen data. The victim whose misconfigured database it indexes did not consent to being scanned, did not consent to being catalogued, and does not receive the money when a stranger pays to find them. The person protected by LeakIX (a customer checking their own attack surface) and the person hunted through LeakIX (an attacker or an intelligence buyer querying yours) use the same search box, priced the same way.

So the honest one-line description is not "a security researcher." It is: a data broker for the internet's exposures, whose raw material is other people's vulnerabilities, gathered by unauthorised critical-CVE scanning, and sold as a subscription. Hold that next to the record.

The fleet

LeakIX does not scan from one box. Our sensor caught fourteen distinct IPs, every one a DigitalOcean droplet (AS14061), all carrying the l9scan UA and the same scan token 8353e293…, working in concert from 04:28 on 4 July to 09:32 on 5 July 2026 — one ~29-hour coordinated scan across throwaway cloud VMs:

It is DigitalOcean top to bottom — the abuse-shield provider of TI-2026-032D — The DigitalOcean Paradox, where scale and brand deter blocking. And it is web-surface only — absent from our SSH honeypot, marking it a targeted HTTP indexer rather than a scattershot botnet. Note what a "transparent research" operation still requires: fourteen anonymous, disposable droplets, to scan fast and wide before targets patch or its source IPs are blocked — the identical operational pressure, and identical infrastructure, as a criminal fleet. The honesty is in the user-agent. The operating model underneath it is mass reconnaissance.

The menu: what a full-spectrum exposure scan actually fires

Across the fleet, roughly thirty distinct high-value signatures per node — a curated catalogue of everything the modern web leaks:

The top row is the tell. /.env is passive. CVE-2022-26134, ProxyShell and CVE-2024-4577 are not — they are unauthenticated RCE primitives, and to "detect" them the scanner must send the injection. From the scanned server's side, an RCE detection probe and an RCE exploitation attempt are byte-for-byte identical up to the payload. The restraint — "we only checked, we didn't drop a shell" — is the scanner's private, unenforceable choice, invisible on the wire. You are asked to trust that a service which mass-scans the internet for RCEs and sells the results stopped, every time, one byte short.

The "research" umbrella is a documented cover, not a mitigating fact

Here is why this dossier will not extend LeakIX the benefit of the doubt its user-agent seems to request: this program has already caught the "security research" umbrella being used as a shield, over and over, with sources. LeakIX is not accused of a specific crime here. It is placed, precisely, inside a pattern the corpus has documented — and the pattern is damning enough that "we're the ethical ones" stops functioning as a defence and starts functioning as a data point.

• The Research Cover is a named, documented shield. TI-2026-019J — The Invisible Hand devotes a thesis to it: "Several entities in our data claim security research or privacy purposes. Their ACTUAL observed behavior serves attack operations." Its analogy is the whole industry in one line: "an insurance company that quietly employs arsonists — the fires justify the premiums." Roughly $120M/yr in criminal hosting sustains a $31B/yr "security" business selling the cure for the disease it also carries.
• There is no "ethical" version of the pipe. TI-2026-039B — The Surveillance Market: "There is no ethical upstream for surveillance operations. The pipes don't discriminate." An index queried through one interface cannot serve a defender without serving the attacker and the intelligence buyer in the same keystroke. "Ethical" is a claim the substrate is physically incapable of honouring.
• The state–vendor boundary is where the crime hides. TI-2026-027E — Surveillance for Sale maps the "lawful-intercept vendor archetype": private firms selling intrusion, interception and analytics under legal or national-security cover, with the state–vendor boundary kept deliberately ambiguous so no one is ever quite responsible. Scanning-and-indexing-as-a-service is the reconnaissance tier of that same economy.
• This has a long, leaked history. The WikiLeaks Spy Files catalogue the surveillance-industrial complex marketing itself as lawful and legitimate — VUPEN Security, a firm that wore "security research" while selling exclusive zero-days to government agencies; SS8, Utimaco, COBHAM; product lines literally named "SCAN&TARGET Analytics." The "ethical hacker / security researcher" label is not a novel trust signal. It is a decades-old front, documented in primary-source leaks, for intelligence and government intrusion supply.

None of this proves LeakIX is a front. It proves something more useful: that a self-declared "research" purpose has, on this program's own evidence, near-zero information value as a signal of benignity — because it is exactly the label the worst actors in the record chose for themselves. A company that scans the whole internet for RCEs, indexes everyone's leaked databases, and sells the map, while asking to be trusted because it said "research" in a user-agent, is asking for a credit the documented history does not extend.

The seven questions

Who is this? A commercial data broker (LeakIX, leakix.net) that scans the internet for exposures and leaked data and sells searchable access, from a 14-node DigitalOcean fleet. Self-attributed — the WHO is printed in the WHAT.

Why did it attack? To stock a saleable index. The unauthenticated critical-CVE probes are the extraction step of a subscription product.

Who does it claim to be? A security researcher. That is the claim; the record says the claim is the most-worn costume in the landscape, so it is weighed as marketing, not testimony.

Whom is it related to? DigitalOcean (fleet); the open-source l9 toolset; and — structurally — the documented grey-hat / lawful-intercept economy (019J, 039B, 027E, the Spy Files) whose defining move is exactly this: attack-shaped behaviour sold under a research/privacy/national-security label.

Where is the money? Subscriptions and API tiers to query the index — the Shodan/Censys model. The victim generates the value (their exposure is the inventory); the broker captures it; the victim is not paid and did not consent. Extraction without consent, monetised at the query.

What is the official anchor? A registered, public, open-source operation — which is not exculpatory. The Spy Files firms were registered and public too. Legitimacy of incorporation is not legitimacy of conduct; the whole surveillance industry is registered.

What if it is not who it claims? It is who it claims. The finding is that being who it claims — an "ethical" indexer of everyone's exposures — is itself the thing the record teaches you to distrust.

What if…

• What if the RCE probes are non-destructive version checks? Unverifiable and beside the point. "Non-destructive" is the scanner's unenforceable promise; "unauthorised" is a property of every one of these requests regardless. The victim cannot audit the restraint, only trust it — and trust is the exact thing the documented record says not to extend on a "research" label.
• What if everyone gets scanned, so this is neutral background? The convergence is the harm. LeakIX, Shodan, Censys and criminal fleets have collapsed into the same shape, the same clouds, the same CVE menu — and the same product: a searchable index of everyone's weaknesses. That criminals and "researchers" are now indistinguishable, and equally monetised, is not a reason to relax. It is the finding.
• What if indexing exposures helps defenders? It helps the defenders who subscribe. It exposes the ones who don't — and hands intelligence and criminal buyers a pre-built target list either way. A "help" that is symmetric between protector and predator, sold to both, is not a public good. It is a market in other people's fragility.

Steelman: the strongest defence of LeakIX — and why it fails

Built at full strength, because it is the case the whole industry makes for itself:

"LeakIX is legitimate security research, no different in kind from Shodan or Censys, which everyone accepts. It self-identifies, open-sources its tools, publishes contacts, and helps organisations find their exposures before criminals do. Its RCE probes are calibrated, non-destructive version checks. Vilifying the transparent actor rewards the ones who hide."

It is the fairest version, and this is where it breaks:

• "Legitimate like Shodan" is not a defence; it is the indictment scaled up. The point is not that LeakIX is uniquely bad — it is that the entire category has, on this program's documented record (019J, 039B, 027E, Spy Files), converged into attack-shaped, consent-free, monetised mass reconnaissance wearing a research label. "We're normal for this industry" concedes exactly what is wrong with the industry.
• Transparency is a sales feature, not consent. Naming yourself makes you auditable; it does not make the RCE probe authorised. The victim still did not agree to be scanned, catalogued, or sold. Self-identification lowers what a defender should do in response — it does not change what the request is, or who profits from it.
• The product is the problem, not the packet. Even granting every individual probe is a gentle version-check, the aggregate — an indexed, searchable, for-sale catalogue of the internet's exposed services and leaked credentials and databases — is a surveillance and targeting instrument by construction. The corpus is explicit: there is no ethical version of that pipe, because the pipe serves whoever pays.
• "Punishing transparency rewards hiding" is the only true thing the steelman says. It earns LeakIX a proportionate response — attribute and rate-limit, don't autoban. It does not earn LeakIX the conclusion that unauthorised critical-CVE scanning for a for-profit exposure index is fine because the packet was polite.

Verdict, split and stated: as an immediate threat to a hardened target, LeakIX is MEDIUM and should not be handled like a botnet. As a phenomenon, it is HIGH — a consent-free data-broker of the world's vulnerabilities, structurally indistinguishable from, and documented as continuous with, the surveillance economy the Spy Files and this corpus have already exposed. The transparency is not a counter-argument to that. It is how the extraction gets to happen in daylight. Confidence: HIGH on the facts; the "research" defence is rejected on the documented record, not on suspicion.

Read between the lines

The most revealing artefact is the token welded into the RCE path. LeakIX embeds 8353e293… in the Confluence exploit URL to correlate its scans — an audit trail. Read from the other side, it is a scanner meticulously numbering every unauthorised remote-code-execution attempt it fires across the entire internet. Accountability and evidence, in grey-hat scanning, are written in the same ink — and a firm confident enough to sign its RCE probes is a firm confident that no one who matters will ever call them RCE probes. That confidence is the finding. It is the confidence of an industry that has already won the argument by never having it: it decided, on its own behalf, that scanning-and-selling is "research," and dared anyone to legislate otherwise.

And read the asymmetry the search box hides. The subscriber sees their exposure and patches. The victim who never heard of LeakIX is simply in it — their leaked database a row someone else can buy. "Net good" is an average that quietly writes off that person. The insurance company employing arsonists does not have to light every fire itself. It only has to keep the register of which houses are flammable, and sell it.

The human layer

Somewhere in an index right now is a leaked database — a small firm's customers, a clinic's backups, a town's credentials — catalogued, timestamped, searchable, found by a probe the owner never saw and never authorised, priced for anyone with a subscription. If they are diligent and lucky, they find themselves first and close the hole, and the tool worked. If they are not, the first hand on that entry belongs to whoever paid with worse intent, and the interface could not tell the difference because it was never built to. That owner is protected and exposed by the identical fact, in the same instant, by the same search box. The grey index does not choose. It sells the choice to whoever is looking — and, on the record this program keeps, the ones looking hardest have rarely been the ones patching.

Defense — attribute, tier, and never mistake honesty for permission

(1) Attribute, don't autoban. A verified l9scan/+https://leakix.net fleet is tagged research_scanner and rate-shaped — transparency earns a proportionate response, not exoneration. (2) Score the probe, not the reputation. The Confluence/ProxyShell/PHP-CGI requests are logged as the critical-CVE attempts they are, whoever sent them; the tag lowers the response, never the record. (3) Refuse the index by fixing it. The decoded scan is a free, curated audit list of exactly the exposures a broker will sell about you — confirm all ~30 return nothing on your estate, then you are neither its inventory nor its product. (4) Treat "we're security researchers" as a claim to verify, not a badge to honour — because the documented history of that exact sentence is the history of the surveillance industry.

Investigation metadata

Next — TI-2026-061B: B is for Bug Bounty — how "responsible disclosure," brokered vulnerability markets, and the zero-day economy (VUPEN, Zerodium) turned the ethical-hacker badge into an arms-dealing licence, with the leaks to prove it.

They built a tool that finds every broken door on the internet, and then they sold access to the register. They signed their name to the work because, after twenty-five years, "security research" is the one signature no one is allowed to question. This series questions it — a letter at a time, with the receipts. Facts are facts. They are good for some and bad for others. You decide.