l9explore and l9scan in Your Access Log: LeakIX Scanning for Leaks

l9explore/1.2.2
Mozilla/5.0 (l9scan/2.0.0000000000000000; +https://leakix.net)
l9tcpid/v1.1.0

What it is

l9explore, l9scan and l9tcpid are the scanners of LeakIX, a search engine for exposed services and data leaks. They are open source: the l9explore README describes it as “a plugin based tool doing deep exploration on a wide range of protocols” that “can be used to expose leaks, misconfigurations and vulnerabilities on any IP network”, the last layer of LeakIX’s l9 tool suite. Its plugins look for exposed .env files, Laravel debug pages, phpinfo output and Apache status pages on web servers, and for open MySQL, MongoDB, Elasticsearch, Redis, CouchDB and Kafka services.

On our own server, LeakIX’s scanners sent well over a thousand requests in the last 30 days from about a dozen addresses (counts above). After /, the paths they asked for most were /.git/config, /files/.git/config and /.env — exactly the leaks the tool is built to find.

Who sends it

LeakIX, from its own scanning infrastructure. The l9scan user agent names https://leakix.net and carries a long hexadecimal suffix that varied between requests on our server; l9explore and l9tcpid send their name and version only. Because the tools are open source, anyone can run them, so a request with these headers is most likely, but not certainly, from LeakIX itself.

Is it a threat?

The scan is reconnaissance (MITRE ATT&CK T1595.002, vulnerability scanning) by a service whose business is finding leaks. It becomes serious when a probe succeeds: a .git/config or .env that returns 200 has exposed source code or secrets, and LeakIX’s search site indexes the leaks its scans find. Plenty of attackers ask for the same files without saying who they are, so a successful LeakIX probe means the file was exposed to everyone.

How to handle it

1. Find LeakIX’s requests and check their status codes; anything other than 404 or 403 for a .git or .env path is a leak to fix now.
2. Move secrets and repositories out of the web root, deny dot-files in the web server, and rotate any secret that was served.
3. If you want fewer scans, refuse the user agents, or use LeakIX’s take-down and blacklist process ([email protected]) to exclude your networks.

Find the requests and the ones that were answered:

grep -Ei 'l9explore|l9scan|l9tcpid|leakix\.net' /var/log/nginx/access.log | awk '{print $9, $7}' | sort | uniq -c | sort -rn | head

Deny dot-files for everyone, and refuse LeakIX’s scanners by name (server block):

location ~ /\.(?!well-known/) {
    deny all;
}
if ($http_user_agent ~* "(l9explore|l9scan|l9tcpid)/") {
    return 403;
}

The free log analyzer flags any secret-file probe in an access log that got a 200 back.