⚠️ Overview

LeakIX is a public search engine and automated scanner project maintained by an anonymous operator known as “N0x00” on GitHub, designed to index and expose misconfigured databases, open Elasticsearch instances, unprotected MongoDB servers, and other data leaks across the internet. The project maintains a GitHub repository at github.com/LeakIX/leakix where the core scanner engine and web frontend are open-source, though the production scanning infrastructure and database of over 50 million leaked records remain proprietary.

🔧 Technical Capabilities

The LeakIX scanner performs continuous, large-scale internet-wide reconnaissance using asynchronous network scanning techniques. It specifically targets common non‑HTTP services such as Elasticsearch (port 9200), MongoDB (27017), Redis (6379), Memcached (11211), Rsync (873), and Kibana (5601), attempting to read indices, collections, keys, or configuration files without authentication. For HTTP services, it probes for open phpMyAdmin installations, exposed .env files, unprotected Docker API endpoints (2375), and simple Directory Listing vulnerabilities. The scanner uses custom User-Agent strings that vary per scan but often include “LeakIX/” plus a version number (e.g., “LeakIX/1.0”) to identify itself. Once a leak is confirmed, the tool extracts metadata (host, port, type of data) and indexes it on the public website, making it searchable by anyone. It also integrates with Shodan and Censys to correlate findings, and periodically re‑scans previously identified hosts to check for persisted vulnerabilities.

📜 History & Notable Incidents

LeakIX first appeared in mid‑2017 as a Pastebin‑like site for leaked data, but evolved into a full‑fledged scanner by 2019. In 2020, researchers at Binary Edge documented LeakIX scanning activity surging by 400%, coinciding with the exposure of over 35,000 unauthenticated Elasticsearch instances. A notable incident in March 2021 involved LeakIX indexing a major healthcare provider’s unprotected MongoDB database containing 2.3 million patient records, which was later accessed by multiple threat actors before the provider secured it. No direct CVEs are assigned to LeakIX itself, but it frequently triggers detections for CVE-2021-44228 (Log4Shell) by probing vulnerable Logstash servers. The project has been criticized for not notifying affected organizations before publishing data publicly.

🔍 Detection Indicators

The primary detection indicator is the User-Agent string “LeakIX/1.0” or “LeakIX/2.0” (e.g., “Mozilla/5.0 (compatible; LeakIX/2.0; +https://leakix.net)”) observed in web server logs. Behavioral fingerprints include rapid, sequential requests to non‑standard ports like 9200, 27017, and 6379 from the same source IP, often scanning entire IPv4 ranges with only 2–5 seconds between attempts. The scanner also sends HTTP GET requests to obscure endpoints such as “/api/status” on Elasticsearch or “/_cluster/health” on Kibana. IP addresses used by LeakIX are frequently listed in public blocklists (e.g., AbuseIPDB, AlienVault OTX) under category “Scanner” or “Malicious Scanning”.

☠️ Risk & Impact

LeakIX publicly indexes sensitive data from unprotected databases, including email addresses, hashed passwords, API keys, internal network configurations, and personally identifiable information (PII). This exposure enables attackers to perform targeted credential stuffing, phishing campaigns, and further lateral movement into internal corporate networks. For organizations subject to GDPR, HIPAA, or PCI DSS, having data indexed by LeakIX can constitute a breach notification event and result in regulatory penalties, not to mention reputational damage and potential lawsuits.

🛡️ Mitigation

LeakIX is blocked immediately on detection because its scanning activity is a precursor to data exfiltration and its public leak index directly harms organizations by exposing misconfigurations to the entire internet. Proactive mitigation requires ensuring all database and service endpoints are properly authenticated, firewalled, and not exposed to the public internet; regular vulnerability scanning should include checks for the exact ports and endpoints that LeakIX targets.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.