Overview
LeakIX l9scan is a scanner associated with LeakIX, used for probing internet-exposed services for leaks, misconfigurations, and vulnerabilities.
Its primary user-agent pattern is l9scan; related patterns include l9scan/2.0; LeakIX scanner; a representative HTTP user-agent is Mozilla/5.0 (l9scan/2.0; +https://leakix.net).
LeakIX l9scan is unverified with Medium confidence. The identity type is Documented.
LeakIX l9scan is not governed reliably by robots.txt. Use authenticated access controls, network policy, rate limiting, or application-layer rules when enforcement is required.
The token is associated with the operator’s open-source scanning ecosystem, but no stable operator-published request-verification policy is currently available.
Treat the user-agent as an identity claim. Corroborate it with operator-controlled IP ranges, reverse DNS, signed-request evidence, or current documentation when available.
Identity
- User-Agent
l9scan- Aliases
- l9scan/2.0; LeakIX scanner
- HTTP Agent Examples
Mozilla/5.0 (l9scan/2.0; +https://leakix.net)- Identity Type
- Documented
- Evidence Method
- Match `l9scan` and corroborate the request with current LeakIX documentation, operator-controlled network data, reverse DNS, or signed-request evidence when available.
Classification
- Type
- Security
- Kind
- Scanner
- Family
- LeakIX
- Purpose
- internet-security-scanning
Behavior and handling
- Common Use
- probing internet-exposed services for leaks, misconfigurations, and vulnerabilities
- Detection Notes
- Detect primarily by `l9scan`; related patterns include `l9scan/2.0; LeakIX scanner`; representative HTTP user-agent: `Mozilla/5.0 (l9scan/2.0; +https://leakix.net)`. User-agent strings can be copied, so corroborate with stronger evidence before granting trust.
- Respects robots.txt
- No
- Spoofing Risk
- LeakIX l9scan has high spoofing risk because its user-agent can be copied and the current evidence is observation-based; do not trust it by name alone.
- Risk
- Caution
- Recommended Handling
- Monitor
Rules and controls
- Robots.txt Snippet
# This identity is not reliably controlled by robots.txt. Use authenticated access controls, network policy, rate limiting, or application-layer enforcement.- Apache Rule
RewriteCond %{HTTP_USER_AGENT} "l9scan" [NC] RewriteRule ^ - [F,L]- Nginx Rule
if ($http_user_agent ~* "l9scan") { return 403; }