LeakIX

LeakIX

Warning

This module requires an active API key. If the LeakIX configuration value is empty, the module will not be registered by the dispatcher and will not execute. For comprehensive instructions on managing keys, refer to the API Credentials page.

Official Website: https://leakix.net/

The LeakIX module interfaces with the LeakIX API to discover exposed services, data leaks, leaked credentials, and passive subdomain intelligence for domains and IP addresses. LeakIX aggregates Internet-wide scan data to identify misconfigured, compromised, or inadvertently exposed assets.

Configuration & Limits

The module enforces a built-in rate limit of approximately 1 request per second to comply with LeakIX API usage policies. Retry behavior can be tuned in your Network Configuration.

If the API key is invalid (HTTP 401) or access is forbidden (HTTP 403), the module enters a blocked state and stops querying the API for all subsequent targets in the current scan.

---

1. Domain Intelligence

The module accepts Domain nodes and queries the LeakIX domain endpoint to extract comprehensive exposure data. The resulting intelligence may include, but is not limited to:

• Services: Discovers services grouped by IP, port, and protocol. For each service event, it may extract:
  • Port and Service (protocol identifier).
  • Software name and version.
  • Web Server header value.
  • Favicon hash (for HTTP/HTTPS services).
  • Last Seen timestamp.
  • Event Source identifier.
• SSL/TLS Metadata: JARM fingerprints, Cert Fingerprint, SAN domains (tagged San, and Wildcard if applicable), Cert Issuer, and Cert Expiration.
• SSH Metadata: SSH Banner, Fingerprint, and MOTD properties.
• Network Context: ASN, Organization, and CIDR network block from associated IPs.
• Geolocation: Geo data including city, region, country, continent, and coordinates.
• Reverse DNS: Reverse DNS hostnames, tagging them as Reverse IP.
• MAC & Vendor: MAC addresses and hardware vendor identifiers.
• Tags: LeakIX behavioral tags attached to service events.

Leak & Credential Intelligence

When leak events are detected, the module extracts additional threat-specific data:

• Leak Summaries: Top-level summaries describing the nature and scope of the leak.
• Leaked Credentials: Extracted username, password, key, and no-auth indicators with discovery timestamps, attached to the relevant port or service.
• Leak Classification: Severity, type, and stage of each leak event (e.g., [critical] open, stage: explore).
• Dataset Statistics: Row count, data size, and infection indicators for leaked datasets.
• Compromised Tagging: Affected entities are automatically tagged Compromised.

---

2. IP Host Intelligence

The module accepts IPv4 and IPv6 nodes, querying the LeakIX host endpoint. It extracts the same comprehensive set of service, leak, credential, network, SSL/SSH, geolocation, and tag metadata as the domain function, organized around per-host event groups.

---

3. Passive Subdomain Enumeration

Note

Strict Scope Validation: The module may extract third-party domains or external infrastructure during the enumeration process. To maintain a clean infrastructure graph, all extracted domains are strictly validated and flagged as Out of Scope if they do not belong to the target organization. See Scope Boundaries for the logic on how domains are classified and how to manually include or exclude them.

The module accepts Domain nodes, querying the LeakIX subdomain API endpoint to discover:

• Subdomains: Validated subdomain nodes tagged PDNS.
• Last Seen: Timestamp of the most recent observation for each subdomain.
• Distinct IPs: Count of unique IP addresses historically associated with each subdomain.