Detected automatically by automated_enumeration · 2026-07-30 03:43:43 UTC
One address requested 28 distinct paths within 33 seconds
A single connecting address took 28 distinct paths in 33 seconds, a rate no interactive session produces.
What was observed
Between 2026-07-30 03:29:27 and 2026-07-30 03:30:00 UTC, one connecting address requested 28 distinct paths.
Declared identity: Mozilla/5.0 (l9scan/2.0.33e27393e2431313e2838313; +https://leakix.net)
What it means
The rate distinguishes systematic retrieval from reading. It does not establish intent — a well-behaved archiver and a scanner looking for an unpatched installation produce a similar shape, and separating them requires looking at which paths were chosen rather than how many.
Limits
- The declared user agent is unverified. Any client can send any string, so this describes a claim rather than a confirmed identity.
- The threshold is a chosen parameter, not a natural boundary. A slower client doing the same thing falls below it.
- One domain, observed continuously. Nothing here generalises to how this client behaves elsewhere.
Evidence chain
This finding was not written from memory. Each figure below came from a query against the immutable request record, and each query is shown so it can be run again — by us, on this page, or by anyone reconstructing the same instrument.
| Stage | What it produced |
|---|---|
| 1. Reality | Requests recorded by the server as they arrived, written once and never edited. |
| 2. Evidence | The rule automated_enumeration selected the observations that bear on this question and emitted each figure with the means of reproducing it. |
| 3. Statement | A fixed template turned that evidence into the prose above. No language model was involved and no figure was altered. |
| 4. Verification | Every figure was recomputed against the record. A single mismatch would have discarded the draft. |
| 5. Publication | 2026-07-30 03:43:43 UTC, after review by a person. |
What was measured
Each figure is stated first as what it means, which does not depend on how this system happens to store anything today. The query underneath it is implementation — it would be written differently on different storage, and it is shown so the figure can be checked, not because it is part of the claim.
Evidence
distinct paths from this address
At publication: 28 · recomputed now: 28 unchanged
Implementation — how this is computed on today's storage
SELECT COUNT(DISTINCT path) FROM RequestReality WHERE siteId = ? AND cfConnectingIp = ?Every figure still returns what it returned at publication.
Governed by
- I. Reality is not interpretation — Reality ≠ Interpretation
- IV. Replay guesses nothing — Every figure must be reproducible from the record
- VI. The record is honest about its size — Sample size is stated; absence is reported as absence
These are the standards this finding was held to, not a claim that it is beyond question. The constitution states them in full.