Back to evidence

Sanitized live incident

Reconnaissance

Native source identity and targetable endpoints are private.

mediumopen
Confidence
92%
First seen
Aug 18, 7:56:15 PM PDT
Evidence through
Aug 18, 8:44:55 PM PDT
AI status
Complete
Likely true positive90% confidence

The evidence strongly supports real automated HTTP surface enumeration against target privatekind from one derived traffic cluster. The detector aggregated 356 requests spanning 173 unique paths, six methods, and eight path categories; verified samples show rapid POST, PATCH, PUT, and GET activity against distinct path hashes, with a mixture of 200, 404, 405, and 422 responses. This is highly consistent with reconnaissance, but maliciousness is not conclusive because authorization and source ownership are unknown and the incident also reports substantial authenticated traffic. Some requests returned 200, but status codes and body hashes alone do not prove state change, exploitation, or compromise. No cited process or flow events were available to assess downstream consequences.

Attack stage
Reconnaissance / discovery through HTTP route and method enumeration
Model
gpt-5.6-sol · 11 evidence calls

Observed impact

  • Observed impact is limited to broad probing and potential mapping of the target's HTTP/API surface.
  • Several sampled requests received HTTP 200 responses, but the available summaries do not establish harmful state changes, command execution, persistence, outbound activity, or data loss.

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

356 observations · 12 http

Explicit uncertainty

  • Authorization is not established. This pattern could represent hostile reconnaissance, an approved security scan, API fuzzing, or benign inventory activity.
  • Authentication context is internally mixed: the derived incident reports 158 authenticated requests, while the signal summary describes unauthenticated enumeration; bounded HTTP summaries do not expose authentication details.
  • The source key is a traffic/workload cluster, not a proven person or single agent, and may represent a proxy, NAT gateway, or multiple workers.
  • No process-plane or flow-plane evidence IDs are cited by this incident. Queries using the cited HTTP IDs were rejected by those evidence tools, so downstream execution and network consequences cannot be determined.
  • Exact paths and payload contents are intentionally excluded from the bounded summaries, preventing determination of whether the 200 responses performed expected, sensitive, or harmful operations.

Recommended actions

  1. Determine whether the source cluster corresponds to an approved scanner, test harness, CI worker, proxy, or known administrative client before escalating containment.
  2. Review application audit records for the cited 200-response events, especially the POST and PUT requests, to determine whether they caused state changes and whether those actions were authorized.
  3. If unauthorized, apply proportionate controls such as source throttling, route-level rate limits, stronger authentication, and method restrictions while preserving relevant logs.
  4. Review the 173-path exposure set and ensure sensitive, administrative, diagnostic, and undocumented routes require appropriate authentication and authorization.
  5. Continue monitoring for follow-on exploitation signals; if process or outbound-flow events become cited, investigate them separately without assuming HTTP-to-process or HTTP-to-socket causality.