Back to evidence

Sanitized live incident

Reconnaissance

Native source identity and targetable endpoints are private.

mediumopen
Confidence
92%
First seen
Aug 25, 5:44:29 PM PDT
Evidence through
Aug 25, 5:52:32 PM PDT
AI status
Complete
Likely true positive92% confidence

The evidence strongly supports real HTTP reconnaissance against target privatekind: the detector aggregated 64 unauthenticated requests across 56 unique paths, two methods, and six path categories from one derived source cluster. Representative verified events show GET and POST probing with differentiated 200, 401, 404, and 422 responses. This is consistent with automated surface enumeration, but authorization and operator identity are not established. No cited process or flow evidence was available to assess execution, outbound activity, or other post-reconnaissance consequences.

Attack stage
Reconnaissance — unauthenticated web route and method enumeration
Model
gpt-5.6-sol · 8 evidence calls

Observed impact

  • The activity could help an operator map reachable, missing, protected, and input-validating service routes based on differentiated HTTP responses [[redacted], [redacted], 86f022b9-b86e-4a3
  • Observed impact is limited to HTTP surface probing; the cited evidence does not establish exploitation or post-exploitation consequences.

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

123 observations · 12 http

Explicit uncertainty

  • Authorization is unknown; automated security testing, inventory, or other approved activity cannot be excluded from network evidence alone.
  • The source key is a traffic/workload cluster and may represent a proxy, NAT gateway, multiple workers, or another shared origin rather than one operator.
  • No process-plane or flow-plane evidence references are cited by this incident; queries using the incident's HTTP IDs were rejected as not cited. Execution, outbound connections, persistence, lateral movement, and data access therefore cannot be assessed from available evidence.
  • HTTP status codes and bounded body metadata do not reveal whether any 200 response contained sensitive information.

Recommended actions

  1. Confirm whether source cluster [redacted] corresponds to an authorized scanner, monitoring system, or scheduled inventory job.
  2. Review gateway logs and application access controls for the enumerated route categories, prioritizing endpoints that returned 200 without authentication.
  3. Apply proportional rate limiting or enumeration detection for unauthenticated clients, while allowlisting only verified authorized scanners.
  4. Monitor the same source cluster and target for follow-on authentication attempts, exploit payloads, process activity, or unusual outbound flows; escalate only if additional evidence establishes consequences.