Back to evidence

Sanitized live incident

Reconnaissance

Native source identity and targetable endpoints are private.

mediumopen
Confidence
92%
First seen
Aug 28, 9:32:35 PM PDT
Evidence through
Aug 28, 10:16:54 PM PDT
AI status
Complete
Likely true positive93% confidence

The incident is strongly supported as web-surface reconnaissance. The detector aggregated 58 unauthenticated requests across 32 unique paths, two methods, and eight path categories from one derived source cluster, with 32 rejected responses (HTTP evidence set [redacted] through [redacted]). Verified samples corroborate a rapid sequence of empty-body GET probes against distinct path hashes: the root returned 200, while several subsequent routes returned 404. This supports route enumeration but does not establish exploit execution or compromise. Authorization and the real actor behind the source cluster remain unknown.

Attack stage
Reconnaissance — unauthenticated web route and method enumeration
Model
gpt-5.6-sol · 8 evidence calls

Observed impact

  • Reconnaissance exposure only: response differences may reveal externally reachable route behavior; no execution, persistence, lateral movement, data theft, or outbound consequence is demonstrated by the cited evidence.

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

300 observations · 12 http

Explicit uncertainty

  • The source key is a traffic/workload cluster, not a proven human or agent identity; it may represent a proxy, NAT gateway, or multiple workers.
  • Authorization is not established. The behavior could be unauthorized reconnaissance, approved security testing, or benign inventory automation.
  • The incident cites no process or flow evidence IDs. Process and flow queries using the HTTP event IDs were unavailable because those IDs are not cited in those planes, so execution and outbound network consequences cannot be independently assessed.
  • Only bounded, secret-free HTTP summaries were available; exact paths, headers, query strings, and raw response bodies were not exposed.

Recommended actions

  1. Confirm whether the source cluster and time window correspond to an approved scanner, penetration test, uptime monitor, or inventory job.
  2. Review the full retained gateway sequence and expected public route inventory to determine whether any probed routes exposed unintended content; do not infer sensitivity from status code alone.
  3. If unauthorized, apply proportionate gateway controls such as rate limiting, route allowlisting where feasible, and temporary blocking based on validated infrastructure policy.
  4. Monitor the source cluster and target for follow-on authentication attempts, exploit-pattern requests, anomalous process execution, or new outbound flows.
  5. If the activity is authorized, document the scanner and tune narrowly scoped allowlisting or detection exceptions rather than disabling surface-enumeration monitoring globally.