Back to evidence

Sanitized live incident

Reconnaissance

Native source identity and targetable endpoints are private.

mediumopen
Confidence
92%
First seen
Aug 18, 10:05:56 AM PDT
Evidence through
Aug 18, 10:07:55 AM PDT
AI status
Complete
Likely true positive91% confidence

The evidence supports the detector's reconnaissance finding: one derived source cluster sent a broad, rapid sequence of requests to target privatekind using multiple HTTP methods and distinct route hashes. Representative requests include GET, POST, and OPTIONS against API and other route categories, with varied 200/401/404/405/422 responses. This is consistent with automated surface and method enumeration. Authorization and source identity are unresolved, so the activity could be sanctioned testing or inventory rather than hostile reconnaissance. No process or flow evidence is cited by this incident, so no execution, persistence, lateral movement, outbound callback, or other post-reconnaissance consequence is established.

Attack stage
Reconnaissance — HTTP route and method enumeration
Model
gpt-5.6-sol · 7 evidence calls

Observed impact

  • Potential disclosure of which routes exist, require authentication, reject methods, or return content; no verified post-reconnaissance impact is established.

Deterministic signals

Http.surface enumeration92%

Broad unauthenticated route and HTTP method enumeration observed

122 observations · 12 http

Explicit uncertainty

  • The source key is a traffic cluster, not a guaranteed person or single agent; it may represent a proxy, NAT gateway, or multiple workers.
  • Network evidence does not establish whether this enumeration was authorized security testing, benign inventory, or hostile reconnaissance.
  • The incident cites no process-plane or flow-plane event IDs. Consequently, the required process and flow evidence lookups could not retrieve corroborating events, leaving execution and outbound-network consequences unassessed.
  • The bounded HTTP summaries expose hashes and metadata rather than raw response content, so the significance of the sampled 200 response cannot be determined from this evidence alone.

Recommended actions

  1. Confirm whether the source cluster and time window correspond to an approved scanner, penetration test, monitoring system, or inventory job.
  2. If unauthorized, apply proportionate rate limiting or temporary source controls and continue monitoring for authentication attempts, exploit payloads, or repeated access to routes that returned content.
  3. Review application and authentication telemetry around the incident window, prioritizing the route that returned HTTP 200 and any subsequent requests associated with the same workload or traffic cluster.
  4. Validate that sensitive and administrative routes require authentication and that unsupported methods return minimal, consistent responses without unnecessary route disclosure.
  5. Do not infer compromise or initiate high-impact containment solely from this reconnaissance alert; escalate if process, flow, credential-use, or application evidence establishes a consequence.