Plan
archived
NTP Pool Servers Abused to Harvest and Scan IPv6 Client Addresses
- Engineer — Plan: If your systems query the NTP Pool and expose IPv6 addresses, those addresses may be harvested and subsequently port-scanned or enumerated by rogue pool members. Plan to evaluate replacing NTP Pool entries with specific trusted NTP servers (cloud-provider NTP, dedicated stratum-2 servers) in IPv6-enabled environments.
- SOC/IR — Learn: The research identifies a mechanism — rogue NTP Pool membership — by which adversaries can build targeted IPv6 address lists for reconnaissance; useful context for understanding scanning sources, but no specific IOCs or ATT&CK-mapped TTPs are provided here for immediate detection work.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.