CuraSec

tag: Reconnaissance · 2 items

Plan Mass vuln scans spoofing AI crawler user-agents (ClaudeBot etc.)
2026-08-13 · HN (vulnerability) · source ↗ #reconnaissance#evasion#threat-intel
  • Engineer — Learn: Attackers are masking vulnerability scans behind AI bot user-agents to evade rate-limiting and WAF rules that allowlist crawlers; review whether your WAF/edge allows AI bot UAs without scrutiny and consider tightening controls.
  • SOC/IR — Plan: Build or tune detections to flag AI crawler user-agents (e.g. ClaudeBot, GPTBot) associated with high request rates or vulnerability-scanning patterns; hunt web access logs for these UAs performing non-crawl behavior since this technique is actively in use.
  • Leader — Skip
Plan archived NTP Pool Servers Abused to Harvest and Scan IPv6 Client Addresses
2026-07-27 · arXiv cs.CR · source ↗ #ipv6#ntp#reconnaissance
  • Engineer — Plan: If your systems query the NTP Pool and expose IPv6 addresses, those addresses may be harvested and subsequently port-scanned or enumerated by rogue pool members. Plan to evaluate replacing NTP Pool entries with specific trusted NTP servers (cloud-provider NTP, dedicated stratum-2 servers) in IPv6-enabled environments.
  • SOC/IR — Learn: The research identifies a mechanism — rogue NTP Pool membership — by which adversaries can build targeted IPv6 address lists for reconnaissance; useful context for understanding scanning sources, but no specific IOCs or ATT&CK-mapped TTPs are provided here for immediate detection work.
  • Leader — Skip