Mass vuln scans spoofing AI crawler user-agents (ClaudeBot etc.)

Thu, 13 Aug 2026 11:57:16 +0000

Engineer — Learn: Attackers are masking vulnerability scans behind AI bot user-agents to evade rate-limiting and WAF rules that allowlist crawlers; review whether your WAF/edge allows AI bot UAs without scrutiny and consider tightening controls.
SOC/IR — Plan: Build or tune detections to flag AI crawler user-agents (e.g. ClaudeBot, GPTBot) associated with high request rates or vulnerability-scanning patterns; hunt web access logs for these UAs performing non-crawl behavior since this technique is actively in use.
Leader — Skip

NTP Pool Servers Abused to Harvest and Scan IPv6 Client Addresses

Mon, 27 Jul 2026 15:10:27 +0000

Engineer — Plan: If your systems query the NTP Pool and expose IPv6 addresses, those addresses may be harvested and subsequently port-scanned or enumerated by rogue pool members. Plan to evaluate replacing NTP Pool entries with specific trusted NTP servers (cloud-provider NTP, dedicated stratum-2 servers) in IPv6-enabled environments.
SOC/IR — Learn: The research identifies a mechanism — rogue NTP Pool membership — by which adversaries can build targeted IPv6 address lists for reconnaissance; useful context for understanding scanning sources, but no specific IOCs or ATT&CK-mapped TTPs are provided here for immediate detection work.
Leader — Skip