Romanian Distillery Scanning for SMTP Credentials, (Tue, Mar 4th)
ID: 8409d369-0829-5212-b574-babd6ae4dc3c
STIX ID: report--8409d369-0829-5212-b574-babd6ae4dc3c
Feed Name: SANS ISC Diary
Threat Score
SANS FirstSeen observed an ongoing scanning campaign (originating from IP 193.41.206.202) probing web servers for exposed credential files such as smtp_tokens.json and smtp_keys.json across multiple endpoints and dates; the IP maps to a Romanian company and is likely a compromised host used for reconnaissance to find secrets on exposed web servers.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.