Web Searches For Archives, (Sun, Sep 14th)
ID: 9791d052-d620-5b87-9a8a-a99ef0c7ac4e
STIX ID: report--9791d052-d620-5b87-9a8a-a99ef0c7ac4e
Feed Name: SANS ISC Diary
Observed via web honeypots, there is an increase in malicious requests for backup and archive files (e.g., backup.zip, web.zip, .tar.zip, backup.sql/json/bak/sh), with user agents and source IPs not matching known researchers; the author concludes this is hostile reconnaissance and recommends ensuring such files do not exist on web servers and implementing policies to avoid exposures (including attempts like 12.34.56.78.zip).
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.