/proxy/ URL scans with IP addresses, (Mon, Mar 16th)
ID: fe10ec26-4493-5dc5-b6b4-56593db36834
STIX ID: report--fe10ec26-4493-5dc5-b6b4-56593db36834
Feed Name: SANS ISC Diary
Threat Score
Honeypot logs show repeated proxy-style requests targeting the cloud metadata service (169.254.169.254) and related paths (e.g., /latest/meta-data/iam/security-credentials/) using IPv6-mapped IPv4, expanded zeroed IPv6 notation, and integer IP encodings to bypass filters; the intent is to retrieve instance IAM credentials via SSRF or proxy forwarding.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.