Scanning Webserver with /$(pwd)/ as a Starting Path, (Sun, Jan 25th)

Based on the sensors reporting to ISC, this activity started on the 13 Jan 2026. My own sensor started seeing the first scan on the 21 Jan 2026 with limited probes. So far, this activity has been limited to a few scans based on the reports available in ISC [5] (select Match Partial URL and Draw):

This article has been indexed from SANS Internet Storm Center, InfoCON: green

Read the original article: