DESCRIPTION LAST UPDATED: 2024-08-16
DEFAULT SEVERITY LEVEL: HIGH
This report identifies hosts that have been observed performing HTTP-based scanning activity, including exploitation attempts.
HTTP scanning may be a benign activity — for example, it may be a search engine indexing the web, a research project, or an organization like the Shadowserver Foundation looking for open or vulnerable services that it can report to National CERTs and network owners so that they can remediate their networks.
Other scans, however, may be part of a network reconnaissance in the preparatory phase of an attack or exploit attempts coming from a botnet that is actively looking to infect new sites or devices. Popular targets include various IoT (routers, nas, webcam devices) or VPN devices, CMS systems, Application Servers, Application Delivery Controllers or mail servers (such as Microsoft Exchange).
The HTTP report type, originally introduced as part of the EU Horizon 2020 SISSDEN Project has been extended under the INEA CEF VARIoT project.
It now features detailed information on attacks observed against HTTP honeypots, including CVE , CVSS score, MITRE ATT&CK tactic and technique mappings, affected vendor and product information and other exploit information that can be associated with the collected HTTP requests.
You can learn more on the report in our Honeypot HTTP Scanner Events Report tutorial.
You can view information about many of the attacks seen on our Dashboard, for example the Known Exploited Vulnerabilities.
You can learn more on our reports in general in our Overview of Free Public Benefit Shadowserver Reports presentation, which also explains example Use Cases.
Severity levels are described here.
Filename: event4_honeypot_http_scan
