Now Live! Project Swarm: Join the Collective. Defend the Edge
.png){kind=spacer}
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: July 13 – July 20, 2026
A matched pair of web crawlers sharing one client fingerprint probed NGINX UI and LiteSpeed Cache for two critical unauthenticated flaws that leak administrative credentials, private keys, or session material, running the same toolkit from two different hosting providers. In parallel, an RDP brute force cohort spread across three networks under one transport fingerprint, a fresh host masked command injection probes as Googlebot traffic, and a secret harvesting pair was linked by a shared fingerprint. Every primary source ran on short-lived rented hosting.
Two crawlers, 159.89.117.80 (DigitalOcean) and 161.97.74.198 (Contabo), ran an identical toolkit against NGINX UI (CVE-2026-27944) and LiteSpeed Cache (CVE-2024-44000), both CVSS 9.8 flaws that disclose credentials, keys, or session material. They share one JA4H fingerprint, and the credential exposure risk sat in this mid-volume pair, not the week's highest-volume sources.
The remote desktop cohort reported last week on a single hosting block spread across AS215929, AS35042, and AS49434 while keeping one shared transport fingerprint. Each host runs 95% or more RDP crawling with a small brute force fraction. A per-ASN block lags the next provider hop; a detection on the shared JA4T plus RDP crawling behavior is the control that survives it.
A BytePlus host, 101.47.13.192, appeared one day before the window closed and wrapped command injection and configuration file collection inside traffic impersonating Googlebot. The single day lifespan and search engine cover are the tradecraft; organizations that allowlist Googlebot by user-agent should verify inbound claims against Google's published crawler ranges.
The source 213.209.159.175, tracked across prior briefs, was linked this week to a second host on AS208137, 213.209.159.154, by a shared client fingerprint. Both share the same JA4H and sweep exposed web apps for .env files, Git and SVN configuration, and framework debug interfaces. The newly linked second node is the development, not a new discovery.
.png)
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
At The Edge is GreyNoise's weekly intelligence brief produced exclusively for customers incorporating complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations. At The Edge Clear is a preview highlighting a couple insights and is available to the public.
Analysis Period: July 13 – July 20, 2026
A matched pair of web crawlers sharing one client fingerprint probed NGINX UI and LiteSpeed Cache for two critical unauthenticated flaws that leak administrative credentials, private keys, or session material, running the same toolkit from two different hosting providers. In parallel, an RDP brute force cohort spread across three networks under one transport fingerprint, a fresh host masked command injection probes as Googlebot traffic, and a secret harvesting pair was linked by a shared fingerprint. Every primary source ran on short-lived rented hosting.
Two crawlers, 159.89.117.80 (DigitalOcean) and 161.97.74.198 (Contabo), ran an identical toolkit against NGINX UI (CVE-2026-27944) and LiteSpeed Cache (CVE-2024-44000), both CVSS 9.8 flaws that disclose credentials, keys, or session material. They share one JA4H fingerprint, and the credential exposure risk sat in this mid-volume pair, not the week's highest-volume sources.
The remote desktop cohort reported last week on a single hosting block spread across AS215929, AS35042, and AS49434 while keeping one shared transport fingerprint. Each host runs 95% or more RDP crawling with a small brute force fraction. A per-ASN block lags the next provider hop; a detection on the shared JA4T plus RDP crawling behavior is the control that survives it.
A BytePlus host, 101.47.13.192, appeared one day before the window closed and wrapped command injection and configuration file collection inside traffic impersonating Googlebot. The single day lifespan and search engine cover are the tradecraft; organizations that allowlist Googlebot by user-agent should verify inbound claims against Google's published crawler ranges.
The source 213.209.159.175, tracked across prior briefs, was linked this week to a second host on AS208137, 213.209.159.154, by a shared client fingerprint. Both share the same JA4H and sweep exposed web apps for .env files, Git and SVN configuration, and framework debug interfaces. The newly linked second node is the development, not a new discovery.
GreyNoise customers get detailed briefs with complete IOCs, infrastructure attribution, detection guidance, and role-based recommendations every week.
Request a demo to learn more about GreyNoise's data and intelligence.
