Cybersecurity articles tagged #Reconnaissance on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/identifying-origin-ip-addresses-behind-cloudflare-and-waf-serviceshttps://runtimerebel.com/blog/identifying-origin-ip-addresses-behind-cloudflare-and-waf-servicesExamine technical methods used to discover backend origin IPs hidden behind Cloudflare, including DNS history, TLS fingerprinting, and outbound leaks.Mon, 20 Jul 2026 03:26:59 GMTCloudflareReconnaissanceOrigin IpWaf BypassNetwork Securityhttps://runtimerebel.com/blog/scans-target-model-context-protocol-servers-and-ai-credentialshttps://runtimerebel.com/blog/scans-target-model-context-protocol-servers-and-ai-credentialsSecurity researchers observe an increase in scans targeting Model Context Protocol (MCP) servers and AI credentials, potentially exposing sensitive data.Mon, 13 Jul 2026 06:54:49 GMTMCPAnthropicAI SecurityCredential TheftReconnaissancehttps://runtimerebel.com/blog/github-api-abuse-detecting-ghost-account-reconnaissance-campaignshttps://runtimerebel.com/blog/github-api-abuse-detecting-ghost-account-reconnaissance-campaignsThreat actors are leveraging thousands of ghost accounts to map GitHub organizations via API abuse, facilitating future targeted supply chain attacks.Sat, 11 Jul 2026 20:51:29 GMTGitHubAPI SecurityReconnaissanceGhost Accountshttps://runtimerebel.com/blog/github-api-abuse-attackers-map-corporate-orgs-via-dormant-accountshttps://runtimerebel.com/blog/github-api-abuse-attackers-map-corporate-orgs-via-dormant-accountsDatadog Security Labs warns of systematic GitHub API enumeration campaigns using dormant accounts and compromised OAuth tokens to map corporate organizations.Thu, 09 Jul 2026 21:25:09 GMTGitHubAPI AbuseReconnaissanceOAuth TokenSupply ChainDatadoghttps://runtimerebel.com/blog/automated-favicon-ico-reconnaissance-for-host-enumerationhttps://runtimerebel.com/blog/automated-favicon-ico-reconnaissance-for-host-enumerationUnderstand how attackers automate favicon.ico analysis for host reconnaissance. Learn to identify and defend against this common, yet often overlooked, enumeration…Mon, 29 Jun 2026 13:41:34 GMTFavicon IcoReconnaissanceHost EnumerationPentestingThreat IntelligenceWeb Fingerprintinghttps://runtimerebel.com/blog/jdy-botnet-china-linked-campaign-targets-us-military-networkshttps://runtimerebel.com/blog/jdy-botnet-china-linked-campaign-targets-us-military-networksAnalysis of the China-linked JDY botnet's expanded targeting of U.S. military networks, its reconnaissance TTPs, and critical mitigation strategies.Wed, 10 Jun 2026 17:15:50 GMTJDY BotnetVolt TyphoonChina LinkedUS MilitaryReconnaissanceNational Securityhttps://runtimerebel.com/blog/detecting-api-discovery-scans-for-swagger-json-security-guidehttps://runtimerebel.com/blog/detecting-api-discovery-scans-for-swagger-json-security-guideAnalysis of automated scans for swagger.json and OpenAPI files. Learn how to secure RESTful APIs against discovery-based attacks and reconnaissance.Wed, 03 Jun 2026 13:51:10 GMTAPI SecurityReconnaissanceSwaggerOpenAPISANS ISChttps://runtimerebel.com/blog/fbi-disrupts-first-vpn-service-used-by-ransomware-groupshttps://runtimerebel.com/blog/fbi-disrupts-first-vpn-service-used-by-ransomware-groupsThe FBI and international partners dismantled First VPN, a specialized service used by dozens of ransomware groups for reconnaissance and intrusions.Fri, 22 May 2026 13:00:22 GMTFirst VPNRansomwareFbi DisruptionReconnaissanceInitial Accesshttps://runtimerebel.com/blog/emerging-reconnaissance-attackers-actively-probe-ai-modelshttps://runtimerebel.com/blog/emerging-reconnaissance-attackers-actively-probe-ai-modelsDShield sensors detect increasing scanning activity targeting popular AI models like Claude and Hugging Face, signaling a potential new attack vector for threat actors.Wed, 15 Apr 2026 00:46:56 GMTAI ModelsScanningReconnaissanceThreat IntelligenceDShieldHugging FaceClaudeOpenClawhttps://runtimerebel.com/blog/trueconf-zero-day-exploitation-against-asian-governmentshttps://runtimerebel.com/blog/trueconf-zero-day-exploitation-against-asian-governmentsA Chinese threat actor is actively exploiting a TrueConf video conferencing zero-day to conduct reconnaissance and achieve privilege escalation against Asian government…Fri, 03 Apr 2026 16:17:33 GMTTrueConfZero-DayAsian GovernmentPrivilege EscalationReconnaissanceChinese Threat Actorhttps://runtimerebel.com/blog/analysis-of-iranbot-message-in-cowrie-honeypot-logshttps://runtimerebel.com/blog/analysis-of-iranbot-message-in-cowrie-honeypot-logsA peculiar 'iranbot_was_here' message, alongside Telnet logins and portscans, was observed in Cowrie honeypot logs, signaling potential reconnaissance activity.Thu, 19 Mar 2026 04:43:57 GMTCowrieHoneypotTelnetReconnaissanceIranbotDShieldLogginghttps://runtimerebel.com/blog/adminer-phpmyadmin-attacker-scans-target-database-management-toolshttps://runtimerebel.com/blog/adminer-phpmyadmin-attacker-scans-target-database-management-toolsRuntime Rebel observes increased honeypot scans targeting Adminer and phpMyAdmin.Wed, 18 Mar 2026 16:32:57 GMTAdminerphpMyAdminDatabase ManagementHoneypotScanningReconnaissancehttps://runtimerebel.com/blog/analyzing-proxy-scanner-activity-monitoring-proxy-uri-patternshttps://runtimerebel.com/blog/analyzing-proxy-scanner-activity-monitoring-proxy-uri-patternsThreat actors are shifting scanning patterns to identify open proxies using /proxy/ URI prefixes. Learn how to detect and mitigate these reconnaissance scans.Mon, 16 Mar 2026 16:31:05 GMTProxy ScanningReconnaissanceWeb Server SecurityHoneypot AnalysisURI Patternshttps://runtimerebel.com/blog/cyberstrikeai-exploitation-ai-tools-targeting-fortinet-firewallshttps://runtimerebel.com/blog/cyberstrikeai-exploitation-ai-tools-targeting-fortinet-firewallsThreat actors are repurposing CyberStrikeAI to automate reconnaissance and exploit critical vulnerabilities in Fortinet FortiGate firewalls and edge devices.Tue, 03 Mar 2026 00:36:03 GMTCyberStrikeAIFortinetCVE-2024-21762AI Powered AttacksReconnaissancehttps://runtimerebel.com/blog/automated-reconnaissance-targeting-react2shell-implementationshttps://runtimerebel.com/blog/automated-reconnaissance-targeting-react2shell-implementationsAnalysis of a specialized toolkit currently utilized by threat actors to identify and exploit React2Shell vulnerabilities within enterprise network perimeters.Mon, 23 Feb 2026 05:34:37 GMTReconnaissanceReact2ShellRCEExploitation