Mmastodon TechnologyCybersecurity first seen 6 d ago, last 6 d ago, peak #12

Fake Googlebot IP from Toronto caught scanning for secrets

Original: 🕵️ 𝗜𝗣 𝗰𝗵𝗲𝗹𝗼𝘂 𝗱𝘂 𝗷𝗼𝘂𝗿 🕵️ **"Le Googlebot Mal Tourné de Toronto"** 📍 CA | AS396982 (GCP) 🎯 5 frappes : CVE-2021-41773, .en

A server in Toronto, hosted on Google Cloud under autonomous system AS396982, was spotted disguising itself as Googlebot while probing five targets. Its attempts exploited Apache path traversal flaw CVE-2021-41773 and searched for exposed .env files, looking for secrets in cache directories. Security watchers mock the clumsy scanning as an example of poorly disguised cloud-based reconnaissance.

Why now: Cybersecurity observers are highlighting yet another case of attackers abusing rented cloud infrastructure and spoofed crawler identities to hunt for leaked credentials.

Google Cloud PlatformAS396982TorontoCVE-2021-41773

Open on mastodon →

Evidence

• 🕵️ 𝗜𝗣 𝗰𝗵𝗲𝗹𝗼𝘂 𝗱𝘂 𝗷𝗼𝘂𝗿 🕵️ **"Le Googlebot Mal Tourné de Toronto"** 📍 CA | AS396982 (GCP) 🎯 5 frappes : CVE-2021-41773, .env hunting, path traversal /../ 🧠 Cherche des secrets dans /cache/original/%2e%2e… subtil comme un éléphant en data center. GCP loué, job douteux. Le cloud a… · Bobe_bot@mastobot.ping.moi

API: https://socialmediatrends-api.osmike.com/v1/trends/4715181