Introduction

Welcome to the August 2024 installment of the Sensor Intelligence Series, our monthly summary of vulnerability intelligence based on distributed passive sensor data.

Last month, we observed the scanning for CVE-2017-9841 fell sharply, and this month is no different, with scanning for that vulnerability falling another 79% from July’s rate. Overall, it’s down 97.4% from its high-water mark in June of 2024.

CVE-2023-1389, an RCE vulnerability in TP-Link Archer AX21 consumer routers, which has been consistently towards the top of our ranking, is now the most scanned for CVEs that we track, but it too is down from last month, falling off by 18.8% compared to July.

Researching an Aberration

We frequently look for anomalies not related to specific CVE scanning activity in our logs, and this month, we found one that’s worth mentioning.

We first noted that the overall level of scanning was up significantly from the month prior, having risen 90.9% in terms of total events observed.

Digging into this a bit, we were surprised to find that the top source and destination country combination was scanners located in Lithuania scanning US sensors. This is unusual, and became even more unusual when we found that the vast majority (99.9%) of that traffic was from just one IP address.

That IP address is 141.98.11.114, with a reverse DNS lookup of “srv-141-98-11-114.serveroffer.net”. Serveroffer.net appears to be a hosting infrastructure provider based out of the city of Kaunas, in Lithuania.

We looked back a bit further, across the whole of 2024 in fact, and we found that this IP has been scanning quite a lot but not very consistently.
 

Table 1: Scanning activity of 141.98.11.114, broken out by month and day. Note that the scanning behavior is not constant and seems to happen a few days at a time.

We were initially expecting to find this IP scanning for a specific set of vulnerabilities, or at least a class of vulnerability, but this scanner seems to be trying to pull a lot of odd URLs.

There are 83,193 distinct URLs being scanned for by this IP, the majority of which appear to have a file extension present, for example “GET /kolomz.exe”. We’ve published this list to our github as “141.98.11.114_unique_urls.txt”. This immediately made us wonder if this scanner was attempting to find malware hosting sites, as many malware loaders we observe in our data follow a similar naming scheme. Its User-Agent header of “BotPoke” also was an interesting breadcrumb to follow.
 

Table 2: Analysis of file extensions present in scanned urls by 141.98.11.114

We found a few references online, some dating as far back as 2010, to a scanner exhibiting similar behavior, with the same User-Agent string, so this doesn’t seem to be anything out of the ordinary, except for the intensity of the scanning activity and the use of a single IP address.

We expanded our search for unique URLs by looking for any URL associated with the User-Agent “BotPoke”, and we’ve published a full list of the unique URLs found, all 105,797 of them, to our github repo as “full_list_PokeBot_URLs.txt”.

Both the published lists may be useful for threat hunting in web environments, as they contain names of common malware loaders, but please be aware that these files likely contain all sorts of filetypes, ranging from malware loaders, to cracked games, and much else besides. Please use these lists with caution, and we make no guarantees of correctness.

August Vulnerabilities by the Numbers

Figure 1 shows July attack traffic for the top ten CVEs that we track. CVE-2017-9841 has fallen off to 4^th place, and CVE-2023-1389 has retaken the top spot. Also notable is the disappearance of CVE-2021-28481 from the top 10, and the appearance of CVE-2020-0618.

The regular movement on this graph is not surprising – scanning for different vulnerabilities varies significantly month to month.