Angriffsfall

KI-/MCP-Endpunkt-Jaeger (Cursor mcp.json, GraphQL, OpenAPI)

10.08.2026 · Credential/Secret-Harvester · 178 Anfragen · Dauer 5 s · Vereinigte Staaten

Überblick

Klassifizierung: Credential/Secret-Harvester
Angriffsmuster: Config-/Secret-Leak, KI-/API-Probe, PHP-Scan, Shell-/RCE-Probe, Admin-Login-Suche, WordPress-Scan
Herkunft: Vereinigte Staaten · Google LLC
Werkzeug (User-Agent): Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user

178 Anfragen in 5 s von [IP], User-Agent Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; Perplexity-User/1.0; +https://perplexity.ai/perplexity-user. Signaturen: Secret-Harvest.

Erkannte Signaturen

Secret-Harvest: Zugangsdaten/Secrets absaugen (34 Treffer)

Der Angriff, nachgespielt

echter Mitschnitt unserer Fake-Shell; die Antworten sind erfunden, ausgefuehrt wurde nie etwas

root@srv01: ~

root@srv01:~$ GET /
root@srv01:~$ GET /z9x8c7v6b5-debug-trigger-[Sensor]
root@srv01:~$ GET /webpack-stats.json
root@srv01:~$ GET /rclone.conf
root@srv01:~$ GET /.aws/credentials
root@srv01:~$ GET /dist/manifest.json
root@srv01:~$ GET /.git/config
root@srv01:~$ GET /.git/HEAD
root@srv01:~$ GET /asset-manifest.json
root@srv01:~$ GET /.aws/config
root@srv01:~$ GET /static/manifest.json
root@srv01:~$ GET /manifest.json
root@srv01:~$ GET /assets/manifest.json
root@srv01:~$ POST /graphql
{"query":"{ __schema { types { name fields { name args { name defaultValue } } } } }"}
root@srv01:~$ GET /de
root@srv01:~$ GET /id_dsa
root@srv01:~$ GET /__/firebase/init.json
root@srv01:~$ GET /.git-credentials
root@srv01:~$ GET /id_ed25519
root@srv01:~$ GET /.gitconfig

Ablauf

(25 von 178, Wiederholungen zusammengefasst)

Zeit	Methode	Pfad / Payload	Muster
+0 s	GET	/
+0 s	GET	/z9x8c7v6b5-debug-trigger-[Sensor]
+0 s	GET	/webpack-stats.json
+0 s	GET	/rclone.conf
+0 s	GET	/.aws/credentials	Config-/Secret-Leak
+0 s	GET	/dist/manifest.json
+0 s	GET	/.git/config	Config-/Secret-Leak
+0 s	GET	/.git/HEAD	Config-/Secret-Leak
+0 s	GET	/asset-manifest.json
+0 s	GET	/.aws/config	Config-/Secret-Leak
+0 s	GET	/static/manifest.json
+0 s	GET	/manifest.json
+0 s	GET	/assets/manifest.json
+0 s	POST	/graphql {"query":"{ __schema { types { name fields { name args { name defaultValue } } } } }"}	KI-/API-Probe
+0 s	GET	/de
+0 s	GET	/id_dsa
+0 s	GET	/__/firebase/init.json
+0 s	GET	/.git-credentials	Config-/Secret-Leak
+0 s	GET	/id_ed25519
+0 s	GET	/.gitconfig	Config-/Secret-Leak
+0 s	POST	/api/graphql {"query":"{ __schema { types { name fields { name args { name defaultValue } } } } }"}	KI-/API-Probe
+0 s	GET	/id_rsa
+0 s	GET	/de/beitrag/84
+0 s	GET	/config.json	Config-/Secret-Leak
+0 s	GET	/.gitlab-ci.yml	Config-/Secret-Leak