Looking at today’s weblogs from our honeypot, I noticed one IP in particular, %%ip:83.97.73.89%%, scanning for “/geoserver” related URLs. This isn’t new, and we have seen researchers, in particular Shadowserver, looking for similar URLs at least since the beginning of the year.
Article Link: https://isc.sans.edu/diary/rss/29926