GreyNoise observed 8,126 sessions containing Interactsh OAST domains between January 10-17, 2026. Analysis identified a primary campaign originating from M247 Europe SRL (AS9009) infrastructure using consistent JA4 fingerprints to probe multiple web application vulnerabilities.
OAST
MCP
projectdiscovery
interactsh
rce
iocs
detection engineering
cybersecurity
Author
🔮Orbie✨
Published
January 18, 2026
Overview
Between January 10, 2026 06:10 UTC and January 17, 2026 04:59 UTC, GreyNoise sensors recorded 8,126 HTTP sessions from 34 unique IP addresses containing Well-known Out-of-band Interaction Domain callbacks. The activity exhibits characteristics of automated vulnerability scanning, with payloads targeting React Server Components, Supervisord XML-RPC interfaces, and router command injection vulnerabilities.
OAST domain extraction and decoding identified 273 Interactsh domains spanning 21 distinct campaign identifiers (k-sort values). The dominant campaign (k-sort: d5i159) generated 79 unique OAST domains and was responsible for 6,637 sessions (82% of total volume). JA4 fingerprint analysis reveals consistent tooling across the campaign, with the most prevalent combination (JA4T: 64240_2-4-8-1-3_1286_7 / JA4H: ge11nn06en00_0e5d97bc8ad6_000000000000_000000000000) observed in 1,853 sessions from a single IP address.
The attack infrastructure demonstrates coordination, with the primary IP (146.70.211.244) conducting sustained scanning over an 11-hour period on January 16. TCP fingerprint analysis shows multiple encapsulation layers (MTU-derived MSS of 1286 indicates 174 bytes of overhead), consistent with VPN or nested tunnel usage. This technical profile is typical of automated security testing tools operating through anonymization infrastructure.
Temporal Analysis
Activity began at low volume (16 sessions on January 10), escalated moderately on January 11 (509 sessions concentrated in a single hour), then dropped to sporadic probing for three days before the primary campaign launched on January 16.
Daily Session Distribution:
Date
Sessions
Unique IPs
Pattern
2026-01-10
16
3
Initial reconnaissance
2026-01-11
509
4
First burst (495 sessions in one hour)
2026-01-12
46
7
Scattered activity
2026-01-13
84
9
Sustained low-volume scanning
2026-01-14
329
11
Mid-level activity
2026-01-15
19
3
Minimal activity
2026-01-16
7,123
10
Primary campaign burst
The January 16 activity shows sustained high-volume scanning from 09:00-14:00 UTC (808-865 sessions/hour) from the primary IP (146.70.211.244), followed by continued activity from multiple IPs through 22:00 UTC. The single-IP phase maintained consistent fingerprints, while the multi-IP phase (15:00-22:00 UTC) introduced fingerprint diversity, suggesting either tool configuration changes or involvement of additional scanning nodes.
Decoded OAST timestamps from the primary campaign (d5i159) align closely with sensor observation times, indicating real-time exploitation attempts rather than replayed traffic.
Campaign Analysis
Campaign 1: M247 High-Volume Scanning (Primary)
Sessions: 6,637 (82% of total)
Unique IPs: 1 primary (146.70.211.244)
Infrastructure: AS9009 (M247 Europe SRL), United States geolocation
Dominant Fingerprints: Multiple JA4H variants with same JA4T
Duration: Single hour burst (2026-01-11 21:00 UTC)
Characteristics: Rapid-fire scanning concentrated in 60-minute window
Campaign 3: Namecheap Infrastructure
Sessions: 310 (4% of total)
Unique IPs: 1 (209.74.86.209)
Infrastructure: AS22612 (Namecheap Inc.), United States
OAST Campaigns: d5i66f (29 domains), others
Fingerprints: Similar to Campaign 1 with variations
Characteristics: Distributed over multiple days
Minor Campaigns
An additional 21 campaigns were identified with session counts ranging from 4-115, originating from Microsoft Azure, Cloudflare, various hosting providers, and residential ISPs. These exhibit less coordination and may represent opportunistic scanning or independent security testing.
Payload Analysis
Payload examination reveals three primary vulnerability classes being targeted:
1. React Server Components (RSC) Exploitation
Exploit Type: Prototype pollution leading to remote code execution Sessions: ~300+ (detected in Campaign 1 and 2) Method: POST with multipart form-data exploiting __proto__ chain Payload Characteristics: - Manipulates React Server Actions response objects - Executes process.mainModule.require('child_process').execSync() - Downloads and executes shell script from Pastebin - OAST callback embedded in command execution chain
Targets CVE-2017-11610 (Supervisord XML-RPC RCE) and related vulnerabilities.
3. Router/IoT Command Injection
Exploit Type: Web interface command injection Sessions: ~100+ Method: POST to administrative interfaces Payload Characteristics: - Targets /syscmd.htm and similar endpoints - Uses wget or curl with OAST domains - Common in router and embedded device exploitation
M247 Europe (AS9009) is a bullet-proof hosting provider frequently associated with automated scanning and low-reputation traffic. The infrastructure concentration suggests either a single operator with multi-provider redundancy or multiple actors sharing common tooling and OAST services.
MSS of 1286 is anomalous. Standard Ethernet MTU (1500) yields MSS of 1460. Observed MSS suggests: - 174 bytes overhead from multiple encapsulation layers - Likely nested VPN or tunnel configuration - Consistent with operational security practices for scanning infrastructure
Attribution Assessment
Confidence: Medium
This activity is consistent with automated vulnerability scanning by security researchers, bug bounty hunters, or opportunistic threat actors using commercial/open-source tooling.
Evidence supporting assessment:
Tooling Indicators:
Interactsh OAST service is publicly available and widely used by security testers
Burst pattern on single day suggests scheduled/triggered scanning
No evidence of post-exploitation activity (no callback responses observed)
OAST usage for vulnerability confirmation is standard in both offensive security and threat actor TTPs
What we know: - Activity originates from bullet-proof hosting and cloud infrastructure - Scanning targets known CVEs with OAST-based detection - Infrastructure demonstrates operational security (VPN tunneling)
What we infer (lower confidence): - Single operator or coordinated group based on timing and infrastructure overlap - Purpose is vulnerability detection (could be defensive testing or offensive reconnaissance) - No evidence of successful exploitation or post-compromise activity in sensor data
Block or alert on OAST callback domains in outbound DNS/HTTP traffic. Implement detection for *.oast.site, *.oast.fun, and related Interactsh domains. Legitimate security testing should be coordinated and expected; uncoordinated callbacks indicate unauthorized scanning or successful exploitation.
Monitor for JA4 fingerprint combinations associated with this campaign. Deploy network sensors capable of JA4 fingerprinting and alert on primary indicators (JA4T: 64240_2-4-8-1-3_1286_7 combined with listed JA4H values) from unexpected sources.
Prioritize patching for targeted vulnerabilities:
CVE-2024-46982 (React Server Components RCE) - patch Next.js to latest versions
CVE-2017-11610 (Supervisord XML-RPC RCE) - disable XML-RPC or update Supervisord
Block POST requests to /__nextjs_original-stack-frame with __proto__ in body
Block XML-RPC requests to /RPC2 containing supervisor.supervisord.options
Rate-limit and inspect POST requests to /syscmd.htm and similar admin endpoints
Alert on wget, curl, nslookup commands in URL-encoded POST bodies
Review firewall rules for M247 Europe (AS9009) and other identified ASNs. Consider blocking or rate-limiting traffic from bullet-proof hosting providers unless business need exists.
Audit for successful exploitation: Search logs for OAST domain callbacks in DNS queries, HTTP requests, or command execution logs. Any callback indicates the vulnerability is present and exploitable.
GNQL Queries
Find IPs targeting your organization with OAST domains:
