Counter-Recon via Edge Deception
One of the coolest features of Divert is Counter Recon. Any threat that attacks your deception infrastructure gets a light scan back and you get screenshots and details about services listening on what's attacking you.
Most threats know enough to split their attacks sources from their tooling interfaces or at least not to publish their interfaces but often it's pretty interesting regardless. Take INFALLIBLEJEEP6271 for instance, or at least that's what Divert calls the Telegram user "@lamarsilas."
Divert detected and sent block signals for this threat 3.8 seconds after the first interaction. You don't have to log into Divert; stuff needs to just work that way. Auto detection and blocking with no management overhead is main value add in our opinion.
Targeted threat intel about what's attacking your attack surface, not some global sensors, is a very useful threat hunting byproduct. Take Divert's Counter Recon, one of the many signals sources we gather on designated threats. We do some light fingerprinting, banner grabbing, screenshotting, sprinkle in a little AI analysis, and you get a quickly digestible view of what's hosted on the threats that attack you. That screenshot looked interesting enough.
It's a French-built vibe-coded secrets harvesting scanner. Pretty sure the interface is not meant to be public-facing.
It chews through giant lists of IPs and DNS names, probably obtained from Github, and fuzzes them in a very unsophisticated fashion.
It looks for dozens of types of secrets from aws to stripe to vercel, and is capable of verifying whether secrets are valid or not. As unsophisticated as it is, it's successful enough to have netted 180 valid secrets, since last reset. What information and other secrets are behind 180 valid secrets of disparate types? Obviously we didn't follow those threads.
We can redeploy, reload, and delete the VPS instance.
It's also Telegram integrated, which is where this gets interesting.
It sends confirmed hits to a TG group "crack test" as a bot named "@reeeesultat_bot."
The whole operation is run by user, "@lamarsilas."
Here he discusses "cashing out" over some cred associated with a car dealership as Gmail hits flow in.
I woke up this morning after writing this, after accidentally clicking "Redeploy" on the scanner VPS last night. I figured I'd rip through that scanner's SPA, find a janky endpoint, get RCE, and kill this thing. They must have gotten wise because the interface isn't up; however, the TG secret wasn't rotated, so the hits keep coming in.
Is this a sophisticated threat? No. Divert can tell you this one was all-noise, no skill. Are we all good then? Also no. Think about how unsophisticated this threat is versus what they're accomplishing: Not sophisticated enough to keep the scanner interface private yet they've got a TG-integrated secrets harvester, hitting IP and DNS lists at industrial scale. They've got the access but have no idea what to do with it or otherwise monetize it. Just dipping a toe in the water. Imagine 1 million just like this one. Now put this threat on the skill floor at zero and imagine what skilled loners, organized skilled groups, up to nation states are capable of. Offense and defense have always been asymmetrical, with the leverage on the attack side. AI allows offense to exploit faster than AI allows defense to defend.
I'm going to reiterate, that threat-hunting is not what we're all about. Everyone has enough visibility. Public-facing asset cloaking with automatic blocking using your existing stack is what we're about. There will be bugs, you won't have time to patch before MTTE, and you need time.
Blocking this threat and others from accessing real customer assets 3.8 seconds after they attacked a decoy is why we built it. Since the dawn of global connectivity, malicious actors have been able to rattle your doorknobs, check your windows, look in your garage, walk around your lawn, probing for bugs, with absolute impunity, and you've been blind to it.
It's 2026, wouldn't you want to at least know what's going on, if not just stop it all?