AI-Agent-Driven Mass Exploitation Attempts Against PaperCut Instances

Ibrahim Saud@tektrix

•updated Sep 17, 2026•0•0•3

This rule detects potential scanning activity by identifying high-frequency network connection attempts from a source to multiple distinct internal targets within a short 2-minute time window, specifically targeting suspicious ports (9191, 9192) or a known malicious IP address (45.142.193.132).