RedTail libredtail-http scanner chaining multiple web exploit families

ills3c Intel&Coffee@Ills3C

•updated today•0•0•1

Detects web requests originating from the RedTail botnet user-agent 'libredtail-http' attempting to exploit two or more distinct vulnerability families (such as Apache path traversal, PHP-CGI argument injection, PHPUnit eval-stdin, and ThinkPHP pearcmd) from a single source IP.