The observed activity involves scanning for Solana blockchain API endpoints, particularly those used by the 'surfpool' development environment. Attackers send JSON-RPC requests like 'getHealth', 'getVersion', and 'eth_chainId' to various paths to fingerprint and enumerate available API services. The scans also probe for sensitive configuration files such as .env variants. The requests are directed to port 80, suggesting the use of a proxy or gateway that maps these requests to the actual Solana API backend. No vulnerabilities or exploits are identified in this scanning activity; it is reconnaissance aimed at discovering accessible Solana API endpoints and potentially sensitive files.

There is no direct impact reported from this scanning activity. The scans are reconnaissance attempts to identify Solana API endpoints and potentially sensitive files. No exploitation or compromise has been observed or reported. If successful, such reconnaissance could be a precursor to targeted attacks, but no vulnerabilities or exploits are documented here.

No specific vulnerabilities or exploits are reported, and no patch or fix is applicable. Network defenders should monitor for unusual scanning activity targeting Solana API endpoints and restrict access to sensitive files such as .env configurations. Proper API gateway configurations and access controls can help prevent unauthorized access. Since this is reconnaissance, no urgent remediation is required beyond standard access restrictions and monitoring.