Scans for Solana (Surfpool?) Endpoints, (Mon, Aug 10th)
This report describes scanning activity targeting Solana blockchain API endpoints, specifically those related to the 'surfpool' implementation used for development and testing. The scans attempt to enumerate API endpoints by sending JSON-RPC requests to common paths such as /solana, /jsonrpc, /rpc, /v1, and /. The scanning also includes attempts to access files that may contain credentials, such as .env files. The activity appears to be reconnaissance rather than exploitation, with no known exploits or vulnerabilities reported. The scans are observed on port 80, likely assuming a proxy or API gateway mapping to the backend Solana API, which typically listens on port 8899.
AI Analysis
Technical Summary
The observed activity involves scanning for Solana blockchain API endpoints, particularly those used by the 'surfpool' development environment. Attackers send JSON-RPC requests like 'getHealth', 'getVersion', and 'eth_chainId' to various paths to fingerprint and enumerate available API services. The scans also probe for sensitive configuration files such as .env variants. The requests are directed to port 80, suggesting the use of a proxy or gateway that maps these requests to the actual Solana API backend. No vulnerabilities or exploits are identified in this scanning activity; it is reconnaissance aimed at discovering accessible Solana API endpoints and potentially sensitive files.
Potential Impact
There is no direct impact reported from this scanning activity. The scans are reconnaissance attempts to identify Solana API endpoints and potentially sensitive files. No exploitation or compromise has been observed or reported. If successful, such reconnaissance could be a precursor to targeted attacks, but no vulnerabilities or exploits are documented here.
Mitigation Recommendations
No specific vulnerabilities or exploits are reported, and no patch or fix is applicable. Network defenders should monitor for unusual scanning activity targeting Solana API endpoints and restrict access to sensitive files such as .env configurations. Proper API gateway configurations and access controls can help prevent unauthorized access. Since this is reconnaissance, no urgent remediation is required beyond standard access restrictions and monitoring.
Scans for Solana (Surfpool?) Endpoints, (Mon, Aug 10th)
Description
This report describes scanning activity targeting Solana blockchain API endpoints, specifically those related to the 'surfpool' implementation used for development and testing. The scans attempt to enumerate API endpoints by sending JSON-RPC requests to common paths such as /solana, /jsonrpc, /rpc, /v1, and /. The scanning also includes attempts to access files that may contain credentials, such as .env files. The activity appears to be reconnaissance rather than exploitation, with no known exploits or vulnerabilities reported. The scans are observed on port 80, likely assuming a proxy or API gateway mapping to the backend Solana API, which typically listens on port 8899.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The observed activity involves scanning for Solana blockchain API endpoints, particularly those used by the 'surfpool' development environment. Attackers send JSON-RPC requests like 'getHealth', 'getVersion', and 'eth_chainId' to various paths to fingerprint and enumerate available API services. The scans also probe for sensitive configuration files such as .env variants. The requests are directed to port 80, suggesting the use of a proxy or gateway that maps these requests to the actual Solana API backend. No vulnerabilities or exploits are identified in this scanning activity; it is reconnaissance aimed at discovering accessible Solana API endpoints and potentially sensitive files.
Potential Impact
There is no direct impact reported from this scanning activity. The scans are reconnaissance attempts to identify Solana API endpoints and potentially sensitive files. No exploitation or compromise has been observed or reported. If successful, such reconnaissance could be a precursor to targeted attacks, but no vulnerabilities or exploits are documented here.
Defensive Guidance
No specific vulnerabilities or exploits are reported, and no patch or fix is applicable. Network defenders should monitor for unusual scanning activity targeting Solana API endpoints and restrict access to sensitive files such as .env configurations. Proper API gateway configurations and access controls can help prevent unauthorized access. Since this is reconnaissance, no urgent remediation is required beyond standard access restrictions and monitoring.
Technical Details
- Classification
- {"confidence":0.3,"severitySource":"default","classifier":"rss-v2"}
- Article Source
- {"url":"https://isc.sans.edu/diary/rss/33230","fetched":true,"fetchedAt":"2026-08-10T16:26:15.016Z","wordCount":382}
Threat ID: 6a79fba7bf8831d5391256f6
Added to database: 08/10/2026, 16:26:15 UTC
Last enriched: 08/10/2026, 16:26:27 UTC
Last updated: 08/10/2026, 16:45:19 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.