As cited
Copy frozen at (site build).
threat intel
Scans for Solana (Surfpool?) Endpoints
Security researchers observed reconnaissance scans targeting Solana blockchain API endpoints, using JSON-RPC requests to probe for exposed services and test connectivity via port 80. The scans attempt to fingerprint Solana endpoints and enumerate other common API paths, while also probing for exposed credential files. This activity suggests attackers are mapping accessible Solana infrastructure to identify targets for exploitation.
Why it matters: Organizations running Solana nodes, API gateways, or blockchain infrastructure should monitor for and restrict these reconnaissance patterns; developers using Solana should ensure backend APIs are not exposed on public-facing ports or lack proper authentication.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Scans for Solana (Surfpool?) Endpoints
No summary had been written when this copy was frozen.
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
threat intel
Scans for Solana (Surfpool?) Endpoints
Threat actors are scanning for exposed Solana blockchain application programming interfaces (APIs) and related endpoints across the internet, sending JSON-RPC requests to detect development environments like Surfpool. The scans target multiple paths including /solana, /jsonrpc, /rpc, and /v1 on port 80, and also probe for configuration files like .env that might contain credentials.
Why it matters: Developers and DevOps teams running Solana nodes or API gateways need to verify their endpoints are not exposed to the internet and that configuration files containing secrets are not accessible, as attackers are actively mapping targets for potential compromise.
- Source published
- First seen by Cybersecurity Tracker