Hackers attack Russian company websites by disguising themselves as SI bots ChatGPT, DeepSeek and Claude
Prepared by Sintelligent with the help of SI. Publication time restored from the build log. . Updated: .
SI agents have become such familiar visitors to websites that attackers are already disguising themselves as them: traffic can no longer be trusted by a bot's "name" alone.
Solar WAF, a service of the Solar group, has recorded malicious requests with a spoofed DeepSeekBot User-Agent header since August 12, and with ChatGPT-User, Perplexity-User, Claude-User and GrokBot since August 27. The bet is that site owners filter SI assistants' traffic more leniently as a valuable source of customers. Among such requests, 53% are DNS rebinding attempts, 12% data exfiltration, 4% path traversal, and the rest SQL injections and other techniques.
Sources 2