⚠️ Overview

InfoGuardDisclosureResearch is an automated information-disclosure scanner that masquerades as an InfoGuard research project. It has no official vendor documentation, and InfoGuard AG does not list it as a product; threat-intel feeds from Sucuri and Imperva treat it as a malicious crawler. The agent appears to be maintained by an unknown operator and is frequently rotated across compromised IP addresses.

🔧 Technical Capabilities

The scanner performs HTTP-based forced browsing to discover sensitive endpoints: /.git/HEAD, /.env, /backup.zip, /db.sql, /wp-config.php.bak, /phpinfo.php, /.svn/entries, and /server-status. It emits both HEAD and GET requests, then analyzes response headers, status codes, and body patterns to distinguish a live file from a soft-404. It supports basic directory traversal payloads, path normalization, and extension fuzzing. It attempts to extract Git revision data, database dumps, and environment variable secrets. It uses low request rates, randomizes HTTP Accept and Accept-Language headers, and rotates source IPs to avoid WAF rate-limit triggers. It sometimes follows up with log4j and Laravel debug-mode probes if a framework is detected.

📜 History & Notable Incidents

No CVE is assigned because this is a reconnaissance tool, but the behavior maps directly to CWE-200 (https://cwe.mitre.org/data/definitions/200.html) and is tested by OWASP WSTG-CONF-02 (https://owasp.org/www-project-web-security-testing-guide/). The identifier first appeared in public web logs around 2021 during scans of university and newspaper sites. Some captures listed by URLScan.io show the UA string being used from hosting ASNs associated with phishing infrastructure.

🔍 Detection Indicators

Known User-Agent values are InfoGuardDisclosureResearch, InfoGuardDisclosureResearch/1.0, and Mozilla/5.0 (compatible; InfoGuardDisclosureResearch). Behaviorally, it requests rare paths like /.git/config and /app/config.php without first fetching the homepage, sends no Referer, and uses Accept: */*. It also creates an obvious file-check sequence for common backup extensions.

☠️ Risk & Impact

A successful probe exposes source code, cloud credentials inside .env files, database credentials, and private keys. This information can lead to unauthorized database access, remote code execution, or supply-chain compromise. Even a 403 response during probing discloses server stack details because the scanner fingerprints Server and Set-Cookie headers.

🛡️ Mitigation

This bot is blocked immediately because it is an established threat-intelligence signature and produces no legitimate site traffic. Blocking by user agent, IP reputation, and path rules prevents automated disclosure probing from ever reaching the application layer.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.