🤖 Overview

muhstik-scan is an open-source IoT vulnerability scanner maintained by the Muhstik project on GitHub (repository: github.com/muhstik/muhstik-scan). The tool is designed to probe network-attached devices for known remote code execution flaws, particularly those in routers and IP cameras, to help security researchers and network defenders identify recoverable weaknesses. It feeds findings into a central database used for threat intelligence and patch prioritization.

🌐 Technical Behavior

The scanner operates by sending HTTP GET and POST requests to random IP addresses across public ranges, targeting specific URI paths such as /cgi-bin/, /goform/, and /cmd. Each request includes a crafted payload to test for vulnerabilities like CVE-2014-8361 (Netgear router command injection) and CVE-2017-17215 (Huawei HG532 RCE). Scan frequency is aggressive, often exceeding 100 requests per second from a single source IP, with bursts lasting 30–60 seconds before rotating. IP addresses are drawn from a large pool of residential and cloud providers, making blocking by range impractical. The scanner uses HTTP/1.1 and does not adhere to any scheduling or polite crawling standards.

📋 robots.txt Compliance

muhstik-scan does not honor robots.txt files, as it targets device-level endpoints that are not part of a website’s crawl surface. The tool’s documentation explicitly states that it scans arbitrary IP hosts, not domain-based paths where robots directives apply.

🔍 Detection Indicators

The identifying User-Agent string is Muhstik/1.0 or Muhstik-scan/1.0 (variant: Muhstik-scan/2.0). Requests also lack standard headers like Accept-Language and Referer. Behavioral fingerprinting reveals patterns: three successive GET requests to /, /cgi-bin/, and /goform/ within 500ms, followed by a POST with a large payload containing shellcode.

📊 Data Usage

Collected data—vulnerable device IPs, firmware versions, and exploit outcomes—are aggregated into a public threat intelligence feed maintained on the Muhstik GitHub Wiki. Researchers use this feed to track patch adoption rates and to create Shodan-like search filters for exposed devices.

⚙️ Rate Limiting Policy

Although legitimate, muhstik-scan’s high request rate and random IP behavior can saturate web application resources. Rate limiting is justified by RFC 6585 (429 Too Many Requests) guidance; thresholds of 50 requests per 10 seconds from a single IP treat the scanner as a non-compliant but permissible agent.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the bots listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.