How I accidentally framed myself for a hacking frenzy
Summary: PortSwigger researcher James Kettle released Collaborator Everywhere, an open source Burp extension that spoofs a domain name in outbound traffic to detect servers vulnerable to IP address spoofing via headers like X-Forwarded-For. Because some users ran the tool while bruteforcing passwords on vulnerable sites, those servers misattributed the attacks to id.burpcollaborator.net at 52.16.21.24, generating an Amazon EC2 abuse report against PortSwigger's server. Kettle fixed the extension to use spoofed.uniq-id.burpcollaborator.net, which resolves to 127.0.0.1, and revoked the old version.
Key Takeaway: One researcher's diagnostic tool generated abuse reports for hundreds of simultaneous attacks across thousands of websites, and some of those sites sat on private internal networks where the spoofed traffic looked like an intrusion and a pivot attempt. The attribution your logs record may point at infrastructure that never sent the attack.
Read the original at PortSwigger Research ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026