Scanners often leave recognisable request patterns as their source IPs change. A multipart boundary, user-agent string and HTTP header pattern can help you find related requests across addresses. Identifying the operators behind matching markers takes additional evidence.
In a review of HTTP logs from 08:00 to 11:23 AEDT on 22 October 2026, the multipart boundary bissa_cve_boundary appeared from 67 source IPs. A second marker, ----WebKitFormBoundaryx8jO2oVc6SWP3Sad, appeared from four more. The marker sets did not overlap in this window.
Start with the request pattern
The bissa_cve_boundary marker appeared with Python/aiohttp user agents and a Chrome 126 browser string. The Python strings included Python/3.12 aiohttp/3.14.5 and Python/3.11 aiohttp/3.8.4. GeoIP organization labels included Google, The Constant Company and RouterHosting. These values help group requests for investigation.
The fixed WebKit boundary appeared with Chrome-like user agents and fasthttp. A December 2025 Umbraco forum report contains the same value. The DFIR Report's Bissa investigation describes Bissa tooling used in React2Shell exploitation and credential harvesting. Our separate Bissa scanner analysis explains what the marker shows in our request logs.
Our PHP2Shell probe analysis also followed 169.58.51.5, which used the user-agent Mozilla/5.0 (php2shell-check/1.0) and sent two PHP2Shell boundary variants. Those requests matched our upload-progress field protection and excessive-argument-count protection. The user-agent is a useful search term because clients supply that value themselves.
JA4H summarizes HTTP properties such as the method and version, ordered header names, and cookie characteristics. A multipart boundary appears in the Content-Type header value and separates parts in the body. Search that value alongside JA4H. We calculated JA4H from saved HTTP headers using FoxIO's reference implementation. For the request captured by one of our honeypots from 94.154.43.7, we derived:
po11nn060000_d09ed10a732b_000000000000_000000000000
This gives another comparison point alongside route, boundary and timing.
Search a short time window first
Start with a narrow time window and the request path you expect a scanner to use. The example reads Content-Type and User-Agent from logs.client_logs and returns a small sample. Change the time window and path for your service.
WITH
arrayFirst(x -> lower(x.1) = 'content-type', request_headers).2 AS content_type,
arrayFirst(x -> lower(x.1) = 'user-agent', request_headers).2 AS user_agent
SELECT
time,
client,
httpstatuscode,
content_type,
user_agent
FROM logs.client_logs
PREWHERE
path = '/'
AND time >= toDateTime('2026-10-22 08:02:00', 'Australia/Sydney')
AND time < toDateTime('2026-10-22 08:03:00', 'Australia/Sydney')
WHERE
positionCaseInsensitive(content_type, 'bissa_cve_boundary') > 0
OR positionCaseInsensitive(content_type, '----WebKitFormBoundaryx8jO2oVc6SWP3Sad') > 0
ORDER BY time
LIMIT 200
SETTINGS
max_threads = 1,
max_memory_usage = 268435456,
max_bytes_to_read = 268435456,
max_execution_time = 10;
After finding candidates, compare the exact boundary, user-agent and header order across addresses. For JA4H comparisons, use the same calculation method and capture point. A related honeypot case traced exposed environment-file decoys to SMTP login attempts in 22 seconds.
Use the patterns to improve protection
Use repeated request behavior to guide investigation or a WAF policy. For example, compare requests carrying the same unusual multipart boundary, then review their part structure, route, method, user-agent, header order and timing. Check matches against ordinary application uploads before tightening a rule. Browser libraries reuse multipart conventions, and legitimate clients can share cloud infrastructure. For practical WAF review, see our guide to tuning a WAF.
Observed source addresses
The lists below contain the source IPs for each boundary in the review window. The named PHP checker above is a separate observation.
bissa_cve_boundary
108.61.198.98
136.119.51.159
136.66.201.20
136.70.7.252
136.86.224.157
144.172.118.88
149.28.87.17
149.28.88.68
172.86.86.97
192.248.183.92
199.247.11.20
202.182.103.216
207.148.6.134
207.148.72.68
207.246.119.104
34.1.212.165
34.1.222.89
34.105.14.173
34.118.165.147
34.26.99.252
34.65.6.231
34.7.103.220
34.79.227.19
34.79.37.185
34.80.224.185
34.81.174.226
35.187.41.240
35.189.134.239
35.192.65.236
35.194.107.148
35.196.110.183
35.196.45.0
35.204.7.231
35.206.193.48
35.206.201.46
35.206.218.173
35.213.119.33
35.213.2.73
35.213.69.245
35.213.7.240
35.213.87.236
35.215.139.208
35.215.145.83
35.215.167.171
35.223.246.134
35.232.5.44
35.233.103.194
35.236.172.48
35.243.109.51
35.245.122.12
45.32.205.118
45.76.139.160
45.77.225.79
45.77.71.57
45.77.82.159
64.176.45.104
64.176.71.20
64.177.112.216
64.177.126.251
64.177.42.195
65.20.109.164
65.20.110.253
65.20.114.174
66.135.2.244
70.34.248.35
80.240.29.16
95.179.222.141
----WebKitFormBoundaryx8jO2oVc6SWP3Sad
185.177.72.100
34.76.218.47
34.79.163.248
34.79.34.197
