Observed arrival · 2026-11-10
A field report on exposed ISP looking-glass servers
A security investigation describes unauthenticated command execution found across exposed hyperglass instances and assesses the reported reach of the access.
○Open
⊠Login
$Paid
†Ads
✦Pretty
●Pro
◎Niche
◉Human
⚑Risk
ƒJS
- For
- Network operators and infrastructure security teams
- Worth noticing
- The author says the scan covered 3,693 PeeringDB URLs and found 36 hosts with command execution across 20 ASNs.
Field notes
The author says the search combined 3,693 PeeringDB looking-glass URLs with Shodan queries, finding 388 live instances and 36 hosts with command execution. The report counts 11 hosts at root or root-equivalent access across 20 ASNs, but says most were collectors or edge virtual machines rather than forwarding cores. It distinguishes a router-behavior test run against an emulator from findings described on live systems.
Observed signals
Read the marks
Editorial observations of this landing page, not a rating.
○OpenPublic substance visible
✦PrettyNotable craft visible
◎NicheUnusually specific use
One card from the complete issue