TI-2026-060C — The Method Is the Message

Classification: HIGH · Technique Analysis Confidence: HIGH — direct sensor evidence + primary-source exploit corroboration (Metasploit, CVE-2017-7269, RFC 4918/7231) TLP:WHITE — external attacker infrastructure named in full; operator internals redacted. Series: The 200 That Lied — Part C. Part A pierced the status. Part B mapped the host. This part reads the verb — the one field that carries an attack neither status nor path can express.

The cold open: 2,084 knocks in five minutes, and not one of them a page

At 05:28:07 UTC on 26 June 2026, a machine at 91.103.251.94 began asking our server a question. It asked it 2,084 times in five minutes — roughly seven times a second — and then stopped. Every request was the same shape:

CONNECT  <host>:<port>  HTTP/1.1
User-Agent: Mozilla/5.0 … (a browser)

Look for this attack the way the rest of the industry looks and it is not there.

• A status dashboard sees a wall of bland rejections. Nothing turned red. No 500, no 403 spike worth an alert.
• A path-matching WAF — the WAF that ships a thousand rules for /.env and /wp-login.php — has nothing to match. A CONNECT target is not a URL. It is a host:port. There is no path, no query string, no signature-able string. The rule engine is looking at an empty page.
• A user-agent filter is actively deceived: the request claims to be a Mozilla browser. No browser has issued a raw CONNECT flood in the history of the web, but the costume is on.

Three of the industry's four first-pass triage signals — status, path, user-agent — are blind or lied to. The fourth signal, the only one that carries the entire meaning of these 2,084 requests, is the one almost nobody scores: the HTTP method itself.

CONNECT asks the server to stop being a website and become a tunnel — to open a raw pipe to an arbitrary host:port and relay whatever comes through (RFC 7231 §4.3.6). A flood of it is an open-proxy test: the machine at 91.103.251.94 was checking, seven times a second, whether our server would agree to anonymise its onward traffic — spam, credential-stuffing, the next victim's attack — behind our IP. The verb is not describing the request. The verb is the request.

The thesis: a third axis

This series has been an argument that the fields defenders trust are lower-dimensional than the attacks they face.

• Part A showed the status code is a costume: a 200 can hide a 401 or a 404. We reconstructed effective_status.
• Part B showed the host is a surface: 244 guessed subdomains, all answered 200 by a catch-all. We mapped host_type.

Part C completes the coordinate system. The method — the verb — is a third axis, orthogonal to both. There exists a class of request whose status is uninformative, whose path is unsignatureable, and whose host may be real — and whose entire hostile meaning lives in the one token at the very front of the request line. If you do not score the verb, you cannot see these attacks at all. Not "you see them dimly." You are structurally, geometrically blind to them, because you are projecting a three-dimensional attack onto two axes that happen to exclude it.

Our sensor scores the third axis. Here is what stood on it.

CONNECT: the open-proxy relay, and why it is invisible

The CONNECT census is stark: one IP, 2,084 hits, five minutes. No swarm — the method-cluster detector found zero coordinated clusters, because this is a lone hammer, not a botnet. The carrier is AS201884, ISP SUPPORT LLC, Armenia — a small RIPE-region hosting LLC with a thin entity-graph footprint, the disposable origin behind a customer running an open-proxy scanner.

Why does open-proxy abuse matter enough to hammer seven times a second? Because an open relay is a laundering machine. If our server had said yes, the attacker gains an IP that is not theirs to route: spam that passes SPF because it comes from us, credential-stuffing that evades rate-limits because each attempt wears a different borrowed address, attacks whose forensic trail ends at a victim who was only ever a tunnel. The CONNECT flood is the reconnaissance for that theft of reputation.

And every property that makes it dangerous also makes it invisible to conventional detection:

Four columns say "nothing to see." The fifth says everything. We score the fifth.

WebDAV: reconnaissance for a webshell — and the recidivists return

The second population on the method axis is quieter in volume and louder in intent. Six IPs issued WebDAV verbs — PROPFIND, PUT, PROPPATCH, MKCOL — a total of dozens of requests, led by 46.151.178.13 (AS211443) at 48. This is not noise. It is a specific hunt: a writable upload surface.

WebDAV is HTTP's file-management extension (RFC 4918). A PUT that succeeds means you can write a file to the server; a PROPFIND that returns 207 Multi-Status means WebDAV is enabled and worth attacking. The endgame is a webshell — and this is a documented, weaponised chain, not a hypothetical. The Metasploit module webdav_upload_php detects WebDAV with a PROPFIND probe and then PUTs a PHP shell. The module iis_webdav_scstoragepathfromurl turns a long-header PROPFIND into remote code execution on IIS 6.0 — that is CVE-2017-7269, a PROPFIND-to-RCE that ran wild for years. (Sources: OSINT library — Metasploit modules; CVE-2017-7269, researchers Zhiniang Peng & Chen Wu.)

Here is the detail that should make a status-based defender put the coffee down: the exploit modules themselves document that a PROPFIND probe returns 207 on a vulnerable server and 405 elsewhere (RFC 4918 §9.1). Read that again. The reconnaissance step of an IIS remote-code-execution exploit produces a 207 Multi-Status — a success code — on the machines it is about to own. There is no 4xx for a dashboard to catch. The most dangerous outcome wears the most reassuring status.

And now the thread ties back. Two of the six WebDAV probers are carriers we have already met in this very series:

• 45.198.224.245 → AS215925, VPSVAULT.HOST, Seychelles
• 143.20.185.242 → AS214209, INTERNET-MAGNATE (UAE/Romania/US)

Both are members of the Part B benign-on-404 census — the offshore recidivists that hide at a 0.00 404-rate. Here they are again, on a completely independent axis, doing WebDAV RCE reconnaissance. That is not a coincidence to be waved away. Cross-axis convergence is the strongest attribution signal in this entire series: an operator that both hides on the status axis (Part B) and probes on the method axis (Part C) is not an ambiguous blip. It is the same hand, seen from two angles, and the two angles agree.

OPTIONS *: the third proxy tell

A footnote that is really a preview. 51 IPs issued OPTIONS requests — most are benign CORS pre-flight, the ordinary chatter of the modern web. But OPTIONS * (asterisk-form) is the other classic open-proxy probe, the polite cousin of the CONNECT hammer, and absolute-URI GET http://other-host/ is the third. The method axis is not one signal; it is a family — CONNECT, OPTIONS *, absolute-URI, and the WebDAV verbs — unified by a single property: the hostility is in the verb or the request-form, not in anything a path or status can hold.

The seven questions

Who is this? On the CONNECT axis, a lone open-proxy scanner behind a small Armenian carrier (AS201884). On the WebDAV axis, six webshell-hunters — including two offshore recidivists (VPSVAULT-SC, INTERNET-MAGNATE) already named in Part B.

Why did it attack? To steal reputation (open proxy) and to find a writable surface for a webshell (WebDAV). Both are enabling attacks — the step that makes the next crime cheaper and less attributable.

Who does it claim to be? The CONNECT hammer claims to be a browser. A browser has never issued a raw CONNECT flood. The claim is the tell.

Whom is it related to? The WebDAV probers tie directly to the offshore cohort of Part B — same ASNs, different axis. The method dimension does not introduce new unknowns so much as it re-identifies known operators through a second lens.

Where is the money? An open relay is resold by the gigabyte on proxy markets; a confirmed WebDAV upload becomes an initial-access-broker listing. The method probes are the cheap reconnaissance that prices those products.

What is the official anchor? A RIPE-region Armenian LLC, a Seychelles LTD, a multi-jurisdiction ASN. Documented anchors, all — and all silent, because a CONNECT rejection and a PROPFIND 207 gave their abuse desks nothing to see.

What if it is not who it claims / what is hidden? See below.

What if…

• What if the CONNECT flood is a misconfigured client, not an attack? A misconfigured client retries a destination it wants. This one fired 2,084 CONNECTs at guessed/non-existent hosts in five minutes and vanished. Misconfiguration persists and repeats a target; a scan sprays and leaves. This sprayed and left.
• What if the WebDAV requests are legitimate sync clients (Nextcloud, Office)? Legitimate WebDAV clients authenticate first and speak to their own server. These arrived unauthenticated, from Seychelles and UAE hosting ranges, at hosts they have no account on. A sync client does not shop for writable strangers.
• What if scoring the method just re-flags traffic other axes already caught? The opposite: the CONNECT hammer carried a browser UA, a rejection status, and no path — every other axis scored it benign or blank. The method axis is the only one that saw it. It adds coverage, it does not duplicate it.

Steelman: the strongest case against reading the verb

"HTTP methods are mostly benign. OPTIONS is just CORS. Servers reject CONNECT and unknown WebDAV verbs automatically, so there is no real risk — the method is handled at the protocol layer, not the threat layer. You are inflating harmless protocol chatter into an attack surface, and you will drown analysts in OPTIONS pre-flight noise."

The strongest version, and it is right about one thing: most OPTIONS is noise. Here is where it fails:

• We do not score the benign verbs; we score the anomalous ones. OPTIONS pre-flight is explicitly not the signal — OPTIONS *, CONNECT, absolute-URI and the WebDAV write-verbs are. The taxonomy already separates the chatter from the tells; the 51-IP OPTIONS population is noted precisely so it can be excluded.
• "The server rejects it" is not "the threat is handled." A rejected CONNECT still tells the attacker whether you are an open relay (a slow rejection, a specific error, a timeout — all are answers). A PROPFIND that returns 405 still tells them WebDAV is off here so move on. The protocol layer answering the question does not stop the question from being reconnaissance — it is the reconnaissance's reply.
• The convergence proves it is not noise. If method-probing were harmless protocol chatter, it would come from everywhere at random. Instead its WebDAV cohort overlaps the offshore recidivist cohort from an independent axis. Noise does not correlate with a named threat population. Signal does.

The steelman concedes the OPTIONS noise; we conceded it first, by not scoring it. Everything it needs to be wrong about — CONNECT, WebDAV, the convergence — survives. Confidence: HIGH.

Read between the lines

The quiet horror of Part C is the 207. Across this series the recurring villain has been a success code standing where a warning should be — the 200 of Part A, the catch-all 200 of Part B, and now the 207 Multi-Status that an IIS server about to be owned by a PROPFIND overflow returns to its attacker. Three different success codes, three different layers, one identical function: to tell the defender that nothing happened while the attacker learns everything. The web did not evolve these behaviours to deceive defenders. It evolved them for convenience — auth SPAs, wildcard routing, WebDAV compliance — and the attacker simply noticed that convenience and camouflage are the same shape. Every success code that makes a system easier to use makes an attack against it easier to hide.

Read the browser user-agent on the CONNECT hammer, too. The attacker went to the trouble of forging a Mozilla string on a request that no Mozilla has ever sent. Why bother? Because they know the game: they know defenders filter on user-agent, so they dress the request for the one inspection they expect — and leave the one field they know nobody reads, the method, telling the truth in plain sight. They hid the lie where people look and left the truth where they don't.

The human layer

An open proxy has no victim in the logs and a hundred victims downstream. The person harmed by the CONNECT hammer is not us — we said no. It is the mail server that will reject a real customer because our IP got listed after someone else's relay leaked; the account that gets stuffed by attempts wearing borrowed addresses; the investigator who traces an intrusion back to an IP that turns out to have been only a tunnel, the trail cold at an innocent hop. And the WebDAV hunt's victim is the small business running an old IIS box it forgot about, whose PROPFIND 207 will one day become someone else's shell — with no alert, because the reconnaissance returned success. The method axis matters because the people it protects are always one server removed from the log you are reading, and the attack that reaches them started as a verb nobody scored.

Defense — score the verb, ban the tell

Three controls fall out of the method axis, and all three are live on the sensor: (1) proxy_abuse (CONNECT / OPTIONS * / absolute-URI) and webdav_abuse (PUT/DELETE/PROPFIND/PROPPATCH/MKCOL/COPY/MOVE) are scored as intents independent of status and path — the verb alone sets the label. (2) Both are HIGH-severity autoban intents: because no legitimate visitor open-relays or WebDAV-probes an unauthenticated stranger, the false-positive floor is near zero, and the ban fires on the evidence, not the volume. (3) The convergence itself is a control — an IP that lights up on the method axis is cross-checked against the host and status axes, and agreement across two independent dimensions escalates it from suspicious to attributed. The verb is the tell; we stopped letting it hide at the front of the line.

Investigation metadata

Next in the series — TI-2026-060D: The Redirect That Told the Truth — the ?rd= parameter, where an Authelia-intercepted 200 hides the scanner's real target in plain sight, and how decoding it turns the auth-proxy's own mechanism into a confession.

Status can be forged, paths can be dodged, user-agents can be worn like a mask. The method sits at the very front of the request, the first word out of the attacker's mouth — and it is the one word they forget to lie about, because they are certain no one is listening. We listened.