Scans Targeting Hospitality Applications

1. Executive summary

A single source IP, 94.102.49.125 (IP Volume, AS202425), has been conducting HTTP reconnaissance against hospitality-sector web applications since 15 September 2026, using the distinctive User-Agent Farez-Sorter/1.0 and enumerating paths associated with PBX in a Flash Hospitality Management System (PIAF-HMS) alongside generic hotel/admin endpoints. PIAF-HMS is an abandoned project — last updated roughly ten years ago — with a publicly reported SQL injection issue and, per the reporting analyst's own code review, no input validation and no authentication or access control. No exploitation, payload delivery, or compromise is confirmed in the source material; this is scanning activity only. No VERIFIED REFERENCE DATA was resolved for this item, so no CVSS score, severity rating, or CISA KEV exploitation state can be asserted. Direct risk to EMEA financial services is low unless a client operates or exposes a PIAF-HMS instance or similar legacy hospitality/PBX-adjacent web application; the material concern is the targeting pattern (soft-target sectors, PBX focus, bulletproof-hosted infrastructure) rather than any demonstrated capability against financial infrastructure.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. The source describes internet-wide reconnaissance against third-party hospitality applications with no confirmed exploitation, no confirmed impact on any client's ICT systems, and no confirmed third-party service disruption. Mapping this to DORA Art. 17/18/19 or NIS2 Art. 23 would require an actual ICT-related incident at a client, which the source does not evidence. Clients should treat this as threat intelligence input to existing vulnerability and exposure management, not as a reportable event.

3. Technical analysis & attack chain

Confirmed steps (as observed by the reporting analyst)

1. Scanning host 94.102.49.125 issues HTTP GET requests to internet-facing web servers, first observed 15 September 2026 and continuing through 16 September 2026.
2. Requests carry the User-Agent Farez-Sorter/1.0 and Accept-Encoding: gzip.
3. The first observed request was GET /PIAF-HMS/ HTTP/1.1 — a direct probe for the PBX in a Flash Hospitality Management System web root.
4. The analyst pivoted on the User-Agent and identified additional requests from the same activity: /admin/, /admin/config.php, /ucp/, /hms/, /hotel/.
5. All observed scanning activity in the source traces to the single source IP 94.102.49.125.

That is the full extent of confirmed activity. No exploitation step, no payload, no post-exploitation behaviour, no persistence, no command-and-control, no lateral movement, and no data access or exfiltration is described in the source.

Target application — PIAF-HMS. The scanned application is the "PBX in a Flash Hospitality Management System," hosted at github.com/claudiopizzillo/PIAF-HMS. Per the source: the last update (addition of a license file) was approximately ten years ago and the project should be considered abandoned. A SQL injection vulnerability was publicly reported "a couple of months ago" — the source gives no CVE identifier, no CVSS score, no affected version, and no patch, and no VERIFIED REFERENCE DATA was resolved for this item, so none can be supplied here. The reporting analyst states that a scan of the code shows "many more" injection issues, that the author "does not believe in input validation at all," and that no authentication or access control is visible. The analyst also raises the possibility that the code was never used in production and may have been a lab/experiment for Asterisk PBX integration — this is the analyst's speculation, not a finding, and cuts against assuming widespread exposed instances.

Infrastructure. 94.102.49.125 is attributed to IP Volume (AS202425), characterised in the source as "often considered a bulletproof hoster." That characterisation is the source's, not independently corroborated here.

Analyst assessment of intent (speculative, flagged as such). The source speculates that hotels are "soft targets" for personal-data theft, that compromised hospitality environments have been used to launch man-in-the-middle attacks against guests, and that a PBX foothold could let an attacker appear to call from "inside" the property. These are hypotheses offered by the reporting analyst to explain the targeting pattern. They are not supported by observed exploitation in this item and should not be treated as established tradecraft.

Confidence caveat. This entire item rests on a single source — one SANS ISC diary entry by one analyst, based on that analyst's own sensor telemetry and code review. The IP attribution, the bulletproof-hoster characterisation, the enumeration list, and the vulnerability claims are all single-sourced. Verify before acting on any of it beyond passive monitoring.

4. Mitigation & containment

P1 — within 24 hours

• Search web/proxy logs for the User-Agent Farez-Sorter/1.0 and for requests to /PIAF-HMS/, /admin/config.php, /ucp/, /hms/, /hotel/ from 94.102.49.125 or any source. Treat hits as reconnaissance, not compromise, but escalate for triage.
• If any PIAF-HMS instance is exposed on a client network: take it offline or place it behind authentication immediately. The source states the application has no authentication or access control and no input validation, and that the project is abandoned with no upstream fix path. There is no vendor patch to apply — decommission or network-isolate is the only remediation.
• Block or alert on 94.102.49.125 at the perimeter. Note this is a single-source indicator on bulletproof-hosting infrastructure; expect rotation and do not treat the block as durable.

P2 — within 72 hours

• Inventory internet-facing web applications for legacy hospitality, PBX, and telephony-adjacent software, including Asterisk/PBX-in-a-Flash derivatives. Any such asset that is abandoned upstream and unauthenticated should be scheduled for decommissioning.
• Confirm that PBX and telephony management interfaces are not reachable from the public internet and are segmented from guest networks and from corporate data networks. The source's PBX-focus observation is the reason to check this specifically.
• Review whether any hospitality-facing or guest-network estate sits in the same trust zone as corporate systems; the source's MitM-against-guests hypothesis, while unconfirmed, is a segmentation argument regardless.

P3 — within 7 days

• Add the User-Agent and path set to standing detection (§6) rather than relying on the IP alone.
• Where legacy web applications cannot be removed, front them with an authenticating reverse proxy and a WAF rule set that rejects requests to the enumerated paths from untrusted sources.

5. Indicators of compromise

All indicators are single-sourced from one SANS ISC diary entry; verify before enforcement. No file hashes, domains, or malware artefacts are present in the source material.

ipv4  94.102.49[.]125
user-agent  Farez-Sorter/1.0
uri  /PIAF-HMS/
uri  /admin/
uri  /admin/config.php
uri  /ucp/
uri  /hms/
uri  /hotel/
asn  AS202425

6. Detection

The source provides genuine request artefacts (User-Agent string and enumerated URI paths), which are sufficient for both a YARA rule over captured HTTP request data and a Sigma rule over web server access logs.

rule APT_Scanner_FarezSorter_Hospitality_Probe
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-16"
        reference = "https://isc.sans.edu/diary/rss/33344"
        description = "Detects HTTP request artefacts associated with Farez-Sorter/1.0 scanning of PIAF-HMS and hospitality web paths"
    strings:
        $ua = "Farez-Sorter/1.0" ascii wide nocase
        $p1 = "/PIAF-HMS/" ascii wide
        $p2 = "/admin/config.php" ascii wide
        $p3 = "/ucp/" ascii wide
        $p4 = "/hms/" ascii wide
        $p5 = "/hotel/" ascii wide
    condition:
        $ua or 2 of ($p*)
}

title: Farez-Sorter User-Agent Hospitality Web Path Scanning
id: 8f2c1a44-7d3e-4b91-9c05-6a1e2f9b7d10
status: experimental
description: Detects HTTP requests using the Farez-Sorter/1.0 User-Agent or enumerating PIAF-HMS and hospitality management paths, as reported in SANS ISC diary 33344.
author: Adverse Trace
date: 2026/09/16
references:

    - https://isc.sans.edu/diary/rss/33344
logsource:
    category: webserver
detection:
    selection_ua:
        cs-useragent|contains: 'Farez-Sorter/1.0'
    selection_paths:
        cs-uri-stem:

            - '/PIAF-HMS/'
            - '/admin/config.php'
            - '/ucp/'
            - '/hms/'
            - '/hotel/'
    condition: selection_ua or selection_paths
fields:

    - c-ip
    - cs-method
    - cs-uri-stem
    - cs-useragent
falsepositives:

    - Legitimate administrative access to a /admin/ or /hotel/ path on an unrelated application
level: medium

Note: /admin/, /hms/ and /hotel/ are generic enough to generate false positives on their own; the User-Agent match is the high-fidelity signal. Field names follow the common web-server log schema — adjust cs-useragent / cs-uri-stem to your log pipeline's field naming.

7. Sources

• Johannes B. Ullrich, Ph.D., SANS Internet Storm Center — "Scans Targeting Hospitality Applications" — https://isc.sans.edu/diary/rss/33344 — 2026-09-16
• Referenced project (cited within the source): PBX in a Flash Hospitality Management System — https://github.com/claudiopizzillo/PIAF-HMS

8. Adverse Trace position

We assess this as low-severity, single-sourced reconnaissance activity with no confirmed exploitation and no confirmed impact on any client environment. No VERIFIED REFERENCE DATA was resolved for this item, so we make no CVSS or severity assertion and no CISA KEV claim; the SQL injection referenced by the source carries no CVE, score, or patch in the material available to us. The attribution of 94.102.49.125 to IP Volume (AS202425) and its characterisation as a bulletproof hoster are the source's alone and are unconfirmed by us; no threat actor is named and no MITRE ATT&CK profile is available, so no attribution is made. The practical value here is the detection artefact set — a distinctive User-Agent and a small path list — and the reminder that abandoned, unauthenticated web applications remain reachable and are being enumerated. Clients with no PIAF-HMS or legacy PBX exposure can close this out after a log search; clients with such exposure should treat decommissioning as the remediation, since no upstream fix exists. We will monitor for follow-on reporting that confirms exploitation, additional source infrastructure, or a CVE assignment for the PIAF-HMS injection issue, and will reissue if any of those materialise.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.