Likely not required for untargeted internet scanning. CERT-In's 2022 directions list targeted scanning or probing of critical networks and systems as reportable — review if this activity appears targeted at your organisation.
The decoy contained no real personal data, so no personal data breach has occurred under the DPDP Act.
⚠ BUT ACT NOW: an attacker is actively probing your environment. Complete the “Recommended immediate actions” checklist below within the next hour. If that investigation finds any real system was accessed, reporting clocks apply — measured from your original detection time (14 Jul 2026, 01:42 AM IST).
This is guidance, not legal advice. When in doubt, consult your compliance advisor — this report contains everything they need.Someone was scanning around a fake copy of your monitored asset, looking for weaknesses. Your real monitored asset was never touched — the fake one exists precisely to catch this. The source is a private address, so it may be a container or cloud address rather than your office network; the checklist below shows how to tell.
CyberSharcX raised this alert 1 second after the attack began.
Private address — internal network ranges not configured; this may be a container or cloud address.
- ☐ 1Identify the source IP (172.20.0.2): it is a private address and your internal network ranges are not configured. Check whether it belongs to a container, cloud network or load balancer on your side. If it is part of your office network, find the device using it and add the range under Settings.
- ☐ 2Check your REAL systems for the same attacker: search authentication logs on real servers for IP 172.20.0.2 and username "administrator / admin / root" over the last 7 days. Any hit means treat this as a real compromise — and the CERT-In filing pack below becomes the one to send.
- ☐ 3Kill the easy paths: disable or rename default admin usernames on real systems; enforce strong passwords + MFA on all remote access.
- ☐ 4Preserve this report and the evidence below unaltered — if this escalates, regulators expect records kept unaltered. CyberSharcX retains a copy with hash ed8c99ca5f18… (full hash in the Evidence Appendix).
- ☐ 5No customer or regulator communication is needed at this stage.
Likely not required at this stage — kept ready in case investigation finds real system access. IF filing becomes necessary: the 6-hour window runs from your original detection time — i.e., file by 14 Jul 2026, 07:42 AM IST. Partial information within the window is acceptable; supplement later.
Integrity: SHA-256 ed8c99ca5f18bbfbd09f98696860b56f46c4496c063c9cf8835ad6d9f833accc · retained by CyberSharcX for at least 365 days.
{
"path": "/.git/config",
"method": "GET",
"headers": {
"host": "shree-textiles-http-decoy:8080",
"user-agent": "python-requests/2.32.3"
},
"timestamp": "2026-07-13T20:12:12.364731+00:00"
}This decoy was never connected to any real system or real customer data. No real asset was compromised.This report was generated automatically by CyberSharcX at the moment of detection and is designed to contain everything your compliance officer or advisor needs. It is guidance, not legal advice.
CyberSharcX Private Limited · CIN: U62099UP2026PTC248390 · www.cybersharcx.in