Scans for "adminer", (Wed, Mar 18th)

SANS ISC diary entries (Mar 12–18, 2026) reporting multiple web threat observations: widespread scans targeting Adminer (an alternative to phpMyAdmin) seen in honeypots; frequent /proxy/ URL probing and use of IPv4-mapped IPv6 addresses (RFC 4038) likely used to obfuscate attacker origin; a phishing kit built with React that exfiltrates credentials via the EmailJS service; and a SmartApeSG campaign delivering the Remcos RAT via a ClickFix page. These items indicate active reconnaissance, proxy-abuse probes, client-side credential theft, and commodity RAT distribution.