What happened to FOFA.info?
On September 4, 2026, FOFA.info, one of the most widely used internet asset search engines in the cybersecurity field, began experiencing massive failures. Users from different parts of the world reported HTTP 520 and HTTP 525 errors, which indicate problems in communication between origin servers and the content delivery network (CDN).
The hacktivist group known as ANKA RED TEAM (also identified as AnkaTeam) issued a statement claiming responsibility for the attack. However, there has been no official confirmation from FOFA.info administrators or cybersecurity authorities so far.
What is FOFA.info?
FOFA.info is a cyberspace search engine, similar to Shodan or Censys. It allows security researchers and analysts to find internet-connected devices, such as servers, IP cameras, routers, and other systems, through advanced filters. It is a fundamental tool for vulnerability assessment and threat intelligence.
What do HTTP 520 and 525 errors mean?
These error codes are specific to Cloudflare's network, which acts as an intermediary between the user and the origin server. The 520 error indicates that the origin server returned an empty or unexpected response, while the 525 error points to a failure in the SSL/TLS security protocol. Both suggest that FOFA.info's server is overloaded or blocking connections, which is consistent with a distributed denial-of-service (DDoS) attack.
| Error code | Meaning | Possible cause |
|---|---|---|
| 520 | Empty response from origin server | Overload, server crash, or IP blocking |
| 525 | SSL/TLS handshake failure | Incorrect configuration or attack on certificates |
The role of ANKA RED TEAM
ANKA RED TEAM is a hacktivist collective that has gained notoriety in recent months for its actions against critical infrastructures and surveillance platforms. Its name references the ANKA, a Turkish-made reconnaissance drone, suggesting a possible link to Turkey's geopolitical interests. However, there is no conclusive evidence about its origin or funding.
The group typically uses DDoS attacks and vulnerability exploitation techniques to highlight its demands, which range from defending privacy to opposing online censorship.
Impact and reactions
As of this writing, FOFA.info had not issued an official statement. Cybersecurity forums and social media are rife with speculation, and some analysts suggest the attack could be retaliation for FOFA.info's use in surveillance operations or in identifying vulnerable assets in countries like China and Turkey.
This incident adds to a series of recent attacks on cyberintelligence platforms, reflecting an escalation in global digital tensions. Experts recommend that organizations relying on FOFA.info for their research seek temporary alternatives and strengthen their own security measures.
Sources: ANKA RED TEAM statement, user reports on specialized forums, website status monitoring. This article will be updated as new information becomes available.