Recent reportsWe have received reports of abusive activity from this IP address within the last week. It is
potentially still actively engaged in abusive activities.
Crowdstrike detection.
Name: Generic - Web - Node.js Remote Code Execution
Description: This rule detects potential Node.js remote code execution (RCE) attacks through web applications by identifying Node.js function calls in HTTP requests. The detec ...
show moreCrowdstrike detection.
Name: Generic - Web - Node.js Remote Code Execution
Description: This rule detects potential Node.js remote code execution (RCE) attacks through web applications by identifying Node.js function calls in HTTP requests. The detection covers multiple attack vectors including require() function calls targeting dangerous modules (child_process, fs, os, etc.), process object manipulation, global object access, and execution functions like execSync, spawn, and fork. The rule analyzes URL paths, user agent header, and request body for JavaScript injection patterns, which are commonly used in attacks like CVE-2025-55182 (React2Shell) targeting React Server Components and similar Node.js applications.
Note: This rule requires customization before production use. Please select the appropriate vendors for your CID, evaluate for potential false positives, and apply necessary tuning based on your environment's characteristics.
show less
2026-11-06 09:38:33 GET /.changeset/config.json [301] && 2026-11-06 09:38:33 GET /vercel.json [301] && 2026-11-06 09:38:33 GET /railway.json [301] && 221 more within 20 minutes
