Password spraying attack from this IP targeting [internal-host] Office 365 mailboxes via OAuth2 toke ...
show morePassword spraying attack from this IP targeting [internal-host] Office 365 mailboxes via OAuth2 token endpoint. User-Agent=[internal-Agent]/[internal-domain], application: Azure PowerShell. Rapid enumeration of generic mailbox names (support, finance, marketing, info) with ~17 failed authentication attempts within 13 minutes on [internal-host] One account was locked out due to [internal-host] attempts. IP hosted on [internal-host] LLC infrastructure.
show less
Probing of Spring Boot Actuator endpoints and password file access attempts against an internet-faci ...
show moreProbing of Spring Boot Actuator endpoints and password file access attempts against an internet-facing web service, 2 events during nighttime hours.
show less
Exploit attempt matching a known GPON router remote code execution pattern (diag_Form endpoint) agai ...
show moreExploit attempt matching a known GPON router remote code execution pattern (diag_Form endpoint) against an internet-facing service, single high-severity attempt during nighttime hours.
show less
Repeated path traversal attempts ([internal-domain]. targeting [internal-path] and unauthorized acce ...
show moreRepeated path traversal attempts ([internal-domain]. targeting [internal-path] and unauthorized access attempts against [internal-host] Boot Actuator endpoints and password files on an internet-facing web service, observed over ~13 events during 2026 nighttime hours (03:[internal-host]:00 local).
show less
This IP attempted to [internal-host] an internet-facing HTTP service on our network, sending a reque ...
show moreThis IP attempted to [internal-host] an internet-facing HTTP service on our network, sending a request matching a known command-injection exploit signature (Ivanti Sentry handleMessage command injection) targeting a public-facing web/management endpoint. Detected by perimeter IPS on [internal-host] during automated exploit-attempt activity.
show less
This IP hosts a fraudulent SharePoint credential harvesting page (Hebrew-language fake Microsoft Sha ...
show moreThis IP hosts a fraudulent SharePoint credential harvesting page (Hebrew-language fake Microsoft SharePoint login). The page is designed to [internal-host] corporate Microsoft 365 credentials and is actively linked from [internal-host] emails. Path observed: [internal-path] on a compromised Argentine domain. [internal-domain] ML score: 96/100. Reported July 1, 2026.
show less
This public IP from an Israeli data center/hosting provider sent multiple exploit attempts targeting ...
show moreThis public IP from an Israeli data center/hosting provider sent multiple exploit attempts targeting [internal-host] Hat JBoss AS Insecure Deserialization (CVE/FortiGuard attack ID 44975) against our internet-facing web services on [internal-host] between 20:16 and 20:17 Israel time. Requests targeted [internal-path], [internal-path], and [internal-path] paths via HTTP POST. Attacks were blocked by IPS. Multiple source ports used in rapid succession indicating automated exploitation tool.
show less
Remote code execution exploit attempt (React Server Components / react-flight RCE) against an intern ...
show moreRemote code execution exploit attempt (React Server Components / react-flight RCE) against an internet-facing HTTP service on our network, observed [internal-host] ~02:22 UTC. Single request to port 80 blocked by IPS. Behavior consistent with mass web exploitation scanning.
show less
Observed as part of a distributed password-spray botnet performing repeated failed login attempts ag ...
show moreObserved as part of a distributed password-spray botnet performing repeated failed login attempts against an internet-facing cloud email service of our network during [internal-host]/10. Legacy basic-auth (OAuth2 ROPC, user-agent BAV2ROPC) used to [internal-host] MFA.
show less
Repeated failed authentication attempts (password spray / brute force) against an internet-facing cl ...
show moreRepeated failed authentication attempts (password spray / brute force) against an internet-facing cloud email service of our network during [internal-host]/10. Legacy basic-auth (OAuth2 ROPC, user-agent BAV2ROPC) used to [internal-host] MFA. Part of a distributed botnet credential attack.
show less
Observed as part of a distributed password-spray botnet performing repeated failed login attempts ag ...
show moreObserved as part of a distributed password-spray botnet performing repeated failed login attempts against an internet-facing cloud email service of our network during [internal-host]/10. Legacy basic-auth (OAuth2 ROPC, user-agent BAV2ROPC) used to [internal-host] MFA.
show less
Observed as part of a distributed password-spray botnet performing repeated failed login attempts ag ...
show moreObserved as part of a distributed password-spray botnet performing repeated failed login attempts against an internet-facing cloud email service of our network during [internal-host]/10. Legacy basic-auth (OAuth2 ROPC, user-agent BAV2ROPC) used to [internal-host] MFA.
show less
Observed as part of a distributed password-spray botnet performing repeated failed login attempts ag ...
show moreObserved as part of a distributed password-spray botnet performing repeated failed login attempts against an internet-facing cloud email service of our network during [internal-host]/10. Legacy basic-auth (OAuth2 ROPC, user-agent BAV2ROPC) used to [internal-host] MFA.
show less
Observed as part of a distributed password-spray botnet performing repeated failed login attempts ag ...
show moreObserved as part of a distributed password-spray botnet performing repeated failed login attempts against an internet-facing cloud email service of our network during [internal-host]/10. Legacy basic-auth (OAuth2 ROPC, user-agent BAV2ROPC) used to [internal-host] MFA.
show less
Repeated exploitation attempts targeting [internal-host] RadAsyncUpload arbitrary file upload vulner ...
show moreRepeated exploitation attempts targeting [internal-host] RadAsyncUpload arbitrary file upload vulnerability (CVE) against an internet-facing web service. Multiple attempts detected and blocked by perimeter IPS during [internal-host]. Attack severity rated critical (crscore=50). Traffic dropped at firewall level.
show less
This IP attempted unauthenticated remote command execution (JAWS DVR CCTV shell exploit) against an ...
show moreThis IP attempted unauthenticated remote command execution (JAWS DVR CCTV shell exploit) against an internet-facing HTTP service. Severity: high, blocked by IPS. Activity observed night of [internal-host] Jun 2026.
show less
Attempted D-Link [internal-host] CLI OS Command Injection exploit against our internet-facing HTTP s ...
show moreAttempted D-Link [internal-host] CLI OS Command Injection exploit against our internet-facing HTTP service, attempting to [internal-host] and execute malicious payload. Critical severity. IPS dropped. [internal-host] overnight.
show less