ConnectWise Cloud Backup/SKYKICK IOC
URGENT THREAT NOTICE https://radar.offseq.com/threat/urgent-th ...
show moreConnectWise Cloud Backup/SKYKICK IOC
URGENT THREAT NOTICE https://radar.offseq.com/threat/urgent-threat-notice-2dd4acc6a66371cb
show less
This IP address is being observed conducting password spraying activities - automated to run every 5 ...
show moreThis IP address is being observed conducting password spraying activities - automated to run every 5 mins
show less
Cisco.Smart.Install.Feature.Enable.Scanner
This IP address has been observed in the wild attempti ...
show moreCisco.Smart.Install.Feature.Enable.Scanner
This IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 is a remote code execution vulnerability in Cisco IOS and IOS XE Software, specifically in the Smart Install client feature. An unauthenticated, remote attacker can send crafted Smart Install messages to trigger a buffer overflow, allowing them to execute arbitrary code or cause a denial of service (DoS) on vulnerable devices.
Further information available here:
https://nvd.nist.gov/vuln/detail/CVE-2018-0171
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
https://www.tenable.com/blog/proof-of-concept-and-patch-for-critical-cisco-ios-vulnerability-cve-2018-0171
show less
This IP address is involved in Business Email Compromise activity and Invoice Redirection Fraud
Ver ...
show moreThis IP address is involved in Business Email Compromise activity and Invoice Redirection Fraud
Verdict: MALICIOUS
show less
This IP address has been observed conducting Password spraying activity and has history of conductin ...
show moreThis IP address has been observed conducting Password spraying activity and has history of conducting this activity spanning from around 7 months ago up until today
show less
Phishing link embedded into body of email - this is designed to steal the following data points:
...
show morePhishing link embedded into body of email - this is designed to steal the following data points:
Full name
Full Facebook Page Name
Personal Email address
Business Email address
Mobile phone number
Page is now 403 ed : https://app.any.run/tasks/de1e0756-ac64-464b-96ab-9564f0598045
show less
This IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 i ...
show moreThis IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 is a remote code execution vulnerability in Cisco IOS and IOS XE Software, specifically in the Smart Install client feature. An unauthenticated, remote attacker can send crafted Smart Install messages to trigger a buffer overflow, allowing them to execute arbitrary code or cause a denial of service (DoS) on vulnerable devices.
Further information available here:
https://nvd.nist.gov/vuln/detail/CVE-2018-0171
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
https://www.tenable.com/blog/proof-of-concept-and-patch-for-critical-cisco-ios-vulnerability-cve-2018-0171
show less
This IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 i ...
show moreThis IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 is a remote code execution vulnerability in Cisco IOS and IOS XE Software, specifically in the Smart Install client feature. An unauthenticated, remote attacker can send crafted Smart Install messages to trigger a buffer overflow, allowing them to execute arbitrary code or cause a denial of service (DoS) on vulnerable devices.
Further information available here:
https://nvd.nist.gov/vuln/detail/CVE-2018-0171
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
https://www.tenable.com/blog/proof-of-concept-and-patch-for-critical-cisco-ios-vulnerability-cve-2018-0171
show less
This IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 i ...
show moreThis IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 is a remote code execution vulnerability in Cisco IOS and IOS XE Software, specifically in the Smart Install client feature. An unauthenticated, remote attacker can send crafted Smart Install messages to trigger a buffer overflow, allowing them to execute arbitrary code or cause a denial of service (DoS) on vulnerable devices.
Further information available here:
https://nvd.nist.gov/vuln/detail/CVE-2018-0171
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
https://www.tenable.com/blog/proof-of-concept-and-patch-for-critical-cisco-ios-vulnerability-cve-2018-0171
show less
This IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 i ...
show moreThis IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 is a remote code execution vulnerability in Cisco IOS and IOS XE Software, specifically in the Smart Install client feature. An unauthenticated, remote attacker can send crafted Smart Install messages to trigger a buffer overflow, allowing them to execute arbitrary code or cause a denial of service (DoS) on vulnerable devices.
Further information available here:
https://nvd.nist.gov/vuln/detail/CVE-2018-0171
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
https://www.tenable.com/blog/proof-of-concept-and-patch-for-critical-cisco-ios-vulnerability-cve-2018-0171
show less
This IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 i ...
show moreThis IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 is a remote code execution vulnerability in Cisco IOS and IOS XE Software, specifically in the Smart Install client feature. An unauthenticated, remote attacker can send crafted Smart Install messages to trigger a buffer overflow, allowing them to execute arbitrary code or cause a denial of service (DoS) on vulnerable devices.
Further information available here:
https://nvd.nist.gov/vuln/detail/CVE-2018-0171
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
https://www.tenable.com/blog/proof-of-concept-and-patch-for-critical-cisco-ios-vulnerability-cve-2018-0171
show less
This IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 i ...
show moreThis IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 is a remote code execution vulnerability in Cisco IOS and IOS XE Software, specifically in the Smart Install client feature. An unauthenticated, remote attacker can send crafted Smart Install messages to trigger a buffer overflow, allowing them to execute arbitrary code or cause a denial of service (DoS) on vulnerable devices.
Further information available here:
https://nvd.nist.gov/vuln/detail/CVE-2018-0171
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
https://www.tenable.com/blog/proof-of-concept-and-patch-for-critical-cisco-ios-vulnerability-cve-2018-0171
show less
This IP address is being observed engaging in malicious password spraying activity
IP should be con ...
show moreThis IP address is being observed engaging in malicious password spraying activity
IP should be considered as MALICIOUS
show less
Malicious IP address - engaged in hostile cyber operations.
This IP address has been observed using ...
show moreMalicious IP address - engaged in hostile cyber operations.
This IP address has been observed using the curl command to exfiltrate data from a victims machine.
Related to: hxxp://ec2-18-223-123-109.us-east-2.compute.amazonaws.com/8up161bmdzek01pq7f/hot[.]png
show less
This IP address is engaged in inbound HTTP activity attempting to upload an executable via a /upload ...
show moreThis IP address is engaged in inbound HTTP activity attempting to upload an executable via a /upload.exe endpoint. Activity is targeting FortiGate firewalls, with IPS triggering on the payload identifying EICAR test file content. The use of a known AV test signature strongly indicates deliberate capability testing and pre-positioning, where the actor is validating inspection depth, alerting fidelity, and potential bypass opportunities ahead of real payload delivery. This behaviour aligns with adversary reconnaissance of defensive controls rather than benign activity. Event was detected at the perimeter; no evidence of successful execution observed.
MITRE ATT&CK Mapping:
T1595 – Active Scanning
Systematic probing to evaluate exposed services and defensive posture.
T1046 – Network Service Discovery
Interaction with services to identify filtering, inspection, and response characteristics.
T1105 – Ingress Tool Transfer
Simulated transfer of an executable payload to test delivery pathways.
show less
This IP address has been observed attempting the exploitation of CVE-2016-0703 relating to SSLv2.Ope ...
show moreThis IP address has been observed attempting the exploitation of CVE-2016-0703 relating to SSLv2.Openssl.Get.Shared.Ciphers.Buffer.Overflow
This is a buffer overflow vulnerability related to OpenSSL and its implementation of the SSLv2 protocol https://nvd.nist.gov/vuln/detail/CVE-2016-0703
show less
Spam emails purporting to be selling something - this is designed to lure users to click on the ad > ...
show moreSpam emails purporting to be selling something - this is designed to lure users to click on the ad >> diverted to a fake online store to steal users data and banking information - MALICIOUS
show less
This IP address related to a URL delivered via text message and in an AiTM threat that redirects uns ...
show moreThis IP address related to a URL delivered via text message and in an AiTM threat that redirects unsuspecting victim's to revenue to harvest SSN numbers, DOB, and Passwords
show less
This IP address is the resolving IP address of a known bad URL - that is connected to LummaC2 INFOST ...
show moreThis IP address is the resolving IP address of a known bad URL - that is connected to LummaC2 INFOSTEALER and ClickFix activity.
This IP address IS malicious and should be set to DROP/BLOCK on ingress/egress on perimeter Firewalls
show less
This IP address has been observed attempting the exploitation of CVE-2016-0703 relating to SSLv2.Ope ...
show moreThis IP address has been observed attempting the exploitation of CVE-2016-0703 relating to SSLv2.Openssl.Get.Shared.Ciphers.Buffer.Overflow
This is a buffer overflow vulnerability related to OpenSSL and its implementation of the SSLv2 protocol https://nvd.nist.gov/vuln/detail/CVE-2016-0703
show less
This IP address has been observed for phishing activities in which the URL is presented in a text me ...
show moreThis IP address has been observed for phishing activities in which the URL is presented in a text message purporting to be from the Irish revenue commissioners,
show less
This IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 i ...
show moreThis IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 is a remote code execution vulnerability in Cisco IOS and IOS XE Software, specifically in the Smart Install client feature. An unauthenticated, remote attacker can send crafted Smart Install messages to trigger a buffer overflow, allowing them to execute arbitrary code or cause a denial of service (DoS) on vulnerable devices.
Further information available here:
https://nvd.nist.gov/vuln/detail/CVE-2018-0171
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
https://www.tenable.com/blog/proof-of-concept-and-patch-for-critical-cisco-ios-vulnerability-cve-2018-0171
show less
This IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 i ...
show moreThis IP address has been observed in the wild attempting to exploit CVE-2018-0171
CVE-2018-0171 is a remote code execution vulnerability in Cisco IOS and IOS XE Software, specifically in the Smart Install client feature. An unauthenticated, remote attacker can send crafted Smart Install messages to trigger a buffer overflow, allowing them to execute arbitrary code or cause a denial of service (DoS) on vulnerable devices.
Further information available here:
https://nvd.nist.gov/vuln/detail/CVE-2018-0171
https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-20180328-smi2
https://www.tenable.com/blog/proof-of-concept-and-patch-for-critical-cisco-ios-vulnerability-cve-2018-0171
show less
This IP address is related to the malicious domain wohnpark-popken.de
This IP address and domain ...
show moreThis IP address is related to the malicious domain wohnpark-popken.de
This IP address and domain is sending out phishing emails purporting to be from Wix and has the email subject of "Domain Service Summary" The link contained in the email to "Review Billing Details" resolves to: hxxps://clicks-wix-com-gh87uiydhedty.blogspot[.]gr/
This IP address and Link above is malicious and should be detected as such.
https://app.any.run/tasks/ceccb338-775b-4543-95d0-b0466dee19b9
show less