doauthentication[.]doDomain

1. “…hentication logThe attacker then sent POST requests to the following authentication endpoints, as observed by ThreatLabz:/nf/auth/doAuthentication[.]do”

   Zscaler ThreatLabzVendor16 Oct 2026
   CVE-2026-88771: Inside the Exploitation of a Critical NetScaler RCE Vulnerability

2. “/nf/auth/doAuthentication[.]do”

   SOCRadarVendor7 Oct 2026
   NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation

3. “His advice to organizations is to hunt for POST /nf/auth/doAuthentication[.]do requests whose body contains pitboss PPE unexpectedly died NSPPE, and to watch DNS for outbound lookups ending in instances.httpworkbench.com, which indicates a host in their estate has already been hit.”

   Help Net SecurityNews29 Sep 2026
   NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)

4. “POST /nf/auth/doAuthentication[.]do HTTP/1.1”

   watchTowr LabsVendor28 Sep 2026
   Oh Look, The Foot Gun Went Off Again (Citrix NetScaler PreAuth Command Injection CVE-2026-88771)

5. “When the appliance receives a POST request to the login endpoint (/p/u/doAuthentication[.]do and equivalents) in which the login form variable is present but empty, it parses past the supplied data and serializes a chunk of adjacent process memory into the response, roughly 127 byt…”

   HuntressVendor9 Jul 2026
   CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware

• relay.dltsolutions[.]topin 1 report
• relay.eurofin[.]digitalin 1 report
• opa.tlsd[.]shopin 1 report
• c84739655ce1af0a…bc21802209e2in 1 report
• eb083365dc70d029…474dafab48d8in 1 report
• c4fcae3847946173…44fa7fda180din 1 report
• vtps[.]usin 1 report
• hxxp://citrix[.]com/authentication/response/1in 1 report
• docredentialupdate[.]doin 1 report
• docancelcredentialupdate[.]doin 1 report
• local0[.]infoin 1 report
• local1[.]infoin 1 report
• httpd[.]pidin 1 report
• 138.199.200[.]90in 1 report

Also named with it: CVE-2026-88771, CVE-2026-88772, CVE-2025-5777, CVE-2023-4966, CVE-2026-4368, CVE-2026-75650