108.165.147[.]64IP address
Reported by 3 independent sources · first reported by Volexity · last reported
Last reported 10 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
Ivanti Connect Secure Zero-Day CVE-2026-104935 Exploited in Chained Attacks“The attacker-used host, 108.165.147[.]64, runs an OpenVPN server”
-
Attacker Chains Three Ivanti Connect Secure Zero-Days for Root Access, Only Two Patched So Far“IP: 108.165.147[.]64, the host the attacker used”
-
A Series of Unauthenticated Events: Chained Exploitation of Ivanti Connect Secure Zero-Days“The host used for this operation, 108.165.147[.]64, is an Evoxt VPS and was observed running an OpenVPN server from September 30 to October 7, 2026.”
Indicators reported together
named in the same reports- log[.]eventsin 2 reports
- 25.1.3[.]1in 2 reports
- 25.1.2[.]2in 1 report
- 25.1.1[.]2in 1 report
Copy these 4 indicators · defanged
Also named with it: CVE-2026-104935, CVE-2026-109412, CVE-2026-106042
Thanks — we review every report.