118.31.18[.]77IP address
Reported by 1 independent source · first reported by GreyNoise · last reported
Last reported 19 months ago
What the reports say
1 report, newest first · the exact sentence from each-
GreyNoise Detects Mass Exploitation of Critical PHP-CGI Vulnerability (CVE-2024-4577), Signaling Broad Campaign“C2 Infrastructure: Servers 38.14.255.23 and 118.31.18[.]77 hosted on Alibaba Cloud, with HTTP User-Agent strings mimicking legacy Internet Explorer versions.”
Indicators reported together
named in the same reports- e10adc3949ba59abbe56e057f20f883ein 1 report
- hxxp://38.14.255[.]23:8000/payload.ps1in 1 report
- 38.14.255[.]23in 1 report
Copy these 3 indicators · defanged
Also named with it: CVE-2024-4577
Thanks — we review every report.