138.199.200[.]90IP address
Reported by 1 independent source · first reported by Help Net Security · last reported
Last reported 25 days ago
What the reports say
1 report, newest first · the exact sentence from each-
NetScaler zero-day exploitation escalates into mass attacks (CVE-2026-88771)“The technique used by attackers involves log poisoning, and the collected data is exfiltrated to a Hetzner server (138.199.200[.]90).”
Indicators reported together
named in the same reports- doauthentication[.]doin 1 report
- instances.httpworkbench[.]comin 1 report
Copy these 2 indicators · defanged
Also named with it: CVE-2026-88771, CVE-2026-88772
Thanks — we review every report.