146.70.134[.]50IP address
Reported by 1 independent source · first reported by Huntress · last reported
Last reported 10 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Gladinet CentreStack/Triofox: Cryptography Vulnerability“From Windows event logs, Event ID 1316 from the Application EVTX, we observed 146.70.134[.]50 as the malicious IP address that began the attack leveraging the ViewState deserialization vulnerability by CVE-2025-30406.”
Indicators reported together
named in the same reports- hxxp://185.196.11[.]207:8000/conqueror.exein 1 report
- 185.196.11[.]207in 1 report
- hxxp://185.196.11[.]207:8000in 1 report
- e9fa82d92d826c6a…4393be64b5a5in 1 report
- 147.124.216[.]205in 1 report
Copy these 5 indicators · defanged
Also named with it: CVE-2025-30406, CVE-2025-14611, CVE-2025-11371
Thanks — we review every report.