154.202.59[.]169IP address
Reported by 2 independent sources · first reported by SOCRadar · last reported
Last reported 17 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
FortiBleed hit 86,000 firewalls by exploiting something nobody can patch away“IP address 45.154.12.132 was seen in instances as a C2 server, with IP addresses 154.202.59[.]169 and 103.27.186.156 as proxy nodes used by the threat actors to obfuscate their presence, and 45.155.250.158 as a beacon relay.” reads the advisory.”
-
FortiBleed Is Still Active, Locking Organizations Out“154.202.59[.]169 – Proxy node”
Indicators reported together
named in the same reports- 45.154.12[.]132in 2 reports
- 103.27.186[.]156in 2 reports
- 45.155.250[.]158in 2 reports
- 85.11.187[.]8in 1 report
- 193.8.187[.]2in 1 report
- 193.8.187[.]42in 1 report
- 104.28.155[.]27in 1 report
- 185.136.15[.]43in 1 report
- 185.136.15[.]66in 1 report
- 185.199.199[.]56in 1 report
- 193.8.186[.]33in 1 report
- 45.227.254[.]210in 1 report
- 77.91.118[.]10in 1 report
- 80.75.212[.]113in 1 report
- 87.251.64[.]13in 1 report
- 87.251.64[.]16in 1 report
- 87.251.64[.]17in 1 report
- 87.251.64[.]44in 1 report
- 66.175.220[.]111in 1 report
Copy these 19 indicators · defanged
Thanks — we review every report.