ctrlINT What the industry said about every indicator, with the quote

176.120.22[.]24IP address

Reported by 1 independent source · first reported by Google Threat Intelligence · last reported

Last reported 4 months ago

What the reports say

1 report, newest first · the exact sentence from each

  1. “The session log ends with the attackers establishing an outbound SSH connection from their staging system to 176.120.22[.]24, which hosts the public clearnet mirror of the ShinyHunters DLS.”

    Google Threat IntelligenceVendor
    ShinyHunters Targets Education Sector with Oracle PeopleSoft Exploit

Indicators reported together

named in the same reports
Copy these 11 indicators · defanged

Also named with it: CVE-2026-35273

Thanks — we review every report.

Report a wrong value
What is wrong with 176.120.22[.]24 here?
No account needed. We do not store your IP address.