176.65.132[.]224IP address
Reported by 1 independent source · first reported by GreyNoise · last reported
Last reported 8 months ago
What the reports say
1 report, newest first · the exact sentence from each-
React Server Components Exploitation Consolidates as Two IPs Generate Majority of Attack Traffic“…g operation (87.121.84.24): Successful exploitation triggers retrieval of an XMRig binary from staging servers at 205.185.127.97 and 176.65.132[.]224.”
Indicators reported together
named in the same reports- 193.142.147[.]209in 1 report
- 87.121.84[.]24in 1 report
- 205.185.127[.]97in 1 report
- mased[.]topin 1 report
- mercarios[.]buzzin 1 report
- bt2.radiology[.]linkin 1 report
- 87.121.84[.]25in 1 report
- 87.121.84[.]45in 1 report
Copy these 8 indicators · defanged
Also named with it: CVE-2025-55182
Thanks — we review every report.