23.27.143[.]20IP address
Reported by 2 independent sources · first reported by The Hacker News · last reported
Last reported 23 days agoFeeds last saw it 23 days ago
What the reports say
1 report, newest first · the exact sentence from each-
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs“23.27.143[.]20:9000/main.py”
Seen in threat feeds
1 feed| Feed | First seen | Last seen | Sightings | What the feed says |
|---|---|---|---|---|
| abuse.ch ThreatFox | 1 | payload_delivery · Unknown malware · 0day · Citrix · CVE-2026-88771 · NetScaler |
Indicators reported together
named in the same reports- 64.94.85[.]67in 1 report
- 31.56.197[.]72in 1 report
- 45.141.21[.]130in 1 report
Copy these 3 indicators · defanged
Also named with it: CVE-2026-88771, CVE-2026-88772
Thanks — we review every report.