31.56.197[.]72IP address
Reported by 3 independent sources · first reported by The Hacker News · last reported
Last reported 5 days agoFeeds last saw it 23 days ago
What the reports say
2 reports, newest first · the exact sentence from each-
Rapid7 Analysis: NetScaler intrusions chaining CVE-2026-88771 and CVE-2026-88779“31.56.197[.]72”
-
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs“31.56.197[.]72:9090/lula”
Seen in threat feeds
1 feed| Feed | First seen | Last seen | Sightings | What the feed says |
|---|---|---|---|---|
| abuse.ch ThreatFox | 1 | payload_delivery · Unknown malware · 0day · Citrix · CVE-2026-88771 · NetScaler |
Indicators reported together
named in the same reports- 64.94.85[.]67in 2 reports
- 179.60.146[.]241in 1 report
- 23.27.143[.]20in 1 report
- 45.141.21[.]130in 1 report
- 62.133.62[.]80in 1 report
- a0ba4e1ad622d9c3…9f7a80535556in 1 report
- 6774bfed99da38ce…2eb6f0a03c44in 1 report
- 56a892d80096a9db…db1f4a6fb186in 1 report
- hxxps://v5v[.]in/r.sh?k=in 1 report
- v5v[.]inin 1 report
- c.v5v[.]inin 1 report
- 8e8b9532ce40eacf…60df19b51a4din 1 report
- eaf0086237879bba…88fd3a31cddein 1 report
- ffe052fc50271e77…5e1dd9c0b138in 1 report
- 209.74.64[.]192in 1 report
- 192.159.99[.]139in 1 report
- 213.209.159[.]55in 1 report
Copy these 17 indicators · defanged
Also named with it: CVE-2026-88771, CVE-2026-88772, CVE-2026-88779
Thanks — we review every report.