40.126.23[.]26IP address
Reported by 1 independent source · first reported by Red Canary · last reported
Last reported 4 months ago
What the reports say
1 report, newest first · the exact sentence from each-
Investigating suspicious AI workflows in Microsoft Entra Agent ID: Assistive agents“"ClientIP": "40.126.23[.]26",”
Indicators reported together
named in the same reports- hxxps://login.microsoftonline[.]com/adcb5820-70a1-4272-b79c-32f2bba44ddc/oauth2/v2.0/authorize?client_id=14d82eec-204b-4c2f-b7e8-296a70dab67e&response_type=code&redirect_uri=http://localhost/&response_mode=query&scope=api://beddadf7-4f3b-4e9b-8443-0b0cf777446e/access_agentin 1 report
- importantcompany[.]comin 1 report
- 51.3.97[.]221in 1 report
- 20.106.103[.]146in 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.