45.141.21[.]130IP address
Reported by 2 independent sources · first reported by The Hacker News · last reported
Last reported 23 days agoFeeds last saw it 23 days ago
What the reports say
1 report, newest first · the exact sentence from each-
Citrix NetScaler Post-Exploitation Payload Creates Superuser, Maps Web Shell to CSS-Like URLs“Notable among the second-stage payloads is a Python script ("main.py") that's designed to establish a reverse shell to "45.141.21[.]130" over TCP port 443.”
Seen in threat feeds
1 feed| Feed | First seen | Last seen | Sightings | What the feed says |
|---|---|---|---|---|
| abuse.ch ThreatFox | 1 | botnet_cc · Unknown malware · 0day · Citrix · CVE-2026-88771 · NetScaler |
Indicators reported together
named in the same reports- 64.94.85[.]67in 1 report
- 31.56.197[.]72in 1 report
- 23.27.143[.]20in 1 report
Copy these 3 indicators · defanged
Also named with it: CVE-2026-88771, CVE-2026-88772
Thanks — we review every report.