45.143.130[.]195IP address

Reported by 1 independent source · first reported 7 Oct 2026 by SOCRadar · last reported 7 Oct 2026

Last reported 17 days ago

What the reports say

1 report, newest first · the exact sentence from each

“Fetching this URL returns a bootstrap script from the C2, which uses curl (or wget as a fallback) to fetch a C2 agent from hxxp://45.143.130[.]195:8899/a/<bid>, saves it at /tmp/.nsagent and executes it in the background.”

SOCRadarVendor7 Oct 2026C2
NetScaler C2: A Massive CVE-2026-88771 Exploitation Operation

Indicators reported together

named in the same reports

doauthentication[.]doin 1 report
getauthenticationrequirements[.]doin 1 report
hxxp://45.143.130[.]195:8899/a/in 1 report
8588d11874ab52a1…e40cf8e5e852in 1 report
4992f575f3f1fc44…663498ea5639in 1 report
69a34c591eaaa2cb…2b9cfc93f686in 1 report
a3e26053975daa0a…2061999b4cd4in 1 report
a9142989d9120988…ade1ddfddf4ain 1 report
f9e06d412dee96d9…f282447cf07fin 1 report

Copy these 9 indicators · defanged

9 indicators, defanged, one per line

doauthentication[.]do
getauthenticationrequirements[.]do
hxxp://45.143.130[.]195:8899/a/
8588d11874ab52a1637953dc5538984647023d00b529f695fbd0e40cf8e5e852
4992f575f3f1fc448cf54a4a0ce13cf6548790777abe0af1f935663498ea5639
69a34c591eaaa2cbecaeed10c303b8dcf04c846b8408491da5452b9cfc93f686
a3e26053975daa0a12a4848ce9533e5c439617cd7f69851347be2061999b4cd4
a9142989d912098856e58f2c74c2266e39150d50bc59722f915dade1ddfddf4a
f9e06d412dee96d98db4d4588f0012af859cc11caaae3e130697f282447cf07f

Also named with it: CVE-2026-88771, CVE-2026-88772

Thanks — we review every report.

Report a wrong value