51.3.97[.]221IP address
Reported by 1 independent source · first reported by Red Canary · last reported
Last reported 4 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Investigating suspicious AI workflows in Microsoft Entra Agent ID: Assistive agents“…en correlated, the corresponding Graph API log confirms that the Graph API was used to send the email along with the true IP address, 51.3.97[.]221:”
-
Investigating suspicious AI workflows in Microsoft Entra Agent ID: Agent’s user account“"IPAddress": "51.3.97[.]221",”
Indicators reported together
named in the same reports- hxxps://login.microsoftonline[.]com/adcb5820-70a1-4272-b79c-32f2bba44ddc/oauth2/v2.0/authorize?client_id=14d82eec-204b-4c2f-b7e8-296a70dab67e&response_type=code&redirect_uri=http://localhost/&response_mode=query&scope=api://beddadf7-4f3b-4e9b-8443-0b0cf777446e/access_agentin 1 report
- 40.126.23[.]26in 1 report
- importantcompany[.]comin 1 report
- 20.106.103[.]146in 1 report
- 5e98eabef5ea551db4e9daa0264515b4in 1 report
- 70.152.145[.]147in 1 report
- hxxps://domoarigato[.]ai/in 1 report
- domoarigato[.]aiin 1 report
- hxxps://login.microsoftonline[.]com/$TargetEntraTenantID/oauth2/v2.0/tokenin 1 report
Copy these 9 indicators · defanged
Thanks — we review every report.