79.141.169[.]187IP address
Reported by 3 independent sources · first reported by FortiGuard PSIRT · last reported
Last reported 22 days ago
What the reports say
3 reports, newest first · the exact sentence from each-
FortiMail Zero-Day Under Active Exploitation“Fortinet listed two IP addresses tied to the activity, 79.141.169[.]187 and 45.129.0.192, with the former appearing in a log entry as the remote server for an attacker-created archive account named archive234 pointed at a /uploads directory.”
-
Critical FortiMail Zero-Day Flaw Exploited in Attacks Allows Unauthenticated Arbitrary File Writes“79.141.169[.]187”
-
Improper limitation of a pathname to a restricted directory“79.141.169[.]187”
Indicators reported together
named in the same reports- 45.129.0[.]192in 3 reports
- 8015f34dc84922b0…db23e75cef84in 2 reports
- 77324ac428bde86d…5ac2418a5b6ain 2 reports
- 7a6cea9f5c9e2e99…d1dafd69ee38in 2 reports
- 4000276a150a165d…059cae82157bin 2 reports
- 703e97c64e61e41d…5d5a3bffdef5in 2 reports
- 8953ec7960b09f54…dcfdfbac23b6in 2 reports
- d6fe51c22b91776f…3d51795609d3in 2 reports
- 64c90a00c7fda4d5c7973ed64c25783ain 1 report
- 5241738a3e9988404239e12243f6d35bin 1 report
- ae0ea6502d3fa5f0664bceb73189eb54in 1 report
- f90fa81a5f521d785f2b2f765e3ab897in 1 report
Copy these 12 indicators · defanged
Also named with it: CVE-2026-104286, CVE-2026-93616, CVE-2026-94127, CVE-2026-85102, CVE-2026-93952, CVE-2026-88771, CVE-2026-88772, CVE-2026-76504
Thanks — we review every report.