82.192.72[.]4IP address
Reported by 3 independent sources · first reported by CERT Polska · last reported
Last reported 30 days ago
What the reports say
4 reports, newest first · the exact sentence from each-
AI Helps Uncover MikroTrick Attack Chain in MikroTik RouterOS“Attack logs collected from the MikroTik forum, Reddit, and direct reports to CERT Polska show a consistent source IP, 82.192.72[.]4, repeatedly attempting this exact sequence, and in several cases succeeding well enough to pull diagnostic files off the compromised routers afterward…”
-
MikroTrick Chain Let Attackers Take Over MikroTik Routers Without a Password or SSH Key“IP: 82.192.72[.]4 (observed in successful attacks)”
-
MikroTrick: technical analysis, disclosure process, and the use of LLM agents“login failure for user -2 from 82.192.72[.]4 via ssh”
-
Critical vulnerabilities in MikroTik RouterOS are being actively exploited. Immediate update recommended“…s determined that the successful attacks observed so far, including the creation of the "ops" account, originated from the IP address 82.192.72[.]4 and have been occurring since at least 2 September.”
Indicators reported together
named in the same reports- npratley[.]netin 2 reports
- 103.102.31[.]18in 2 reports
Copy these 2 indicators · defanged
Also named with it: CVE-2026-86060, CVE-2026-67279, CVE-2026-67276, CVE-2026-67277
Thanks — we review every report.