87.121.84[.]25IP address
Reported by 1 independent source · first reported by GreyNoise · last reported
Last reported 8 months ago
What the reports say
1 report, newest first · the exact sentence from each-
React Server Components Exploitation Consolidates as Two IPs Generate Majority of Attack Traffic“Adjacent IP addresses in the same /24 as the scanner (87.121.84[.]25 and 87.121.84.45) are currently serving Mirai and Gafgyt variants targeting MIPS and ARM architectures, along with exploit scripts for consumer routers and DVRs.”
Indicators reported together
named in the same reports- 193.142.147[.]209in 1 report
- 87.121.84[.]24in 1 report
- 205.185.127[.]97in 1 report
- 176.65.132[.]224in 1 report
- mased[.]topin 1 report
- mercarios[.]buzzin 1 report
- bt2.radiology[.]linkin 1 report
- 87.121.84[.]45in 1 report
Copy these 8 indicators · defanged
Also named with it: CVE-2025-55182
Thanks — we review every report.