hxxp://38.14.255[.]23:8000/payload.ps1URL
Reported by 1 independent source · first reported by GreyNoise · last reported
Last reported 19 months ago
What the reports say
1 report, newest first · the exact sentence from each-
GreyNoise Detects Mass Exploitation of Critical PHP-CGI Vulnerability (CVE-2024-4577), Signaling Broad Campaign“Payloads: PowerShell scripts fetching Cobalt Strike reverse HTTP shellcode (e.g., hxxp://38.14.255[.]23:8000/payload.ps1).”
Indicators reported together
named in the same reports- e10adc3949ba59abbe56e057f20f883ein 1 report
- 38.14.255[.]23in 1 report
- 118.31.18[.]77in 1 report
Copy these 3 indicators · defanged
Also named with it: CVE-2024-4577
Thanks — we review every report.