Tags

IP addresses scanning for CGI scripts and vulnerable CGI directories like /cgi-bin/

IP addresses probing for CMS platforms like Drupal, Joomla, and admin panels

IP addresses searching for configuration files and sensitive application data

IP addresses searching for database administration interfaces like phpMyAdmin

IP addresses attempting path traversal attacks to access system files

IP addresses targeting enterprise software like VMware, Citrix, and Exchange servers

IP addresses probing for file upload endpoints and upload functionality

IP addresses targeting router firmware vulnerabilities and IoT devices

CVE-2025-53770 active SharePoint exploitation attempts targeting ToolPane.aspx endpoints. These represent live attacks attempting to deploy webshells and extract MachineKey secrets for persistent access.

Detects exploitation attempts against CVE-2025-53770, a critical zero-day SharePoint RCE vulnerability. Attackers use ASPX payloads to steal MachineKey configuration and achieve remote code execution. Primary IOC: /_layouts/15/spinstall0.aspx

Scanning for CVE-2025-53770 SharePoint webshells (spinstall*.aspx). These requests typically indicate threat actors probing for already compromised SharePoint servers rather than active exploitation attempts.

IP addresses with this tag have been observed scanning the Internet for SIP devices and attempting to query or modify address bindings using REGISTER requests.

IP addresses targeting SolarWinds Orion network monitoring platforms

IP addresses with this tag have been observed making repeated SSH connections in a short timeframe.

IP addresses with this tag have been observed attempting to negotiate an SSH session.

IP addresses with this tag have been observed attempting to bruteforce Telnet server credentials.

IP addresses with this tag have been observed attempting to authenticate to a Telnet server.

IP addresses with this tag have been observed attempting to opportunistically crawl the Internet and establish TLS/SSL connections.

IP addresses with this tag have been observed attempting to authenticate to a VNC server.

IP addresses attempting to execute system commands through web applications

IP addresses with this tag have been seen crawling HTTP(S) servers around the Internet.

IP addresses searching for web shells and backdoors on web servers