Published file metadata, source observations, indicators, and research history in one bounded catalog.
2,400+Reachable catalog records
55 / 100Current catalog page
24Maximum records per page
0Samples downloaded by this page
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
src_0060ae82ad11b5dc16Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
2,400+ MATCHING RECORDSMETADATA ONLY / SOURCE ATTRIBUTION PRESERVED
GreyNoise has been tracking malicious use of an IP address since early June 2026 due to its frequent use in scans and attacks against a variety of technologies. We detail a few of the more notable intrusions we observed including the theft of more than 18,000 sensitive records from a western government.
First reported Sep 21, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
Today, we're launching Project Swarm — a research initiative that opens the GreyNoise deception platform to the global security community. Project Swarm transforms GreyNoise from a proprietary sensor network into a collective intelligence platform.
First reported Apr 29, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise has observed active exploitation attempts targeting a newly disclosed authentication bypass vulnerability, CVE-2025-0108, affecting Palo Alto Networks PAN-OS. This high-severity flaw allows unauthenticated attackers to execute specific PHP scripts, potentially leading to unauthorized access to vulnerable systems.
First reported Feb 13, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise observed 400+ IPs exploiting multiple SSRF vulnerabilities across various platforms, with recent activity concentrated in Israel and the Netherlands.
First reported Mar 11, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise has detected a surge in exploitation attempts for two vulnerabilities—one flagged as a top target by government agencies and another flying under the radar despite real-world attacks. See the latest exploitation trends and why real-time intelligence is essential for risk management.
First reported Feb 11, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise recently observed a coordinated spike in malicious activity against Apache Tomcat Manager interfaces. On June 5, 2025, two GreyNoise tags — Tomcat Manager Brute Force Attempt and Tomcat Manager Login Attempt — registered well above baseline volumes, indicating a deliberate attempt to identify and access exposed Tomcat services at scale.
First reported Jun 10, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise reports attackers using rotating IPs to exploit Microsoft RDP timing vulnerabilities, targeting RD Web Access and RDP login enumeration to evade detection.
First reported Oct 20, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
Two critical Ivanti zero-days (CVE-2025-4427 and CVE-2025-4428) are now being actively exploited after a surge in scanning activity last month. When chained together, these vulnerabilities enable unauthenticated remote code execution on Ivanti Endpoint Manager Mobile systems.
First reported May 16, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise uncovers a stealth campaign exploiting ASUS routers, enabling persistent backdoor access via CVE-2023-39780 and unpatched techniques. Learn how attackers evade detection, how GreyNoise discovered it with AI-powered tooling, and what defenders need to know.
First reported May 28, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
On 24 September 2026, a malicious cyber actor (MCA) used 149.104.78.141 to attempt zero-day exploitation against a Citrix NetScaler Gateway. At the time, there were no CVE-specific detections for the attack due to it occurring pre-disclosure. However, GreyNoise still detected and labeled the activity as fundamentally malicious within seconds due to behavioral detections.
First reported Sep 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
A spike in botnet traffic from a single utility in a rural part of New Mexico led to the discovery of a global botnet. Explore how human-led, AI-powered analysis exposed compromised devices, uncovered attack patterns, and why defenders should take note.
First reported Jul 24, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
Over the last 30 days, nearly 24,000 unique IP addresses have attempted to access these portals. The pattern suggests a coordinated effort to probe network defenses and identify exposed or vulnerable systems, potentially as a precursor to targeted exploitation.
First reported Mar 31, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
Learn how GreyNoise Feeds enable real-time, event-driven threat intelligence that eliminates polling delays—helping defenders react instantly to new exploits, IP threats, and zero-day activity.
First reported Oct 08, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise Tactics gives anyone running a Deception Sensor visibility into what adversaries do after initial compromise, automatically mapping qualifying sessions to the MITRE ATT&CK framework.
First reported Jul 31, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
Ransomware group Black Basta’s chat logs were leaked, revealing 62 mentioned CVEs (Source: VulnCheck). GreyNoise identified 23 of these CVEs as actively exploited, with some targeted in the last 24 hours. Notably, CVE-2023-6875 is being exploited despite not appearing in CISA’s KEV catalog — reinforcing the need for real-time intelligence beyond static lists.
First reported Feb 26, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise observed a 9X spike in suspicious scanning activity targeting Ivanti Connect Secure or Ivanti Pulse Secure VPN systems. More than 230 unique IPs probed ICS/IPS endpoints. This surge may indicate coordinated reconnaissance and possible preparation for future exploitation.
First reported Apr 23, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise deployed MCP honeypots to see what happens when AI middleware meets the open internet — revealing how attackers interact with this new layer of AI infrastructure.
First reported Nov 05, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
On March 3, 2025, the Cybersecurity and Infrastructure Security Agency added five vulnerabilities to its Known Exploited Vulnerabilities catalog, confirming their exploitation in the wild.
First reported Mar 04, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
GreyNoise has identified a significant escalation in malicious activity targeting Palo Alto Networks GlobalProtect portals. Beginning on 14 November 2025, activity rapidly intensified, culminating in a 40x surge within 24 hours, marking a new 90-day high.
First reported Nov 19, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence record
The public shared-host view reaches the newest 2,400 matching records. Narrow the filters or search an exact MD5, SHA-1, or SHA-256 value to reach a specific record.
A filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.