Published file metadata, source observations, indicators, and research history in one bounded catalog.
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.
At GreyNoise, our sensors attract attackers so you don’t have to. We take the hits, learn from every attack, and share insights so you stay safe.
First reported Oct 24, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordOn October 3, 2025, GreyNoise observed a ~500% increase in IPs scanning Palo Alto Networks login portals, the highest level recorded in the past 90 days. The activity was highly targeted and involved multiple, potentially coordinated scanning clusters.
First reported Oct 03, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise intelligence is now available across the CrowdStrike Falcon platform, bringing internet-wide scanning context to SIEM queries, SOAR workflows, and AI-driven triage.
First reported Mar 04, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise compared 119,842 malicious IPs against 11 major threat feeds. The average coverage: just 2%, exposing the limits of static blocklists.
First reported May 22, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise detected a surge of 7,000+ IPs attempting to log into GlobalProtect, sharing fingerprints with a surge in SonicWall API scanning and earlier Palo Alto campaigns, exposing a persistent credential-based attack pattern.
First reported Dec 04, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordEdge vulnerabilities are a critical and growing threat. The 2025 DBIR reveals an eightfold surge in exploitation, yet many remain unpatched despite immediate risk.
First reported May 06, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise analyzed 2.97 billion malicious sessions over 162 days — and the patterns challenge assumptions about where edge defenses are strongest. From VPN targeting to infrastructure concentration to attackers rapidly rotating through fresh IPs, new research quantifies where the gaps are and what to do about it. Read the full findings.
First reported Feb 24, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordA comprehensive analysis of benign internet scanning activity from November 2024, examining how quickly and thoroughly various legitimate scanning services (like Shodan, Censys, and others) discover and probe new internet-facing assets. The study deployed 24 new sensors across 8 geographies and 5 autonomous systems, revealing that most scanners found new nodes within 5 minutes, with ONYPHE leading
First reported Dec 23, 2024 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise is bringing awareness to in-the-wild activity against several known vulnerabilities (CVE-2020-8515, CVE-2021-20123, and CVE-2021-20124) in DrayTek devices.
First reported Mar 25, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise observed two scanning surges against Cisco Adaptive Security Appliance (ASA) devices in late August including more than 25,000 unique IPs in a single burst. This activity represents a significant elevation above baseline, typically registering at less than 500 IPs per day.
First reported Sep 04, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise customers can turn any GreyNoise query directly into a real-time blocklist for their firewall, SOAR, or other enforcement points.
First reported Nov 19, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise has begun seeing active exploitation of CVE‑2025‑64446, the critical path‑traversal flaw that lets an unauthenticated actor run administrative commands on Fortinet FortiWeb appliances.
First reported Nov 19, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise is already seeing opportunistic, largely automated exploitation attempts consistent with the newly disclosed React Server Components (RSC) “Flight” protocol RCE—often referred to publicly as “React2Shell” and tracked as CVE-2025-55182.
First reported Dec 05, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordTwo months after CVE-2025-55182 was disclosed on December 3, 2025, exploitation activity targeting React Server Components has consolidated significantly.
First reported Feb 02, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordA new SonicWall scanning surge mirrors the pattern that preceded CVE-2026-0400. GreyNoise details the activity and what defenders should watch.
First reported May 21, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise is tracking a coordinated, automated credential-based campaign targeting enterprise VPN authentication infrastructure, with activity observed against Cisco SSL VPN and Palo Alto Networks GlobalProtect services.
First reported Dec 17, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise is observing automated scanners posing as the web crawlers of OpenAI, Anthropic, DeepSeek, and Fortune 500 companies, using forged user agents while requesting the files where misconfigured web servers frequently leak secrets and credentials.
First reported Aug 28, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordAttackers are automating exploitation at scale, targeting both new and old vulnerabilities — some before appearing in KEV. Our latest report breaks down which CVEs were exploited most in 2024, how ransomware groups are leveraging mass exploitation, and why real-time intelligence is critical.
First reported Feb 27, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise observed a significant increase in crawling activity targeting Git configuration files. While the crawling itself is reconnaissance, successful discovery of exposed Git configuration files can lead to exposure of internal codebases, developer workflows, and potentially sensitive credentials.
First reported Apr 28, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordA PoC for CVE-2026-1731 hit GitHub on Feb 10. Within 24 hours, GreyNoise observed reconnaissance probing for vulnerable BeyondTrust instances.
First reported Feb 12, 2026 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordSilk Typhoon-linked CVEs are under active exploitation. GreyNoise observed 90+ threat IPs exploiting them in the past 24 hours, following Microsoft’s report on the group's evolving tactics.
First reported Mar 06, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordAttackers exploit vulnerabilities within hours of PoC releases. Learn how GreyNoise provides real-time intelligence to detect and disrupt threats, helping defenders respond faster and stay ahead of evolving risks.
First reported Dec 10, 2024 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordCVE-2024-40891: Zyxel CPE Zero-day Exploitation. Hackers are actively exploiting a telnet-based command injection vulnerability in Zyxel CPE devices, impacting 1,500+ exposed systems. No patch is available yet.
First reported Jan 28, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordGreyNoise data confirms that exploitation of CVE-2024-4577 extends far beyond initial reports. Attack attempts have been observed across multiple regions, with notable spikes in the United States, Singapore, Japan, and other countries throughout January 2025.
First reported Mar 07, 2025 00:00 UTCCatalog metadata updated Oct 08, 2026 03:52 UTCOpen evidence recordA filename, label, or report mention alone does not establish maliciousness. Observation dates describe cited sources; collection dates describe this local metadata catalog. No malware samples are stored, fetched, or executed by these pages.