Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
19 IOCs
GreyNoise Labs Weekly OAST (Well-known Out-of-band Interaction Domains) Report • Week Ending 2026-01-09
Excerpt
GreyNoise observed 30,165 sessions from 64 unique IP addresses containing Well-known Out-of-band Interaction Domains during the week of January 3-9, 2026. Analysis reveals three distinct operational clusters: a high-volume MCP server command injection campaign from a single OVH IP ( 51[.]77[.]116[.]46 ), a coordinated React2Shell (CVE-2025-55182) exploitation effort spanning four IPs across three ASNs, and opportunistic multi-vector scanning from MEVSPACE infrastructure. All…
Read the original report →Diamond Model
Adversary
Infrastructure(6)
Capability
Victim
Indicators of Compromise
Open the mindmap →19 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 209.38.59.248 | High | Score 58/100 | First seen |
| IP | 104.28.214.4 | High | Score 58/100 | First seen |
| IP | 34.91.29.122 | High | Score 58/100 | First seen |
| IP | 80.191.90.190 | High | Score 58/100 | First seen |
| IP | 51.77.116.46 | High | Score 58/100 | First seen |
| IP | 195.24.237.218 | High | Score 58/100 | First seen |
| IP | 104.28.246.4 | High | Score 58/100 | First seen |
| CVE | CVE-2021-44228 | High | Score 80/100 | First seen |
| IP | 185.181.183.41 | High | Score 58/100 | First seen |
| CVE | CVE-2025-55182 | High | Score 82/100 | First seen |
| IP | 188.212.125.110 | High | Score 58/100 | First seen |
| IP | 34.91.156.181 | High | Score 58/100 | First seen |
| IP | 198.98.61.39 | High | Score 58/100 | First seen |
| IP | 82.154.215.52 | High | Score 58/100 | First seen |
| IP | 34.91.237.187 | High | Score 58/100 | First seen |
| CVE | CVE-2025-8943 | Medium | Score 54/100 | First seen |
| IP | 94.26.88.61 | High | Score 58/100 | First seen |
| IP | 34.32.217.222 | High | Score 58/100 | First seen |
| IP | 139.59.217.230 | Medium | Score 61/100 | First seen |
IOC Relationship Graph
Building graph…